Lame

OS: Linux, Difficulty: Easy, IP: 10.10.10.3

Initial Enumeration

1000 Common TCP port scan

sudo nmap -oN T-common 10.10.10.3
# Nmap 7.70 scan initiated Tue Jul  2 21:55:24 2019 as: nmap -oN T-common 10.10.10.3
Nmap scan report for 10.10.10.3
Host is up (0.23s latency).
Not shown: 996 filtered ports
PORT    STATE SERVICE
21/tcp  open  ftp
22/tcp  open  ssh
139/tcp open  netbios-ssn
445/tcp open  microsoft-ds

# Nmap done at Tue Jul  2 21:55:38 2019 -- 1 IP address (1 host up) scanned in 13.34 seconds

100% TCP port scan

sudo nmap -p- -T4 -oN T-all 10.10.10.3
# Nmap 7.70 scan initiated Tue Jul  2 21:55:36 2019 as: nmap -p- -T4 -oN T-all 10.10.10.3
Nmap scan report for 10.10.10.3
Host is up (0.24s latency).
Not shown: 65530 filtered ports
PORT     STATE SERVICE
21/tcp   open  ftp
22/tcp   open  ssh
139/tcp  open  netbios-ssn
445/tcp  open  microsoft-ds
3632/tcp open  distccd

# Nmap done at Tue Jul  2 21:59:27 2019 -- 1 IP address (1 host up) scanned in 230.72 seconds

Detailed scan on all the open TCP ports

Probable attack vectors

Service

Reason

FTP - 21

Anonymous login enabled

SMB - 445

Samba shares enumeration and old version of samba

DistCCD - 3632

An odd service running version 1

FTP file enumeration got me nothing.

However the FTP Server vsFTPd 2.3.4 is vulnerable to remote code execution (MSF) as per my initial searchsploit search.

However, running this exploit using Metasploit and trying to exploit the vulnerability manually didn't get me a shell.

User Own

There are 2 ways to own the user in this box, as per my understanding.

Using SMB

I have read and write access in one of the SMB Shares.

Find all the users on the box

makis as a user stuck out to me hence I tried making a symlink to the /home/makis/user.txt file and own user.

As evident from the list of files, we have our user flag 69454***

Using DistCC service

A simple searchsploit search for DistCC got me a metasploit RCE exploit entry DistCC Daemon - Command Execution (Metasploit)

Using this method also we can get the user flag from the system, however this is not privileged and can not be leveraged to get root, however, this is a good and stable shell for further enumeration.

Root Own

Owning root is a simple process in this box. Run an existing exploit Samba 3.0.20 < 3.0.25rc3 - 'Username' map script' Command Execution (Metasploit) on the old samba service to get the root shell.

Takeaway

My personal takeaway from this box was to enumerate all the running services and the their versions first before running into the manual enumeration. While solving this box I completely forgot about running samba service and wasted quite a while enumerating to privilege escalate my way to root using the daemon shell.

PreviousLinuxNextBashed

Last updated

Was this helpful?