Kioptrix Level 1 Writeup via SMB

Kioptrix is a vulnerable machine for practicing basic penetration testing tools. The goal is to gain root access by any available route except hacking the VM server or player. I chose SMB.

Discovery

We first used netdiscover to find the Kioptrix machine's IP address.

Enumeration

We then used nmap to see which services were running on the machine.

The scan showed SSH, Apache, and SMB. We focused on SMB.

SMB enumeration

The nmap results didn't identify the SMB version, so we ran Metasploit's smb_version scanner.

The scanner reported SMB version 2.2.1a.

Exploitation

We then used searchsploit inside Metasploit to find a compatible exploit. In this case, it was trans2open.

We selected the trans2open exploit in Metasploit and set the Linux x86/reverse_shell_tcp payload. I tried several payloads, but this was the only one that worked.

After configuring the exploit and payload, we ran it.

The exploit opened a shell on the target. We used whoami to identify the current user.

We had gained root access through SMB.