Black-Box Penetration Test — SecOS:1 (VulnHub)

---

Overview

Full black-box penetration test against SecOS:1, a deliberately vulnerable CTF machine from VulnHub. Objective: simulate a real-world attacker with zero prior knowledge and achieve root-level compromise, evidenced by retrieving /root/flag.txt.

All testing was conducted within a controlled virtual lab (Apporto Cloud) as part of a university module. No real systems were targeted.

---

Lab Environment

• Network: NAT — 192.168.122.0/24
• Platform: Apporto Cloud Lab

---

Methodology

Followed the Hacking Exposed framework (McClure, Scambray & Kurtz, 2003):

1. Information Gathering (Footprinting)
2. Scanning & Mapping
3. Enumeration
4. Vulnerability Assessment
5. Gaining Access
6. Privilege Escalation
7. Post Exploitation -> Pilfering -> Covering Tracks -> Backdoor Creation

---

Attack Chain

Vulnerabilities Identified — 22 Total (Nessus)

Tools Used

---

Repository Files

---

Recommendations

1. CSRF tokens on all state-changing endpoints; require current password to change password
2. Patch OS and services — upgrade Ubuntu, OpenSSH, and Node.js; apply kernel patches
3. MongoDB authentication — enforce credentials; never leave unauthenticated
4. Password hashing — replace SHA-256 with Argon2 or bcrypt with salting
5. SSH hardening — disable password auth; use key-based authentication only
6. HTTP security headers — add X-Frame-Options, X-Content-Type-Options, CSP

---

Evidence

CSRF — hint page source code

hint page source

CSRF — Apache log confirming spiderman accessed the link

apache log

Spiderman login with abc123

spiderman login

SSH access as spiderman

ssh login

MongoDB records extracted

mongodb

Backdoor user created

backdoor user

Cron job reverse shell configured

cronjob

Cron job connection to Kali confirmed

cronjob connection

References

• McClure, S., Scambray, J. and Kurtz, G. (2003) Hacking Exposed. McGraw-Hill/Osborne.
• VulnHub — https://www.vulnhub.com/entry/secos-1,88/
• Exploit-DB 37292 — https://www.exploit-db.com/exploits/37292
• PEASS-ng LinPEAS — https://github.com/peass-ng/PEASS-ng

---

Disclaimer: All testing was conducted against a deliberately vulnerable CTF machine within a controlled university lab environment (CSI_7_PTE, LSBU). Authorised for educational purposes only.