Today, I am going to share a writeup for the boot2root challenge of the Vulnhub machine “Sumo: 1”. It was an intermediate box based on the Linux machine. The goal for this machine is to read the flag file Download From Here

Penetration Testing Methodology

  • Network Scanning
    • Netdiscover scan
    • Nmap Scan
  • Enumeration
    • Enumerating HTTP service on Browser
    • Enumerating using Nikto
  • Exploitation
    • Exploiting Shellshock Vulnerability
    • Gaining Meterpreter
  • Post Exploitation
    • Enumerating for Escalating Privileges
  • Privilege Escalation
    • Dirty Cow
  • Reading Root Flag

A portable version of this application is available: Portable SUMo runs on: Windows 10 32/64 bit Windows 8 32/64 bit Windows 7 32/64 bit file size: 3.7 MB filename: sumolite.exe main category: System. KC Softwares - Software Development Company. Developpers of SUMo, DUMo, KCleaner and other powerful System Utilities.

Walkthrough

Network Scanning

We begin by scanning our network for the target machine using Netdiscover. The target machine is active on 192.168.1.104

Let’s scan it and see which services are running and which ports are open.

Enumeration

The scan gives us a lot of good and useful information, but what stands out the most is that port 22 and 80 are open, let’s explore port 80 first and see what we can find there.

This webpage seemed like a dead-end so, we decided to perform a Nikto scan in the hope that it will provide us with some more insight.

The Nikto scans the web application to find the /cgi-bin/ directory. on further inspection, the application was found vulnerable to shellshock vulnerability. Time to exploit it.

Exploitation

Open a terminal type msfconsole for loading Metasploit framework and use the following module. This module targets CGI scripts in the Apache webserver by setting the HTTP_USER_AGENT environment variable to a malicious function definition.