Kioptrix VMs Challenge Walkthrough

In this article, we will walk through all the basic Kioptrix VMs (total 5) which are available on vulnhub.com. The difficulty level of all these machines is easy, and they are categorized into different Levels. Let’s start.

Note: For all these machines I have used VMware workstation to provision VMs. Kali Linux VM will be my attacking box. Also, the techniques used are solely for educational purpose. I am not responsible if listed techniques are used against any other targets.

Download link: https://www.vulnhub.com/series/kioptrix,8/#modal22download

Write-up:

1. Download the Level 1 from above link and provision it as VM.

2. Let’s start with enumeration. First, we need to identify the IP of this machine. For determining the IP, we can use Netdiscover tool present in Kali Linux, like below

Note: There are only 2 VMs live in the current setup. Above we can see that Netdiscover is able to find our target VM as 192.168.181.136.

Since now we know the IP of this machine, let’s enumerate more about this VM

3. Below we have used nmap to enumerate the host

And the snipped output is below. We can see below porta are accessible on the machine.

1. Looking into the service version behind these ports, below we can see the Apache version

2. Looking for a quick win, a quick search on the mod_ssl version has a known exploit.

Note: This exploit is quite old and needs some changes before it can be compiled. One can edit the ExploitDB exploit or a working exploit such as here:https://github.com/piyush-saurabh/exploits/blob/master/openfuck.c

3. Now since we have the exploit, compile it, and run it to get root on the box

Download link: https://www.vulnhub.com/series/kioptrix,8/#modal23download

Write-up:

1. Download the Level 2 from above link and provision it as (Read more...)