OSCP Journey 002 - Assessing Kioptrix Level 1

Now that we have the Kioptrix Level 1 VM up and ready, let's see what we have! Ensure that both the Kali VM and Kioptrix Level 1 VM are up and running. I first booted up the Kali VM and then booted up the Kioptrix VM. That order has helped me with the IP address distribution below and in future posts.

Assessment go!

1. Log into the Kali VM


2. Open a terminal window and let's verify that we cannot connect to the internet


3. In Terminal, type in "ping www.msn.com" and press the Enter key
   
   


4. That should be good enough to verify we can't get out. Let's see our IP configuration.


5. In Terminal, type in "ifconfig" and press the Enter key
   


6. When we set up the host-only network configuration in VirtualBox, we could see that the IP addresses would automatically start at .3. It appears that our Kali box has the first IP address from the DHCP pool for the "eth0" adapter.


7. Let's use netdiscover to see if that can pick up any hosts in our network. Note: Your results may vary depending on what else you've configured to run in the host-only network.


8. In Terminal, type in "netdiscover" and press the Enter key
   


9. The command will enumerate IP ranges and eventually we should find the Kioptrix Level 1 VM!
   


10. We can correlate the Kioptrix VM with the IP address based on the MAC address. This is why we needed to note that MAC address from the previous post!


11. Let's use another tool to further investigate Kioptrix. We're going to use Zenmap.


12. In terminal, type in "zenmap" and press the Enter key
    


13. This will launch the GUI front-end for the nmap tool.
    


14. We can see default options are already set for us. Let's configure Zenmap to scan Kioptrix.


15. In Zenmap, enter in "192.168.56.5" for the Target, and change the Profile to "Intense scan, all TCP"
    


16. Click the "Scan" button
    


17. Depending on a few factors, your entire scan of the host could take 1 or up to a few minutes. The scan I performed took about 5 minutes for the entire scan to finish. However, you'll quickly see preliminary results based on the different phases of the scan.


18. Once the scan finishes, you'll see various points of interest from the scan results. In the first part of the scan results we can see open ports on the Kioptrix VM.
    


19. Here's a quick breakdown of the results and why we care:
1. Port 22 - Could identify a vulnerable SSH implementation
2. Port 80 - Could identify a vulnerable web server and OS
3. Port 111 - Could identify a vulnerable RPC implementation
4. Port 139 - Could identify a vulnerable file sharing/SMB implementation
5. Port 443 - Could identify a vulnerable web server and OS
6. Port 32768 - Could identify some kind of vulnerable network thing


20. Let's keep scrolling
    
    
    
    
    
    
    
    
    
    


21. This scan helped further identify services behind the ports and interesting tidbits of information


22. On the left, click "Services"
    


23. This view provides a quick interface to each service and further information


24. Click on "http" to see more information about the version of Apache and identification of Red Hat
    


25. Scrolling to the right reveals more info
    


26. Click on "netbios-ssn" to reveal Samba is being used for SMB
    


27. Click on "ssh" to show information about OpenSSH
    


28. Let's save our scan results for future reference


29. Click "Scan" at the top and click "Save Scan"
    


30. Let's name the results "Kioptrix Level 1" and save it in the Documents folder. But, you can save it wherever you want!
    


31. Let's take a quick peek at what's running!


32. Open Firefox


33. In Firefox, open a new tab/window, type in 192.168.56.5, and press Enter


34. You should see the default page for an Apache install (albeit pretty old) on port 80
    


35. If we type in https://192.168.56.5 in Firefox, we'll get a warning about insecure SSL settings (e.g. an expired self-signed certificate).


36. Click "Advanced"


37. Add in the exception by clicking on "Add Exception"
    


38. Click on "Confirm Security Exception"
    
    


39. We see the same default install page for Apache, but on port 443

Now that we have a basic enumeration of the system done, the next post will use more tools to identify more information about each service and we will exploit it.