GoldenEye CTF

This article covers a brief walk-through of a Goldeneye themed vulnhub system. Based on the systems description, brute forcing was going to be key;

• No extra tools other than what’s on Kali by default
• Any brute forcing will only need fasttrack.txt or less

Scanning & Enumeration

I started by port scanning the system. POP3 looks like a good brute force candidate.

Heading to the web server, a login console also appears to be available:

The source code (terminal.js) which shows this message reveals two potential user names, and an encoded password:

I decoded the password (InvincibleHack3r) with BurpSuite:

Connecting to the SMTP port, I used the VRFY command to check if these users exist on the system:

Logging in with the Boris/InvincibleHack3r account we appear to hit a dead end:

Brute Forcing

Using Medusa and the fasttrack.txt wordlist, I attempted to brute force the passwords for the two accounts previously identified:

medusa -u boris -P /usr/share/wordlists/fasttrack.txt -h 192.168.0.108 -M pop3 -n 55007 -t 20 -b -v 0

Valid Account: boris:secret1!

medusa -u natalya -P /usr/share/wordlists/fasttrack.txt -h 192.168.0.108 -M pop3 -n 55007 -t 20 -b -f

Valid Account: natalya:bird

I configured Claws mail to see if anything interesting appeared in these email accounts:

This revealed more credentials:

username: xenia
password: RCP90rulez!

Logging into the URL mentioned in the email (severnaya-station.com/gnocertdir), presents us with a Moodle CMS website, where a message from Dr. Doak awaits..

Poking around the Moodle application didn’t reveal much interesting, so time for more brute force:

medusa -u doak -P /usr/share/wordlists/fasttrack.txt -h 192.168.0.108 -M pop3 -n 55007 -t 20 -b -f

Valid Account: doak/goat

Logging into the email account, more credentials were uncovered:

username: dr_doak
password: 4England!

Logging into the Moodle website using the Dr. Doak account, we find a s3cret.txt file:

The contents of the file point to a .jpg file:

Downloading the image shows the following.

And since it wouldn’t be a CTF without exiftool being required..

password: xWinter1995x!

Using the this password, I was then able to login as an admin to the Moodle application:

Remote Access

Metasploit includes a Moodle CMS module, which allows for code execution provided you have an admin account, so I thought I would give that a try.

The module injects code into the aspell system path to gain a reverse shell, however my first attempt didn’t work out.

After some time poking around the site settings, this appeared to be because a different spell check system was being invoked. I headed over to Site Administration > Plugins > Text Editors and set the spell engine to PSpellShell:

Success!

Privilege Escalation

After doing a “uname -a” it appears the system was running Kernel 3.13.0-32-generic which is vulnerable to the following exploit: https://www.exploit-db.com/exploits/37292. I copied the exploit across from my Kali system:

Unfortunately, gcc wasn’t available to compile the exploit, however does have the Clang compiler installed:

I modified the exploit so references to gcc were replaced with clang, and compiled it. This generated some warnings, but did produce an “a.out” executable:

Executing it we get a root shell:

Checking out the /root directory, we can see a .flag.txt file:

Visiting the URL shows the flag has been captured:

Victory. It’s quite a fun challenge with a couple of small curve-balls. Could be improved by the addition of Defense Minister Dmitri Mishkin 😉