【WriteUp】Kioptrix Level1.1 - 明日は明日の風が吹く

はじめに

またいつぞやのリベンジ

Kioptrixの続編を独力でプレイ

使用ツール

nmap

nikto

dirb

偵察

% nmap -sS -sV -A -T5 -p 1-20000 192.168.3.30

Starting Nmap 7.80 ( https://nmap.org ) at 2020-03-28 11:15 EDT
Nmap scan report for 192.168.3.30
Host is up (0.0012s latency).
Not shown: 9993 closed ports
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 3.9p1 (protocol 1.99)
80/tcp open http Apache httpd 2.0.52 *1
111/tcp open rpcbind 2 (RPC #100000)
443/tcp open ssl/https?
631/tcp open ipp CUPS 1.1
784/tcp open status 1 (RPC #100024)
3306/tcp open mysql MySQL (unauthorized)
MAC Address: 00:0C:29:EF:7A:CC (VMware)

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 23.49 seconds

結果、動作しているサービスは以下

22/tcp open ssh OpenSSH 3.9p1 (protocol 1.99)
80/tcp open http Apache httpd 2.0.52 *2
111/tcp open rpcbind 2 (RPC #100000)
443/tcp open ssl/https?
631/tcp open ipp CUPS 1.1
784/tcp open status 1 (RPC #100024)
3306/tcp open mysql MySQL (unauthorized)

% dirb http://192.168.3.30

-----------------
DIRB v2.22
By The Dark Raver
-----------------

START_TIME: Sat Mar 28 11:15:48 2020
URL_BASE: http://192.168.3.30/
WORDLIST_FILES: /usr/share/dirb/wordlists/common.txt

-----------------

GENERATED WORDS: 4612

結果、めぼしいものは特になし

%nikto 192.168.3.30

- Nikto v2.1.6
---------------------------------------------------------------------------
+ Target IP: 192.168.3.30
+ Target Hostname: 192.168.3.30
+ Target Port: 80
+ Start Time: 2020-03-28 20:56:51 (GMT-4)
---------------------------------------------------------------------------
+ Server: Apache/2.0.52 (CentOS)
+ Retrieved x-powered-by header: PHP/4.3.9
+ The anti-clickjacking X-Frame-Options header is not present.
+ The X-XSS-Protection header is not defined. This header can hint to the user agent to protect against some forms of XSS
+ The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type
+ Apache/2.0.52 appears to be outdated (current is at least Apache/2.4.37). Apache 2.2.34 is the EOL for the 2.x branch.
+ Allowed HTTP Methods: GET, HEAD, POST, OPTIONS, TRACE
+ Web Server returns a valid response with junk HTTP methods, this may cause false positives.
+ OSVDB-877: HTTP TRACE method is active, suggesting the host is vulnerable to XST
+ OSVDB-12184: /?=PHPB8B5F2A0-3C92-11d3-A3A9-4C7B08C10000: PHP reveals potentially sensitive information via certain HTTP requests that contain specific QUERY strings.
+ OSVDB-12184: /?=PHPE9568F34-D428-11d2-A769-00AA001ACF42: PHP reveals potentially sensitive information via certain HTTP requests that contain specific QUERY strings.
+ OSVDB-12184: /?=PHPE9568F35-D428-11d2-A769-00AA001ACF42: PHP reveals potentially sensitive information via certain HTTP requests that contain specific QUERY strings.
+ Uncommon header 'tcn' found, with contents: choice
+ OSVDB-3092: /manual/: Web server manual found.
+ OSVDB-3268: /icons/: Directory indexing found.
+ OSVDB-3268: /manual/images/: Directory indexing found.
+ Server may leak inodes via ETags, header found with file /icons/README, inode: 357810, size: 4872, mtime: Sat Mar 29 13:41:04 1980
+ OSVDB-3233: /icons/README: Apache default file found.
+ 8725 requests: 1 error(s) and 17 item(s) reported on remote host
+ End Time: 2020-03-28 20:58:08 (GMT-4) (77 seconds)
---------------------------------------------------------------------------
+ 1 host(s) tested

結果、こちらも特にめぼしいものはなし

普通にブラウザで確認すると、ログイン画面らしきものが出てくる

f:id:syachineko:20200331091547p:plain

侵入

SSH上での侵入を試みる

kali@kali:~/SyachinekoLab/workspace/VulnHub/Kioptrix1.1$ ssh 192.168.3.30
kali@192.168.3.30's password:
Permission denied, please try again.
kali@192.168.3.30's password:
Permission denied, please try again.
kali@192.168.3.30's password:
kali@192.168.3.30: Permission denied (publickey,gssapi-with-mic,password).
kali@kali:~/SyachinekoLab/workspace/VulnHub/Kioptrix1.1$ ssh admin@192.168.3.30
admin@192.168.3.30's password:
Permission denied, please try again.
admin@192.168.3.30's password:
Permission denied, please try again.
admin@192.168.3.30's password:
admin@192.168.3.30: Permission denied (publickey,gssapi-with-mic,password).
kali@kali:~/SyachinekoLab/workspace/VulnHub/Kioptrix1.1$ ssh root@192.168.3.30
root@192.168.3.30's password:
Permission denied, please try again.
root@192.168.3.30's password:
Permission denied, please try again.
root@192.168.3.30's password:
root@192.168.3.30: Permission denied (publickey,gssapi-with-mic,password).
kali@kali:~/SyachinekoLab/workspace/VulnHub/Kioptrix1.1$