Troll 2 is another intentionally vulnerable Linux VM which is a bit harder than its predecessor.
We're going to cover the enumeration and exploitation of it over the course of this lecture.
You can grab Troll 2 from my google drive download it.
Double click the overlay file imported make sure you have it configured as host only.
Start it up and we will now go over to Kelly Linux to get started.
Find the IP address with net discover
once the IP for Troll 2 is discovered.
We will now use and map scan
the results of the map scans show that we have FTB over port twenty one SSA over for to an Apache web
server over port 80.
First let's check out port 80 so I'm just going to open up Firefox
type in the IP address of Troll 2
Okay.
We have some picture here and just going to right click view page source.
Nothing here.
Try harder.
Author of troll that is a potential username.
So let's just take that information.
Doesn't seem like there's anything else of use here.
Okay let's go over to a terminal real quick and I'm going to try to log in to f T.P. using that username
and same password so username of troll and password troll so FTB IP address of Troll 2
OK we're able to authenticate using those credentials see what we have here.
LMA m not zip.
Just grab that file nothing else here somewhere to quit out of FTB
so let's take a quick look at that LMA o zip file here.
Click files over here and your applications and should be in the home folder.
Here it is and let me out zip.
I'm going to try to extract it.
Okay so it has a password required which we not have yet.
It's just structural.
No.
Okay.
So we need to figure out the password or brute force it somehow.
So let's move on and see if we can find any thing else by enumeration.
Back to one of your terminals.
And we're going to try.
Darby against the Web site.
So Darby IP address Troll 2 that run okay for a short amount of time we have a couple accessible directories
and files.
Just go to robot dot techs sort of right click that Okay so we have a bunch of directories here.
Just going to copy all these I'm going to use Darby to run through them see if any of these directories
are accessible.
So back over to your terminal that's going to create a file named Ders.
Copy paste all those directories that I just copy say that let's try right the commander bee IP address
of Troll 2.
Hey we're going to use that word loose that I just created.
Okay so we can access four of these directories.
Let's take a look at all of them.
Just gonna right click each one open it in firefox.
Here they are.
It's like we have four of the same picture here.
So let's download all of these pictures and see if we can analyze them to see if there's anything interesting
in any of them.
Okay.
So I'm just going to right click Save image as well then rename them so I can keep track.
I have one
too.
Three
and Four.
All right.
So just go over your Downloads folder
okay.
Let's take a look.
I'm just going to tell us everything that starts with Kat and I'm going to UCLA switch.
Take a look at the file sizes.
Okay.
So for Kat the Troll 3 see that there's a very slight difference in file size.
So since that's different from all the other ones.
Let's take a look at that.
Would you just use the strings command.
And I'm going to specify that file that says a slightly different file size
okay.
My eyes are immediately drawn to the bottom it says look deep within yourself for the answer.
So let's just copy yourself.
Could be a web directory and go back to Firefox.
Just paste that in here
OK.
We have a file answer dot text.
Just gonna check that out.
All right it looks like a bunch of base64 encoded strings here just gonna go ahead and control a control
C to copy all those and I will put them in a file back in my own directory and I'm going to create a
file named base64.
I'll just paste all those base64 encode strings.
There's a lot of them.
So it's taken a little while
OK I'm going to see that file and we have to decode these base64 encoded strings I'll show you how to
do that now with command line just 64 five I think the code base64 that is the name of the file I just
created like that to sort I saw to unique that is going to eliminate all but unique strings.
And then I would redirect that to a new file named decoded.
All right.
Those very quick.
So let's take a quick look at that file less to code.
OK so this looks like a password list.
And if you remember we have a password protected file LML got zip.
So what I want to do is try to use this as a password word list using f crack zip to try to brute force
the password of LME out zip.
So let's just give that a shot.
We have LME Oh Dot zip here in the home folder along with the file that I want to use decoded so when
I type in F cracks zip I find you.
I d I think P decoded LME Oh Dot zip.
So this is going to do as I just said.
We're going to use it password list of Decoded and we're going to try to brute force the password for
LME Oh God zip
OK immediately we have found the password it can't really be this easy.
All right.
Elwell
OK let's just grab this password and try it out.
So we have LME Oh Dot zip.
We're going to extract here
quick extract extract put in this password click OK.
Good.
Extraction completed successfully.
So let's take a look at who was going to open it with less.
OK.
So looks like we have an SSA key private key.
So this should allow us to log in to SS each very good
okay.
So we haven't found any user names other than troll yet and I've already tried troll as a username.
So I'm going to now guess that newb is the user name and we're trying to utilize the census data private
key.
So first I'm going to change the permissions of the private key or else it won't work.
And now try SSA noob at IP address of Troll 2 using the private key of new
okay.
So it gives us a message.
Try harder Ella.
Well it's not going to be that easy.
Let's take a closer look at what has transpired over SSA by increasing the verbosity of the output
so let's just type in SSA hyphen v v for increased verbosity noob at IP address of Troll 2.
I've been high in the private key all right.
So taking a look at what happened before the message was prompted here.
We have remote forced command.
Now it's common knowledge that forced commands are potentially vulnerable to Shellshock.
If I didn't know that information here's how I'd find out.
So we have force command vulnerability.
I'm just going to Google that and we have immediately this article here and snack change.
How can shellshock be exploited over SS H.
It has some information here regarding shellshock and it even has some proof of concept right here that
we could actually just copy and paste and use if it is indeed vulnerable.
So you can read this on your own time I'm going to go ahead and try to exploit it to see if it is actually
vulnerable
so I'm going to paste in a very simple shellshock exploit.
This is going to try to execute the command echo shellshock so if we receive the text back shellshock
then it should be vulnerable.
OK so we're able to execute the command echo shellshock before the other command was executed to print.
Try harder.
Well so let's try with this method to spawn a shell instead of echo the same thing.
Only difference is we're trying to spawn bin bash.
Okay good.
So we have a shell now.
No one more interactive shell so I'm going to go ahead and generate a public SS key on Cally Linux and
add it to the authorized SS H keys on Troll 2.
So first step will be to generate this key SSA type and key Gen i would be 2048 and specify RSA.
Gonna put it in this default location no passphrase.
OK.
I'm just going to cat that file.
Here is
the private key so go over to
public key which is right here.
So sure what I did.
I'm in route for flash datasets H.
And here is the public key going to get that.
All right.
So we're going to copy that public key.
Go back to our limited shell here.
Just type in Echo double quote paste that public key double call redirect that to dot SS H or slash
authorized underscore keys.
All right.
Now we should be able to use the private key that is associated with that public key and get a more
manageable SSA session.
So I'm going to go ahead and clear that out and we are going to type in New IP address of Troll 2.
AN I.
That s s h for Slash I.T. underscore RSA.
That's our private key that is associated with the public key that we just added to the authorized keys
over there on Troll 2 OK.
Very good.
Now our next step is to escalate privileges to.
So I'm going to use this find command here what it does essentially is to look for anything with root
permissions within three directories of the Ford slash directory and it will redirect errors to give.
And also we won't see them
OK.
The most interesting thing I see here is this directory nothing to see here and looks like a series
of doors.
1 2 and 3.
So let's go ahead and check those out.
Okay so we have door 1 2 and 3
just go to door number 1 see what's in there.
So we have a an executable route.
So let's just try to execute that okay.
It says it is accepting input.
So let's try to throw a couple hundred or so throw a thousand characters at it thousand eight characters
at it and see what happens.
Okay.
So dot for Slash root dollar sign would you use python to just print a thousand eight characters so
eight times a thousand
OK.
We have an segmentation fault.
So that means that we should be able to create a custom buffer overflow exploit and possibly get a root
Shell as a result.
So I will show you how we will do that.
First of all we need to go back to Kelly Linux and I'm going to create a pattern of 1000 characters
using a ruby script called pattern create.
So just locate that we have it right here.
So going to copy this full path pattern create an L for a length of 1000 just wait until that populates
with our pattern of 1000 characters so why we're doing this is we want to find a offset match.
So we want to find the length at which this executable has crashed.
We need this information in order to make a functioning buffer overflow exploit.
So we have that we're just going to copy these thousand characters go back to our as a six session here
and we are going to
just type in GDP for the new debugger and root
case something happened here.
OK.
So the file disappeared.
This is Troll 2 it's going to frequently kick you off change the location of where your executable is
are due.
This is the how do our 1 2 and 3 work.
So you could have different results than me just have to have to deal with it.
So
let's see if this is the correct one.
Two men in hard mode.
So what hard mode does it just limits your ability to use less when we know where everything is.
So just go back and go to door 3.
Here's Eliza.
OK.
So this is the correct one we found it.
But as I said it's going to change between Door 1 2 and 3 so you just have to stay on top of that.
All right let's try that again.
So GDP rule.
OK.
And we were going to type in R and just paste in that B thousand pattern that we just copy
right.
So let's just take this
go back to Kelly lyrics that we're going to use pattern offset
disk located that put in the full path Q And we're going to use that value that we just found from using
that pattern create thousand characters
today we have an exact match at offset two hundred sixty eight.
Document that information and let's move forward with our buffer overflow exploit.
Now I want to see if I can reliably control the VIP or extended instruction pointer so if I can overwrite
that VIP after using two hundred and sixty eight eight characters with four B characters that means
that I should be able to reliably control overwrite the IP and hopefully execute shell code in an address
such as jam PSP which I'll show you how to do.
So first of all to use the new debugger right now we're going to type in our dollar sign.
We're going to use Python again.
We're just going to print two hundred and sixty eight days so eight times two hundred sixty eight plus
B times four.
So we're just going to try to override that IP as I previously stated All right.
You can see right here it was overwritten with four forty 2s which is the hexadecimal equivalent of
B.
So we at this point have determined that we can reliably overwrite the E IP it's just quit that we have
more work to do.
Now I'm going to run the new debugger using the EMV command and unset the environment variables to avoid
getting an invalid address for ESPN since it is crucial that we have the correct address in which to
execute shell code to get our root shell.
So first things we're going to do is EMV hyphen GDP root.
Okay.
They have moved the binary again and now in hard mode so I can't use unless it's go to a different door.
That one reboots it if you don't kill it right away.
So tried door three
to mere hard mode again the back door to.
Okay.
There's a correct binary so let's try that once again.
So EMV hyphen GDP Ruth
their GDP.
OK.
Now I want to show the environment we're going to unset both of these variables.
So unset in V lines uncertainty in V columns.
Good.
Now what I want to do is run another Python command.
It's going to print 268 days for BS and 16 backslash X 90s which is a knob sled and one hundred CS then
we're going to look at do memory and see the ESB address that we're going to use for our final exploit.
So I'm just gonna paste that real quick here.
As you can see printing 268 days for BS in bobsled and 100 cs OK.
Very good.
It's overwritten with the four B's.
Let's just type in info registers
OK.
Here you go.
This is the address that we're going to utilize in the final exploit.
And I will feel you have that is done.
I should know real quick that this address is not going to be copied as is we're gonna have to convert
it to bite code which means we're going to have to add an x in front of each one of these and and we're
going to write it in reverse.
I'll show you how that's done but it's basically gonna be backslash X 80 backslash X FC and so on.
So you'll see that soon I'm just gonna exit out of this
versus go back to a Kelly Linux shell.
We're going to have to run an MSF then on command to generate our shell code so as you can see here
we're running just a command DNS H to spawn a roof shell.
It's in the format of Python.
We have a couple bad characters here just these are generally known as bad characters.
And then we have architecture of 32 bit and encoder of Chicago good.
So just run that we're going to take that output and clean it up a bit so we can use it with Python.
All right so I'm just going to copy all that and we're going to remove all these double quotes in the
buff over here.
So it's just all we want is the shell code.
I'll show you how that looks after I clean it up okay.
So here it is.
I just removed the buff plus ghouls and all this other all these spaces and double codes.
So this is the show code that we're going to use in the final exploit.
All right we'll go back to our SSD H
okay.
Let's take a look at our last command.
We have envoys used before and we have our group binary and printing.
Two hundred and sixty eight A's followed by the ISP address we acquired earlier from the info register
command and we have a not slide of 16 and the MSF then payload that we generated.
So this should be all we need to get a root shell hopefully.
OK.
There we go.
That's crucial.
See right there.
Right.
Go ahead and go to the root directory.
We got proof dot text.
Very good.