Kioptrix-1.1(#2)

Walk through of Kioptrix level 2

4 min readJun 21, 2021

Overview: This Kioptrix VM Image are easy challenges. The objective of the game is to acquire root access via any means possible (except actually hacking the VM server or player). The purpose of these games are to learn the basic tools and techniques in vulnerability assessment and exploitation. There are more ways then one to successfully complete the challenges.

Here we Will follow the hacking methodology. Lets Start:

Information gathering

In order to hack a System, first we need to have the some information about the target such as ip address. So in-order to find the ip address of the vm, we will use netdiscover.

command: # netdiscover -r 10.10.10.0/24 (since i know my system, all the vm are at this range)

since ip with 1,2,254 are reserved, so the target vm ip is 170.

Scanning and Enumeration

PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 3.9p1 (protocol 1.99)
80/tcp open http Apache httpd 2.0.52 ((CentOS))
111/tcp open rpcbind 2 (RPC #100000)
443/tcp open ssl/https?
631/tcp open ipp CUPS 1.1
824/tcp open status 1 (RPC #100024)
3306/tcp open mysql MySQL (unauthorized)

Since It is a web server, I began to visit for any sensitive info, but it had only login page, so i intercepted its request in burp and tried to login. I used following payload and found that it is vulnerable to sql injection.

Then I got access to into admin page . Since from the above info gathering i knew that it was a linux server (centos) and it had option to ping the system so i tried to exploit this behavior. I tried to list the users using the following command.

From the command, i got the following response from the server.

Lets sets setup the netcat listner in our system and make connection from the server using bash reverse shell.

Note: Here 10.10.10.167 is the attacker ip and 8080 is the port on which attacker is listening. After pressing submit we get the connection on console.Lets see who we are logged in as:

So we wanted to be of higher privileged user so, first lets see the kernel version.

It is a 32 bit old kernel. Let’s search for exploit on the internet. Found 9542.c named exploit in exploit-db.

First lets move to the /tmp folder and download that exploit in that server using wget command. Directly we cannot download because of ssl error so first download it into your attacker box and then host it in local server using python(You may use apache too).