alien Posted February 23, 2012 Report Posted February 23, 2012 (edited) Kioptrix Challenge #4 is a special system designed specially with weaknesses build into it. The goal is to gain highest privilege access(root).The VM image can be downloaded here: Kioptrix ? Challenge VM #4 finally done Videos:Limited ShellMethodScanned network for the target [Netdiscover]Port scanned the target [unicornScan]Banner grabbed the services running on the open port(s) [NMap]Interacted with the web server & logged into the system anonymously [Firefox & Burp Proxy]Discovered & exploited an local file inclusion vulnerably to enumerate possible users [burp Proxy]Logged into the Web UI as each user to discover their password in plain text [Firefox & Burp Proxy]Remotely connected to as a user and broke out of the limited shell [sSH]Enumerated the system environment to identifying limiting factors. [iPTables]Escalated privileges via a vulnerable kernel version [sock_sendpage]Accessed the 'flag' [Text file]SQL InjectionMethodScanned network for the target [Netdiscover]Port scanned the target [unicornScan]Banner grabbed the services running on the open port(s) [NMap]Interacted with the web server & discovered a the web application that is possibly subject to a SQL injection vulnerability [Firefox]Exploited the SQL injection and enumerated database [sqlMap]Uploaded a web shell backdoor [sqlMap & Netcat] (Limited user)Manually performed SQL injection injection to dump database [burp Proxy]Created a web shell on the target [burp Proxy & Netcat] (Limited user)Created a backdoor shell via a cron job [burp Proxy & Netcat] (Superuser)Accessed the 'flag' [Text file]Created a backdoor shell via a cron job [burp Proxy & Metasploit] (Superuser)Local file inclusionMethodScanned network for the target [Netdiscover]Port scanned the target [unicornScan]Banner grabbed the services running on the open port(s) [NMap]Interacted with the web server & logged into the system anonymously [Firefox & Burp Proxy]Discovered & exploited an local file inclusion vulnerably to enumerate possible users. [burp Proxy]Exploited the same local file inclusion to fingerprint the web service & inject code into the PHP session data [burp Proxy]Created a web shell on the target [burp Proxy & Netcat] (Limited user)Created a shell and to escalated privileges executed it from a service running as superuser [burp Proxy & Metasploit]Accessed the 'flag' [Text file]Credits and thanks to g0tmi1k Edited February 24, 2012 by alien Quote
alien Posted February 25, 2012 Author Report Posted February 25, 2012 Am dus pana la capat toate cele 3 tutoriale, daca aveti probleme sa-mi spuneti. Quote
