search
Home

Cat Pictures

Date: 08, June, 2021

Author: Dhilip Sanjay S

Click Herearrow-up-right to go to the TryHackMe room.

hashtag
Enumeration

hashtag
Nmap

$ nmap -sC -sV -p- -oN nmap.out 10.10.96.70
Nmap scan report for 10.10.96.70
Host is up (0.16s latency).
Not shown: 65530 closed ports
PORT     STATE    SERVICE      VERSION
21/tcp   filtered ftp
22/tcp   open     ssh          OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 37:43:64:80:d3:5a:74:62:81:b7:80:6b:1a:23:d8:4a (RSA)
|   256 53:c6:82:ef:d2:77:33:ef:c1:3d:9c:15:13:54:0e:b2 (ECDSA)
|_  256 ba:97:c3:23:d4:f2:cc:08:2c:e1:2b:30:06:18:95:41 (ED25519)
2375/tcp filtered docker
4420/tcp open     nvm-express?
| fingerprint-strings: 
|   DNSVersionBindReqTCP, GenericLines, GetRequest, HTTPOptions, RTSPRequest: 
|     INTERNAL SHELL SERVICE
|     please note: cd commands do not work at the moment, the developers are fixing it at the moment.
|     ctrl-c
|     Please enter password:
|     Invalid password...
|     Connection Closed
|   NULL, RPCCheck: 
|     INTERNAL SHELL SERVICE
|     please note: cd commands do not work at the moment, the developers are fixing it at the moment.
|     ctrl-c
|_    Please enter password:
8080/tcp filtered http-proxy
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
SF-Port4420-TCP:V=7.91%I=7%D=6/8%Time=60BF02E4%P=x86_64-pc-linux-gnu%r(NUL
SF:L,A0,"INTERNAL\x20SHELL\x20SERVICE\nplease\x20note:\x20cd\x20commands\x
SF:20do\x20not\x20work\x20at\x20the\x20moment,\x20the\x20developers\x20are
SF:\x20fixing\x20it\x20at\x20the\x20moment\.\ndo\x20not\x20use\x20ctrl-c\n
SF:Please\x20enter\x20password:\n")%r(GenericLines,C6,"INTERNAL\x20SHELL\x
SF:20SERVICE\nplease\x20note:\x20cd\x20commands\x20do\x20not\x20work\x20at
SF:\x20the\x20moment,\x20the\x20developers\x20are\x20fixing\x20it\x20at\x2
SF:0the\x20moment\.\ndo\x20not\x20use\x20ctrl-c\nPlease\x20enter\x20passwo
SF:rd:\nInvalid\x20password\.\.\.\nConnection\x20Closed\n")%r(GetRequest,C
SF:6,"INTERNAL\x20SHELL\x20SERVICE\nplease\x20note:\x20cd\x20commands\x20d
SF:o\x20not\x20work\x20at\x20the\x20moment,\x20the\x20developers\x20are\x2
SF:0fixing\x20it\x20at\x20the\x20moment\.\ndo\x20not\x20use\x20ctrl-c\nPle
SF:ase\x20enter\x20password:\nInvalid\x20password\.\.\.\nConnection\x20Clo
SF:sed\n")%r(HTTPOptions,C6,"INTERNAL\x20SHELL\x20SERVICE\nplease\x20note:
SF:\x20cd\x20commands\x20do\x20not\x20work\x20at\x20the\x20moment,\x20the\
SF:x20developers\x20are\x20fixing\x20it\x20at\x20the\x20moment\.\ndo\x20no
SF:t\x20use\x20ctrl-c\nPlease\x20enter\x20password:\nInvalid\x20password\.
SF:\.\.\nConnection\x20Closed\n")%r(RTSPRequest,C6,"INTERNAL\x20SHELL\x20S
SF:ERVICE\nplease\x20note:\x20cd\x20commands\x20do\x20not\x20work\x20at\x2
SF:0the\x20moment,\x20the\x20developers\x20are\x20fixing\x20it\x20at\x20th
SF:e\x20moment\.\ndo\x20not\x20use\x20ctrl-c\nPlease\x20enter\x20password:
SF:\nInvalid\x20password\.\.\.\nConnection\x20Closed\n")%r(RPCCheck,A0,"IN
SF:TERNAL\x20SHELL\x20SERVICE\nplease\x20note:\x20cd\x20commands\x20do\x20
SF:not\x20work\x20at\x20the\x20moment,\x20the\x20developers\x20are\x20fixi
SF:ng\x20it\x20at\x20the\x20moment\.\ndo\x20not\x20use\x20ctrl-c\nPlease\x
SF:20enter\x20password:\n")%r(DNSVersionBindReqTCP,C6,"INTERNAL\x20SHELL\x
SF:20SERVICE\nplease\x20note:\x20cd\x20commands\x20do\x20not\x20work\x20at
SF:\x20the\x20moment,\x20the\x20developers\x20are\x20fixing\x20it\x20at\x2
SF:0the\x20moment\.\ndo\x20not\x20use\x20ctrl-c\nPlease\x20enter\x20passwo
SF:rd:\nInvalid\x20password\.\.\.\nConnection\x20Closed\n");
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

hashtag
Port 8080

Cat Pictures Home

  • Identify the version by visiting:

    • http://10.10.151.249:8080/docs/CHANGELOG.html

    • http://10.10.151.249:8080/styles/prosilver/style.cfg

  • We can see that the version of phpBB is 3.3.3

  • Searching for exploits using searchsploit, there were no results found for that version:

hashtag
Other ports

  • FTP 21 is filtered

  • SSH 22 was accepting login using private keys!

  • Port 4420 was an internal shell, which also required a password

  • Port 2375 - may be a docker container is there!

hashtag
Port Knocking

  • At this point, I didn't know how to proceed further. So, I just went and read a write up.

  • I learnt a new thing called port knocking.

circle-info

  • In computer networking, port knocking is a method of externally opening ports on a firewall by generating a connection attempt on a set of prespecified closed ports.

  • Once a correct sequence of connection attempts is received, the firewall rules are dynamically modified to allow the host which sent the connection attempts to connect over specific port(s).

  • A variant called single packet authorization (SPA) exists, where only a single "knock" is needed, consisting of an encrypted packet.

  • The post in the website, gives the hint about port knocking and the sequence of ports to be knocked:

Knock Knock

  • Before port knocking, nmap showing ftp being filtered:

  • Port knocking the correct sequence using nc:

    • v - verbose

    • z - zero mode (used for scanning)

  • One can also use knock or nmap -Pn to do the same.

  • After port knocking, nmap showing ftp as opened:

hashtag
Accessing FTP

  • Now that the FTP is open, we can access it.

  • We could find a file named note.txt:

  • The contents of the note.txt gave the password for the internal shell in port 4420:

hashtag
Internal Shell

  • Login into the internal shell using the password found:

  • But we don't have most of the commands.

  • Only the following binaries were available:

  • At this point, I tried to execute /bin/bash. But I could get a proper shell.

  • Again reading some writeup, I found that mkfifo can be used to gain a reverse shell.

  • Check out Pentester Monkey's Reverse Shell cheatsheet.

hashtag
Internal shell to Reverse shell

  • Now by using nc, we can get a proper reverse shell:

  • On the victim machine:

  • On the attacker machine:

  • Now, we can use cd command to look for interesting files.

  • There was an binary named runme, but which required a different password:

hashtag
Analyzing runme

  • To analyze the binary, we need strings (This was not available in the victim machine)

  • Transfering the runme binary to attacker machine using nc and run strings:

  • On the victim machine:

  • On the attacker machine:

  • As you can see, rebecca must be the password.

  • Once we run the binary, we get the private ssh key:

hashtag
Inside Docker container

  • Login using the private ssh key.

    • Note: Modify the permission of id_rsa to 600

  • We could find the flag.txt here.

  • But it says we are root user. Probably we are inside the docker container.

hashtag
Running Linpeas

  • Transfer Linpeas to the victim machine using curl:

  • On running linpeas, we get the clue /opt/clean:

  • Check out the files over there!

  • We have a file named clean.sh.

hashtag
Root flag

  • We can modify the clean.sh and include a reverse shell:

  • On attacker machine, we can get the reverse shell as well as the root flag:

hashtag
Port Knock - Additional Info

  • I was curious, to know how to setup port knock.

  • So, I checked out the contents of firewall folder and the firewall rules.

  • But it didn't mention anything about port knocking.

  • With a little bit of googling, I found that the port knocking configuration file is /etc/knock.conf

hashtag
References

Previousc4ptur3-th3-fl4gNextBounty Hacker

Last updated