OffensivePentest- Machine Vulnversity

OffensivePentesting.ctd

Vulnversity


Vulnversity



Learh about active recon, web app attacks and privilege escalation

Reconnaissance


Reconnaissance



nmap -T4  -sV 10.10.231.79   
Starting Nmap 7.92 ( https://nmap.org ) at 2022-03-22 14:57 PKT
Nmap scan report for 10.10.231.79
Host is up (0.26s latency).
Not shown: 994 closed tcp ports (reset)
PORT     STATE SERVICE     VERSION
21/tcp   open  ftp         vsftpd 3.0.3
22/tcp   open  ssh         OpenSSH 7.2p2 Ubuntu 4ubuntu2.7 (Ubuntu Linux; protocol 2.0)
139/tcp  open  netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
445/tcp  open  netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
3128/tcp open  http-proxy  Squid http proxy 3.5.12
3333/tcp open  http        Apache httpd 2.4.18 ((Ubuntu))
Service Info: Host: VULNUNIVERSITY; OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 59.51 seconds



vsftpd 3.0.3 Potential Exploits



https://www.exploit-db.com/exploits/49719

http://www.securityspace.com/smysecure/catid.html?id=1.3.6.1.4.1.25623.1.0.108045


    

OpenSSH 7.2p2 Potential Exploits



https://www.exploit-db.com/exploits/40136

https://www.rapid7.com/db/modules/auxiliary/scanner/ssh/ssh_enumusers/

https://hackerone.com/reports/476439



Samba smb Potential Exploits



As this is Intentionally Vulnerable Machine you may check for Eternal Blue by yourself





Squid Proxy Potential Exploits



https://www.rapid7.com/db/modules/exploit/linux/proxy/squid_ntlm_authenticate/

https://www.rapid7.com/db/vulnerabilities/squid-proxy-gopher-bo/

https://www.cybersecurity-help.cz/vdb/squid-cache_org/squid/3.5.12/





Apache httpd 2.4.18 Potential Exploits




https://www.rapid7.com/db/vulnerabilities/apache-httpd-cve-2019-0211/

https://www.exploit-db.com/exploits/46676

https://hackerone.com/reports/520903


                 





Quick Summary about Nmap


nmap flag Description
-sVAttempts to determine the version of the services running
-p <x> or -p-Port scan for port <x> or scan all ports
-PnDisable host discovery and just scan for open ports
-AEnables OS and version detection, executes in-build scripts for further enumeration
-sCScan with the default nmap scripts
-vVerbose mode
-sUUDP port scan
-sSTCP SYN port scan


Nmap Basic Port Scan Summary




Option Purpose
-p-all ports
-p1-1023scan ports 1 to 1023
-F100 most common ports
-rscan ports in consecutive orde r
-T<0-5>-T0 being the slowest and T5 the fastest
--max-rate 50rate <= 50 packets/sec
--min-rate 15rate >= 15 packets/sec
--min-parallelism 100at least 100 probes in parallel






Nmap Post Port Scan Summary



Option Meaning
-sVdetermine service/version info on open ports
-sV --version-lighttry the most likely probes (2)
-sV --version-alltry all available probes (9)
-Odetect OS
--tracerouterun traceroute to target
--script=SCRIPTSNmap scripts to run
-sC or --script=defaultrun default scripts
-Aequivalent to -sV -O -sC --traceroute
-oNsave output in normal format
-oGsave output in grepable format
-oXsave output in XML format
-oAsave output in normal, XML and Grepable formats




Other Usefull ToDo about Nmap



Option Purpose
--reasonexplains how Nmap made its conclusion
-v verbose
-vvvery verbose
-ddebugging
-ddmore details for debugging




Some Important Points about



In other words, stealth SYN scan -sS is not possible when -sV option is chosen

Note that -T4 is often used during CTFs and when learning to scan on practice targets.

whereas -T1 is often used during real engagements where stealth is more important.



Other Nmap Cheat-sheet



https://github.com/marsam/cheatsheets/blob/master/nmap/nmap.rst

Directory Busting with GoBuster


Directory Busting with GoBuster



gobuster dir --url http://10.10.231.79:3333/ --wordlist /usr/share/wordlists/dirb/common.txt  
===============================================================
Gobuster v3.1.0
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:                     http://10.10.231.79:3333/
[+] Method:                  GET
[+] Threads:                 10
[+] Wordlist:                /usr/share/wordlists/dirb/common.txt
[+] Negative Status codes:   404
[+] User Agent:              gobuster/3.1.0
[+] Timeout:                 10s
===============================================================
2022/03/22 15:25:18 Starting gobuster in directory enumeration mode
===============================================================
/.hta                 (Status: 403) [Size: 293]
/.htaccess            (Status: 403) [Size: 298]
/.htpasswd            (Status: 403) [Size: 298]
/css                  (Status: 301) [Size: 317] [--> http://10.10.231.79:3333/css/]
/fonts                (Status: 301) [Size: 319] [--> http://10.10.231.79:3333/fonts/]
/images               (Status: 301) [Size: 320] [--> http://10.10.231.79:3333/images/]
/index.html           (Status: 200) [Size: 33014]                                      
/internal             (Status: 301) [Size: 322] [--> http://10.10.231.79:3333/internal/]
/js                   (Status: 301) [Size: 316] [--> http://10.10.231.79:3333/js/]
/server-status        (Status: 403) [Size: 302]   

Useful about Gobuster


Useful about Gobuster



GoBuster is a tool used to brute-force URIs (directories and files), DNS subdomains and virtual host names. For this machine, we will focus on using it to brute-force directories.

GoBuster flag Description
-ePrint the full URLs in your console
-uThe target URL
-wPath to your wordlist
-U and -PUsername and Password for Basic Auth
-p <x>Proxy to use for requests
-c <http cookies>Specify a cookie for simulating your auth

Exploitation


Exploitation



We will not only try to exploit as What THM has told us to do (web server compromising) but we also try to exploit this machine in many different ways based on our previous experiences

Steps from my experience rather than THM current guide


Steps from my experience rather than THM current guide




I used Ms17 Eternal Blue , Didn't Work for me

I also try to exploit with several different but I got tired may be this machine was design to be exploit only the way THM told us to do but It is worth to Try different approaches to root the machine.


Steps From THM


Steps from THM



• As we Found upload functionality we will try to exploit it.

• While trying we found that extensions are blocked so we will use world list /usr/share/wordlists/dirb/extensions_common.txt using burp intruder

• we found that .phtml is not blocked

• se we renamed our php-rev-shell.php as php-rev-shell.phtml and upload and got the shell

• we enumerate different PrivEsc Vectors and found Systemctl to be using SUID bit

• used https://gtfobins.github.io/gtfobins/systemctl/ and https://medium.com/@klockw3rk/privilege-escalation-leveraging-misconfigured-systemctl-permissions-bc62b0b28d49 to exploit this

• Successfully followed the step and got rootshell




Problems while exploiting

while using Burp Intruder I didn't notice any difference in response size, status code, even the grepable text was same for all the payloads including .phtml I will figure out why. Now I have Figured out the Problem the UrL ENcode Option in Burp Suite was responsible for this issue.






Comments

Post a Comment

Popular posts from this blog

THM JRPentester Intro To Pentesting > Principles of Security

Image
Principles of Security Principles of Security Introduction It outlines some Fundamentals of InfoSec. The measuers, frameworks and protocols that we will discuss, all play small part in “Defence in Depth” Defence in Depth is the use of multiple varied layers of security to protect Organisation's system. The CIA Traid InfoSec model used in the making of Security Policies. This model has an old background dating from 1998/ Reason for its old background is InfoSec is not just about CyberSecurity, it also applies to scenarios like filing record storage etc. It consist upon three sections, C onfidentiality,  I ntegrity and  A vailability ( CIA ), it is Industry Standard model right now, it helps to understand the value of data it applies to and the attention that the data need from the bussiness Unlike traditional models where you have individual sections, It is continous cycle. Confidentiality This element is the protection of data from unauthorized access and misuse. ...
Read more

THM JRPenTester Pentesting Fundamentals Writeup

Image
Pentesting Fundamentals Pentesting Fundamentals What is PenTesting Ans: Finding the Vulnerability in the system and using the right mitigations is known as PenTest. A Pentester will use the same waepons and tactics just like an Black hat hacker use. According to Security Magazine , a cybersecurity industry magazine, there are over 2,200 cyber attacks every day - 1 attack every 39 seconds. https://www.securitymagazine.com/articles/87787-hackers-attack-every-39-seconds Penetration Testing Ethics Hat Category Description Example White Hat These hackers are considered the "good people". They remain within the law and use their skills to benefit others. For example, a penetration tester performing an authorised engagement on a company. Grey Hat These people use their skills to benefit others often; however, they do not respect/follow the...
Read more

Advanced_Exploitation--Game_Zone Writeup

Image
OffensivePentesting.ctd Game Zone Game Zone Learn to hack into this machine. Understand how to use SQLMap , crack some passwords , reveal services using a reverse SSH tunnel and escalate your privileges to root! Recon Recon nmap -sV -sC -T4 -Pn 10.10.25.213   Starting Nmap 7.92 ( https://nmap.org ) at 2022-03-29 19:27 PKT Nmap scan report for 10.10.25.213 Host is up (4.0s latency). Not shown: 998 closed tcp ports (reset) PORT   STATE SERVICE VERSION 22/tcp open  ssh     OpenSSH 7.2p2 Ubuntu 4ubuntu2.7 (Ubuntu Linux; protocol 2.0) | ssh-hostkey:   |   2048 61:ea:89:f1:d4:a7:dc:a5:50:f7:6d:89:c3:af:0b:03 (RSA) |   256 b3:7d:72:46:1e:d3:41:b6:6a:91:15:16:c9:4a:a5:fa (ECDSA) |_  256 53:67:09:dc:ff:fb:3a:3e:fb:fe:cf:d8:6d:41:27:ab (ED25519) 80/tcp open  http    Apache httpd 2.4.18 ((Ubuntu)) |_http-server-header: Apache/2.4.18 (Ubuntu) |_http-title: Game Zone | http-cookie-flags:   |   /:   |     PHPSESSID:   |_      httponly flag not set Service Info: OS: L...
Read more