Welcome back to our continuation of the walk through for the CTF EVM version one.
Now, in this second video, we're going to be going through the exploitation and the privilege escalation
for this target.
And so without any further ado, let's go ahead and get started.
So let's go ahead and minimize our terminal.
And we're going to go over here to our terminal and launch a clean one, and at my new terminal, I'm
going to type in MSF consul.
I hit enter and now we're just going to let it roll on up, and once it gives us that metastable prop
will begin to look for the exploit that's going to give us that terminal over onto our target machine
so that my display prompt.
We type in the U.S command, followed by the export that we want to use.
Now you can do a search inside of Venice flight just by typing in search and then you can tell it what
you're looking for.
For instance, if we were looking for this exploit, I could type in search space, WordPress, and
then it would bring me up all of the different exploits that are available for WordPress.
And from that selection, I would then find this exploit.
I would then copy and paste it along with the U.S. command at the top.
And then I would hit enter.
You'll notice that my prompt changes to let me know that we are now using that exploit, so to see what
options have to be configured, we can type in show options.
And we see that we do have to set the remote host and we do have to set or we can set the local host
IP address, I recommend that you do set that local host IP address for this to work properly.
So we're going to go ahead and type in our host.
So we're going to type in, set our host and now we're going to type in the IP address of our remote
target, which is one nine to that one six eight dot 56, the one zero three.
Now make sure everything is correct before you hit enter and it comes back to the prompt.
Let me know that that command completed successfully.
Now we're going to do the same thing, but we're going to do it for our local Kalyn machine.
So I'm a type in set.
They'll host the IP address of my calling machine, which is one nine two one six eight DOT 56 that
one two seven hit enter.
That comes back to that prompt.
Let me know that that completed successfully.
Now we have to set the target.
You are I for the directory that we're going to find this ability to create the reverse shell with some
type and set target.
You are I.
And now I'm going to type in a space for WordPress.
Hit enter because back to the pump, let me know that that completed successfully.
Now we have to set the username I've typed and set space.
Use your name.
And now I'm just going to copy and paste that information in because I want to correct.
I'm going to hit enter now.
We have to type in the password.
So again, I'm going to use the set command space password along with the password that we discovered
for this user called Corrupted Brain.
I'm going to hit enter and now we're going to launch this exploit by typing in the word exploit and
then hitting enter.
So for me, that command failed.
Now, if I go back and have trouble shoot myself, I see that the localhost IP address is actually wrong.
It should be one, two, three.
So I'm going to go ahead and reset that.
And I'll hit enter now again, I'm going to run exploit.
And this time it completed successfully and we now have a reverse shell between the target machine and
our counting machine using a metal spreader session.
So the first thing we want to do is look inside the home directory for that target machine, some type
in CD change directory it would afford a home like.
So I hit enter, comes back in and lets me know that that command completed successfully.
Now I'm going to type in ls, which is list everything that's inside of that home directory.
And you'll see that we have just one directory and it's called Route three are.
Again, I have to change locations over to that route three hour directory, some type in CD space,
Route three are hit enter and again, it comes back to the prompt.
Let me know that that command completed successfully.
Again, I type in LS and I see that I have a number of directories and files available to me up inside
of that directory.
Now, I need to look inside of that root, underscore, password, underscore, S.H., not text file.
Now, to do this, I'm going to have it printed out to the terminal using the command, Kat.
So I've typed in cat space, the name of the text file that I want printed out to the terminal.
I'll go ahead and enter and inside we have a password, Willy, two six, that is the root password
for our target machine.
So the next thing I need to do is get some privilege escalation, which means that I want to be route.
Currently, I'm not route.
And if I type in get.
You I.D. or set you I.D., that doesn't work, so I type and get you I.D. and it tells me that I'm currently
logged on as a default user using the name of W-W dash data.
Now, you're going to see that a lot.
But when you see that, that means that you have very limited access to the server.
You want to be rude.
So that's what we're going to do next.
So I need to now run a little snippet of Python code, but I can't do it at this terminal to run a snippet
of code.
I got to have a shell now to get a shell up inside a metal spreader.
I just type in the word shell.
Now it comes back and there's no prop, but it is working.
So when you see it, are you going to have is the cursor.
But again, no.
So now I'm going to copy and paste the following snippet of Python code into that prop and make sure
you get all of this because at the very end.
This snippet of code, there is a little dash at the top that has to be part of it.
I'm talking about this right here.
All right, so make sure that you get all of it.
Now, I'm going to go ahead and what's going to happen here when I run?
This is I'm going to spawn a bash shell.
Let's see how that happens.
And you'll notice now that I have a bash shell and I'm currently logged in as W-W dash data.
But now I have an elevated prop.
Now because I have this elevated prop, I can change over to pseudo or super user or route just by typing
in S2.
And now it wants that password that we discovered up inside of that text file, which was Willy 26,
I hit Enter and now you'll see that my prompt changes to let me know that I'm now logged on as route.
I now need to look inside of the root directory.
So I'm going to type in KDDI space forward slash route hit enter.
And it comes back to the prompt, let me know that I'm now inside of that directory again of my type
in ls so I can see what's inside of here and you'll see that I have something called proof text.
Now I need to look at that proof dot text because that is going to confirm that we have completed this
boot to the root challenge.
So I'm again going to print out the contents of that text file using the cat.
So that's the proper type in cat space proof dot text and it comes back and lets us know that we have
successfully completed this boot to root challenge.
So this was an easy butyrate challenge, but it introduced you to some of the excellent exploits that
can be used not in just this capture to play exercise, but in the real world of pain testing.
So you want to become familiar with these little snippets of Python, Perl and bash code because you're
going to see them not only out in the real world, but also on your exams for certifications.
And so that's going to conclude this short video presentation on how we go about completing the boot
to root challenge and the walkthrough for the SVM version, one, capture the flag exercise.
You've got questions.
You've got concerns.
Don't hesitate to reach out.
Contact your instructor and I'll see you in my next video.