[Learning] Kioptrix level one -- mod_ssl

Links:

watch the HD video online: http://vimeo.com/f4l13n5now/kioptrixl1

Description:

"This Kioptrix VM Image are easy challenges. The object of the game is to acquire root access via any means possible (except actually hacking the VM server or player).
The purpose of these games are to learn the basic tools and techniques in vulnerability assessment and exploitation. There are more ways then one to successfully complete the challenges."
                                                                                                                                 --------- Kioptrix team

Attacker:
Backtrack 5 R2
IP: 10.10.10.132/24

Victim:
Kioptrix level 1
IP: 10.10.10.137/24

Vulnerability & Exploit:

1, Apache OpenSSL Remote Exploit (Multiple Targets) (OpenFuckV2.c)

Attacking process:

1, discover the vulnerable services:
use NMAP to probe the opening ports and services

nmap -sS -sV -O -v 10.10.10.137

found the following services:
[1] ssh service running on port 22
[2] https service running on port 443 (apache_1.3.20)


use Nikto to discover vulnerabilities:

./nikto -host 10.10.10.137

found the following vulnerability:
[1] mod_ssl 2.8.7 and lower are vulnerable to a remote buffer overflow （CVE-2002-0002， OSVDB-756）


2, exploit vulnerable services:
[1] exploit mod_ssl based on apache_1.3.20

3, cover the trace
use 0x333shadow to delete the logs

Notes:

764.c compile error on BT5:
The problem is that openssl develop package is not included in BT5. You have to install it manually.

Solution:

apt-get install libssl-dev

Reference:

[1] Kioptrix download link
[2] Tutorial on g0tmi1k's Blog