Today, we are going to get to the heart of the matter and do some hacking! But do not worry, it will probably not get you arrested and / or extradited. We are going to work on a target known as a boot-to-root machine. These are virtual machines that you run inside your own network and that are designed to look like a normal production box. They can run applications such as web servers, databases, FTP servers, and so on.
However, these machines are designed to be intentionally vulnerable by the author, in order to let you practice your pentesting skills in a simulated setting.
What is Kali Linux?
Kali Linux is a Linux security distribution derived from Debian and specially designed for computer forensics and advanced penetration testing. It was developed through the rewriting of BackTrack by Mati Aharoni and Devon Kearns of Offensive Security. Kali Linux contains several hundred well-designed tools for various information security tasks, such as penetration testing, security research, computer forensics and reverse engineering. BackTrack was their former information security operating system. The first iteration of Kali Linux was Kali 1.0.0, introduced in March 2013. Offensive Security currently funds and supports Kali Linux. If you were to visit the Kali website today ( www.kali.org ), you would see a large banner reading, "Our most advanced penetration testing distribution, ever." A very bold statement that, ironically, has not yet been disproved.
Kali Linux has more than 600 preinstalled penetration testing applications to discover. Each program with its own flexibility and unique use case. Kali Linux does an excellent job of separating these useful utilities into the following categories: Information gathering Vulnerability analysis Wireless attacks Web applications Exploitation tools Stress testing Forensic tools Sniffing and spoofing Password attacks Maintaining access Reverse engineering Reporting tools Hardware hacking In this Kali Linux tutorial for beginners, you will learn the basics of Kali Linux such as: What is Kali Linux? Who uses Kali Linux and why? Kali Linux installation methods How to install Kali Linux using Virtual Box Getting started with the graphical interface of Kali Linux What is Nmap? Nmap target selection How to perform a basic Nmap scan on Kali Linux Nmap operating system analysis What is Metasploit? Metasploit and Nmap Metasploit Exploit utility Who uses Kali Linux and why? Kali Linux is truly a unique operating system, as it is one of the few platforms openly used by both the good guys and the bad guys. Security administrators and Black Hat hackers both use this operating system extensively. One to detect and prevent security flaws, and the other to identify and possibly exploit security flaws. The number of tools configured and preinstalled on the operating system makes Kali Linux the Swiss army knife of any security professional's toolbox. Professionals who use Kali Linux Security administrators - Security administrators are responsible for protecting the information and data of their institution. They use Kali Linux to review their environment(s) and make sure that there are no easily detectable vulnerabilities. Network administrators - Network administrators are responsible for maintaining an efficient and secure network. They use Kali Linux to audit their network. For example, Kali Linux has the ability to detect rogue access points. Network architects - Network architects are responsible for designing secure network environments. They use Kali Linux to audit their initial designs and make sure that nothing was overlooked or misconfigured. Pen Testers - Pen Testers use Kali Linux to audit environments and carry out reconnaissance on the corporate environments they were hired for. CISO - CISO, or Chief Information Security Officers, use Kali Linux to internally audit their environment and discover whether new applications or rogue configurations have been put in place. Forensic Engineers - Kali Linux has a "Forensic Mode", which allows a Forensic Engineer to perform data discovery and recovery in certain cases. White Hat Hackers - White Hat Hackers, similar to Pen Testers, use Kali Linux to audit and discover the vulnerabilities that may be present in an environment. Black Hat Hackers - Black Hat Hackers use Kali Linux to discover and exploit vulnerabilities. Kali Linux also has many social engineering applications, which can be used by a Black Hat Hacker to compromise an organization or an individual. Grey Hat Hackers - Grey Hat Hackers sit between White Hat and Black Hat Hackers. They will use Kali Linux in the same methods as the two listed above. Computer enthusiast - Computer enthusiast is a fairly generic term, but anyone who wants to learn more about networks or computers, in general, can use Kali Linux to learn more about information technology, networks and common vulnerabilities. Kali Linux installation methods Kali Linux can be installed using the following methods: Ways to run Kali Linux: Directly on a PC or a laptop - Using a Kali ISO image, Kali Linux can be installed directly on a PC or a laptop. This method is best if you have a spare PC and you are familiar with Kali Linux. In addition, if you are planning or carrying out access point testing, it is recommended to install Kali Linux directly on a Wi-Fi capable laptop. Virtualized (VMware, Hyper-V, Oracle VirtualBox, Citrix) - Kali Linux supports the best-known hypervisors and can easily integrate into the most popular ones. Preconfigured images are available for download at https://www.kali.org/ , or an ISO can be used to manually install the operating system in the preferred hypervisor. Cloud ( Amazon AWS , Microsoft Azure ) - Given the popularity of Kali Linux, AWS and Azure provide images for Kali Linux. USB boot disk - Using the Kali Linux ISO, a boot disk can be created to run Kali Linux on a machine without installing it, or for forensic purposes. Windows 10 (App) - Kali Linux can now run natively on Windows 10, through the command line. Not all features work yet, as it is still in beta mode. Mac (dual or single boot) - Kali Linux can be installed on Mac, as a secondary or primary operating system. The boot feature of Parallels or Mac can be used to set up this configuration.
It is about getting your hands dirty, running tools against a real target, seeing what works and what fails, and getting into the mindset of the pentester. To help you, we are going to walk through a popular boot-to-root machine known as Mr. Robot (like the TV show!). This VM is a WordPress server. We are going to force our way into the admin console, get a reverse shell, then elevate our privileges to another Linux user before finishing as the root user, with full control of the machine. Let's go!
SCARY LEGAL WARNING: As with any pentesting exercise, make sure to never run scans or tools against systems that you do not own without explicit authorization!
Starting the machine
Theee first step of any boot-to-root is to download it and start it, so head here to download the image. You will end up with a file in OVA format, which is a VMware machine image. The file will import easily into any VMware product or Virtual Box. If you are using Hyper-V, you will have to follow a few extra steps to convert it. Once it is imported into your hypervisor, compare the network settings of it and of your Kali box to make sure that they are on the same virtual network, then start it.
The next step: which IP address did it get? First find Kali by running ifconfig, the address after eth0 is what you are looking for: Kali's IP is 10.0.9.6
root@kali:~# Ifconfig eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500 inet 10.0.9.6 netmask 255.255.255.0 broadcast 10.0.9.255 Kali's IP is 10.0.9.6
Kali's IP is 10.0.9.6. Next, let's use Nmap to ping the entire subnet and find other live machines:
root@kali:~# Nmap -Sn 10.0.9.0/24
Starting Nmap 7.80 ( https://nmap.org ) at 2019-10-14 11:25 EDT
Nmap Scan Report for 10.0.9.1
Host Is Up (0.00019s Latency).
MAC Address: 00:1C:42:00:00:18 (Parallels)
Nmap Scan Report for 10.0.9.2
Host Is Up (0.00014s Latency).
MAC Address: 00:1C:42:00:00:08 (Parallels)
Nmap Scan Report for 10.0.9.5
Host Is Up (0.00048s Latency).
MAC Address: 00:1C:42:70:D7:77 (Parallels)
Nmap Scan Report for 10.0.9.6
Host Is Up.
Nmap done: 256 IP addresses (4 hosts up) scannedWe know that 10.0.9.1 and .2 are virtual network devices used by our hypervisor and .6 is Kali, so .5 must be our unknown!
Enumeration
The next step is to run a basic Nmap scan to find the open ports:
root@kali:~# Nmap 10.0.9.5 Starting Nmap 7.80 ( https://nmap.org ) at 2019-10-14 11:26 EDT Nmap Scan Report for 10.0.9.5 Host Is Up (0.00046s Latency). Not Shown: 997 Filtered Ports PORT STATE SERVICE 22/Tcp Closed Ssh 80/Tcp Open Http 443/Tcp Open Https MAC Address: 00:1C:42:70:D7:77
Port 22 is reported as closed, which means that the TCP request to that port was explicitly answered with a "go ahead, nobody is answering here!" instead of the lack of response from all the other ports. However, 80 and 443 are open! These ports are usually for HTTP and HTTPS. So, let's try to reach the IP address with a browser. We get an interesting response:
Definitely a website, a little strange, but if you have seen the Mr. Robot TV show, you should pick up on the theme this machine was built on. Standard web procedure. Let's take a look at the source code. There is some cute ASCII, a call to some Javascript, but not much else interesting:
Let's move on to HTTPS, it is the same site, just encrypted, nothing new. The page does not give us any link to follow. Is there anything else interesting on the server that we could discover? Try scanning it with Nikto
root@kali:~# Nikto -H 10.0.9.5 – Nikto V2.1.6 —————————————————————————————————————– + Target IP: 10.0.9.5 + Target Hostname: 10.0.9.5 + Target Port: 80 + Start Time: 2019–10–14 12:02:22 (GMT–4) —————————————————————————————————————– + Server: Apache + The X–XSS–Protection header is not defined. This header can hint to the user agent to protect against some forms of XSS + /Wp–Login/: Admin Login Page/Section Found. + /wordpress: A WordPress installation was found. + /wp–admin/wp–login.php: WordPress Login Found
Two very interesting things stand out immediately: it is an Apache web server and it is a WordPress site. Try the login page.
We could try to scan the page with WPScan to enumerate the vulnerable plugins, but first take a step back. A principle of pentesting is to enumerate broad and shallow first - then start the deep dive. First understand your target more broadly.