The first system that we're going to work on is Troll 3.
You may recognize this if you took my first course in the hands on penetration testing lab series in
which I covered troll 1 and Troll 2 since I had a lot of fun with those I wanted to go ahead and include
this one in my new course.
Go ahead and double click the Troll 3 dot over a file you can get this from my google drive.
If you don't have it yet please go back to the previous lecture which covers downloading the vulnerable
virtual machines that we'll be using for the remainder of this course so double click the V.A. file
that's going to launch your virtual box manager.
If you do not have virtual box please go ahead and download the most recent version of a virtual box
dawg.
So now we're going to click import
once the import is done make sure that you have your settings correct for Troll 3 so right click Troll
3 click on settings.
Now go to the Network tab all right.
It is currently set to bridge the adapter.
We want to set it to host only adapter.
This is gonna allow us to use an internal local area network to communicate to and from the Kelly Linux
VM so that's all we need.
We do not need internet connectivity with this vulnerable VM so click OK with Troll 3 highlighted click
Start.
Now if you do not have your Kelly Linux VM on yet you want to go ahead and start that up as well.
If Troll 3 booted up properly.
This is the prompt that you're going to see says Are you sure you want to do this.
Log in.
Start calling here.
So this is a piece of information that could be potentially useful.
Possibly a username and a password it could be nothing but let's just remember that and go over to Kelly
Linux.
Go ahead and open up a terminal
make that a little bit bigger.
OK.
So the first thing that we want to do in all of these challenges is do you find the IP address of the
target machine.
Since we're in a local area network and the host only interface we're going to be able to use Net discover.
So it's going to show you real quick.
This is the host only interface for my Kelly Linux VM.
If you are using the Kelly Linux VM that I provided in the course you will see something similar to
this.
Otherwise you can use your own Kelly VM but if you have any issues connecting you can go ahead and just
use the one I have set up for you.
So we have each one which has the IP address of 1 or 2 1 6 8 dot 5 6 dot 1 4 9 and we are going to use
that to connect to the troll 3 VM.
So let's just clear that out.
Type in net discover hyphen.
I eat VH 1.
That's going to be using that interface which is the host only interface and we're going to search for
the IP address using ARP or address resolution protocol
as you can see here the IP address was discovered.
If you're wondering what dot 1 and Dot 100 are the DOT 1 is the IP address assigned to the host system
and the DOT 100 is the IP address of the virtual DHS CPS server.
These IP addresses are always gonna be here in virtual box regardless of what systems are connected
to the local area network.
So just ignore them going forward.
I mean just go ahead and copy that IP address here.
Now let's use an N map scan in order to see which ports are open.
We're going to be using an end map scan with the hyphen capital a switch which is going to enable OS
detection version detection script scanning and trace wrap.
So I'm going to type and map hyphen capital leg and the IP address which I just copied from the net
discover results.
So just press enter and wait for a little bit for that to finish
as you can see there's only one port open which is the common port for secure shell or SS H port twenty
two.
This is not usually an easy protocol to exploit.
Let's enumerate the service further with another and map command so I'm going to go ahead and clear
that out and we're going to type in and map hyphen P specify port 22.
I've been lowercase s capital V that is going to initiate a service scan and we're going to use a script
scan with the directives default safe that is going to use all of the end map and see scripts related
to that specific port which is 22 without using any exploits that could potentially result in a denial
of service or other negative unforeseen consequences so we're going to go ahead and type in the IP address
and press enter
OK.
So we've enumerated the version seven point six P one of open SS H.
This is not directly exploitable based on any publicly known exploits.
So the next step is to try to manually connect the service.
So if you remember we found something in the banner just closes real quick and take a look at the banner.
So take a look at that says Are you sure you want to do this.
Log in start colon here.
So I had this theory that maybe start was a user name and here's a password.
Let's just try that
clear this out real quick and I'm just going to SS H using the user name.
Start typing that IP address so SS H start at IP address
typing yes.
And we are going to use the password here
all right.
So now we are in.
Let's check out what we can find.
I'm just gonna go ahead and clear that out.
And unless the directory we have to directories here blue pill and red pill I'm going to go to blue
pill first.
We have a file here called awesome work.
Just going to see what type of file that is text file.
So I'm going to catch that.
All right.
We have a U or L here and are reluctant to just go straight to it.
So I'm going to make sure that it's safe before we go to it.
Copy that or to a web browser and I'm going to unsorted this link is that but this is it's a shortened
link so you have no idea where it's going to lead to just going to go to on Shorten.
Got me no plug that right in there and on Shorten that link.
OK.
Looks like the Your L is going to be an image or a query in this this Web site.
How do you make a hacker waste time.
All right.
So that's a safe link to go to.
I'm just going to go to a fun here.
So it's just showing us how to google how to make a hack or waste time.
That's very good.
All right so let's assume that this is a dead end and keep moving on it's going to clear that out.
We're going to go back one directory and go to the Red Pill directory have another text file named.
This will surely work.
So I'm going to just right candidate step two in a password so maybe that is another account that we
can access H2.
Let's try that OK.
So I'm just going to type control shift t to create a new tab and make that a little bit bigger and
we're going to try to SS H into that user name was step two and the IP address of Troll 3.
And I have the password on my clipboard it was password one explanation point right here and it did
not work.
So they have told us two times so far.
It's just go back to our working as the sage session.
Now we're going to utilize a fine command that is going to start in the forward slash or root directory
searching for type F which stands for files with permissions of 0 7 7 7 which is read write and execute.
It's essentially looking for files that we can access the dev null here is to suppress errors for a
nice clean output.
Let's go ahead and presenter and see what we get.
All right as you can see here we have a dot cap file and a dot text file.
These files could be interesting.
We have network traffic and the cap file and some text in the gold stored text file.
So let's copy them over to Kelly so we can analyze them for this task.
We'll be using secure copy or MCP.
So I'm just gonna create another tab here and I'm going to type in SGP.
Start at IP address of Troll 3 colon.
And I'm going to copy over this file path here
space Dot.
That's just going to drop it right in my route home directory
so the password is here.
Okay.
First one's done.
Now let's just do the same exact thing.
Start at IP address of Troll 3 then let's copy this giant file path here.
Same thing.
Drop it right here in the home directory into the password again.
Very good.
So now we have both of the files here and roots home directory.
And right here gold started out text and White Shadowed our cat OK.
So let's take a look.
The text file first So type in V.
Gold star out text
all right.
So looks like we have a bunch of strings here.
Down here at the bottom you'll see the amount of lines in the file so there are over three million.
That's password list possibly of over three million passwords here.
Go ahead and exit out of that.
Let's take a look at the packet capture.
Now
so you can use wire shark if you want.
If you're more comfortable with that.
But I like using TGP dump.
It's a protocol analyzer that is used over the command line.
It's useful in situations where you do not have access to the gooey or graphical user interface.
Let's say you have hacked a machine you have SSA access or reverse shell of some sort.
And you can't use wire shark obviously because you don't have a gooey but you can use TCB dump to sniff
their traffic for example.
So anyway we're going to type in TCB dump Ivan in and Titi Titi A R.
What this does is the end end basically makes it to where the port numbers don't resolve to the names
the T T is just changing the time format to a human readable the capital a is to print ASCII format
and the R is to read the following file so the files name was White Shadow dot cap and I'm going to
go ahead and pipe that to less it's just going to put it in the results from the CCP dump command is
going to be piped into left so we can read it easier
OK so if you've never seen wireless network traffic before these are a bunch of d authentication packets
here all right.
So go down
went all the way down to the end.
So what you see here are a bunch of acknowledgements and data Ivy so what Ivy stands for is initialization
vector which is a common number that's used with a secret key for wireless authentication.
So what's happening in this peak app is known as the 8 0 2 dot eleven association process which is required
to be carried out before a device can connect to a wireless network.
So what we have here is this dot cap file with wireless traffic in it and a potential password list.
Let's see if we can leverage the Wi-Fi attack tool air crack in g to recover any passwords from the
captured network traffic.
So I'm just going to exit out of this.
Now we're going to type air crack iPhone G.
Ivan w we're going to be specifying the word list which is the gold star dot text file and we are going
to specify the packet capture file which is white shadow dot cap.
Press enter
let that run it's going to take five minutes to complete.
Running through this word list
very good to after a couple of minutes we found a key
logic would tell me based on the artifacts that we observed in the P cap and the name of the file that
white shadow would be the user name and this key could be the password for us S H.
So let's go ahead and put that theory to the test.
I'm going to just create another tab here and we're going to try to SS H white shadow at IP address
of Troll 3 and I'm just going to go back here and copy this password.
Try that out
OK.
Very good.
Now we're in with a new user White Shadow.
It's going to clear that out and let's see what we can find in here.
So just tell us the home directory we have this executable called Move fun let's just run that see what
happens
all right.
Looks like it's going to scroll I'm crazy like a lynx I'm just going to do control seed and that it's
clear that okay let's just quickly run a pseudo hyphen L to see if we have any pseudo permissions supply
that password here OK so we have the ability to run engine X starts as pseudo as root
right so now that we know that we can run engine X start as root.
Let's try to abuse that to gain privilege escalation or root.
So we're going to go to Etsy engine X and I'm going to take a look at these sites enabled directory
see if there's going to check out the default file here.
So use that configuration file.
So the default server configuration.
All right.
So I see that it is listening on port 80 80 and I see this user agent links.
So if you recall earlier when we ran that binary it said crazy like a links over and over that could
be a clue clearing us in on what we may have to do here.
We maybe have to utilize this linked service over port 880 some in some way so let's check that out
OK.
So let's see if the service is actually running.
I'm going to type a net stat any A.P. Okay so we do not have a process running over port ADHD but we
were told earlier to run a command pseudo service engine X start okay let's just run that again.
All right.
So now we are listening on port 80 80.
As you can see right here right so let's just move over to another tab here and I'm going to see if
I can connect to it over links
all right.
So simply type lengths HDP cone for size forward slash and the IP address of Troll 3 colon ADT with
the port number.
Press enter all right.
So we've connected and it looks like we have a username and password.
So we're going to just copy that.
See if we can SSA into that
all right.
So assess each we got the username Jen Lux at IP address of Troll 3 I'm just going to copy you over
that password.
All right.
We found another legitimate account so let's just clear that out.
Take a look at what we have in here.
K.
so we have a private key.
Let's take a look at that Milius.
All right.
That looks like an SSA key.
Maybe we can use that to further escalate privileges and see a pile them ex log in as well.
So let's focus on this as a stage key.
Just gonna copy that
easier than
copying it over.
Just copy the text and I'm going to create a file as there's a key just paste that text in there.
Save it
OK.
So let's modify the permissions.
This command 600 SSA key and now we're going to try to SS H into the user Malley is with this as a stage
key so to do that we'll type SS H Malpass at IP address of Troll 3.
I find I SSA key we're going to be utilizing this private key with the user name of malice to try to
log into Troll 3 All right.
So we have found yet another user
Okay so let's see what we have here
if a file called Don't even bother.
So an executable so let's try.
All right.
Says enter the password.
We do not know what the password is
try Malia's
right.
So we're gonna have to figure out what the password is somehow
so let's analyze the metadata in this file a bit using these strings command so strings don't even bother.
All right it's going to go up a little bit so I see here enter the password and then it has the string
right under enter the password that could be the password right there.
So looks like it.
Let me try that out so let's just execute don't even bother enter that password and it says correct
password.
Your reward is just knowing you did it.
So let's save this password it might be useful for something else later down the road
okay.
Let's take another look here in the directory we have this file them info.
Check that out
so I see here under registers.
Another potential password is going to copy that real quick.
So we have two passwords now one that we found in the binary and one we found in the vim info file.
So it's just clear that our real quick now let's see if we have any sudo privileges.
So just pseudo hyphen L..
All right.
So we have two passwords that we found earlier.
It's prompting us for a password here.
First one I'm going to try is the one we found in the binary
All right incorrect password.
I'm going to try the other one that we found in Vin info.
Very good.
OK so the correct password is the one that starts with capital B that we found in Vin info.
All right.
So let's see what we can do says we can run the following command control three home values.
Don't even bother.
So don't even bother was that binary that we just found so what we can do here is completely remove
the binary make a new one and use it to spawn a root shell since we can do it with Sudo we can run it
as root.
Therefore we can escalate our privileges.
I'm going to show you how to do that right now.
All right.
So first I'm going to remove this file.
Now I'm going to create a new file the same name but dot C. because we're going to have to create some
source code and then compile it to create the executable.
So OK we got some weird vim error just press enter to continue it says we'll do that.
And now I'm going to paste a simple piece of code what they're is going to do is set the group identifier
as you see here the G I.D. to zero and the user identifier or you I.D. to zero as well zero stands for
root in Linux and then is going to create a shell.
So we have four slash bin for size S H.
So go ahead and say that we got this little error here just press enter.
Don't worry about it.
And now we're going to compile our code so GCSE.
Don't even bother dot C..
IPhone 0 4 output.
And we're going to name it exactly the same thing.
So we can use sudo on this command.
Don't worry about those errors it's to be expected.
And now.
Use the command sudo don't even bother.
Just like we saw.
Up top.
Okay very good as you can see here.
We are now logged in as root and we have access to a flag.
Here you go.
Now we have successfully completed this challenge.
Let's move on to the next one.