Posts for: #Gtfobins

PG: Astronaut

#offsec  #proving-grounds  #easy  #linux  #grav-cms  #cve-2021-21425  #rce  #suid  #gtfobins 
ターゲット // Astronaut
PlatformOffSec Proving Grounds
OSLinux
DifficultyEasy
IP192.168.155.12

Enumeration

Nmap

▶ Nmap output
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.5 (Ubuntu Linux; protocol 2.0)
80/tcp open  http    Apache httpd 2.4.41 ((Ubuntu))

Two ports. SSH is a dead end without creds, so the web server is the way in. The Apache directory listing on port 80 exposes a grav-admin/ folder — a Grav CMS install. robots.txt confirms a stock Grav layout (/user/, /system/, /cache/…).

[]

HTB: Knife

#htb  #easy  #linux  #php-backdoor  #gtfobins 
ターゲット // Knife
PlatformHTB
OSLinux
DifficultyEasy
IP10.129.44.1

Enumeration

Nmap

1

nmap -sC -sV -oN nmap/initial 10.129.44.1
▶ Nmap output
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH
80/tcp open  http    Apache httpd 2.4.6

OS: Linux (Ubuntu, kernel 5.4.0-80-generic)

[]

PG: Peppo

#offsec  #proving-grounds  #hard  #linux  #ident  #weak-credentials  #rbash-escape  #docker-privesc  #gtfobins 
ターゲット // Peppo
PlatformOffSec Proving Grounds
OSLinux
DifficultyHard
IP192.168.100.60

Enumeration

Nmap

▶ Nmap output
PORT     STATE SERVICE    VERSION
22/tcp   open  ssh        OpenSSH 7.4p1 Debian 10+deb9u7 (protocol 2.0)
113/tcp  open  ident
5432/tcp open  postgresql PostgreSQL DB 12.3 - 12.4
8080/tcp open  http       WEBrick httpd 1.4.2 (Ruby 2.6.6 (2020-03-31))

Four services, and most of them are noise. The Redmine app on 8080 and PostgreSQL on 5432 both look inviting but lead nowhere. The pivotal service is the easy-to-overlook one: ident on port 113.

[]

PG: Dibble

#offsec  #proving-grounds  #medium  #linux  #nodejs  #eval-rce  #mongodb  #suid  #gtfobins 
ターゲット // Dibble
PlatformOffSec Proving Grounds
OSLinux
DifficultyMedium
IP192.168.179.110

Enumeration

Nmap

▶ Nmap output
PORT      STATE SERVICE VERSION
21/tcp    open  ftp     vsftpd 3.0.3
22/tcp    open  ssh     OpenSSH 8.3 (protocol 2.0)
80/tcp    open  http    Apache httpd 2.4.46 ((Fedora))
3000/tcp  open  http    Node.js (Express middleware)
27017/tcp open  mongodb MongoDB 4.2.9

Fedora box with a busy surface. Anonymous FTP is allowed but the listing hangs and holds nothing. Port 80 is a stock Drupal 9.0.6 install page (/core/install.php) — a red herring that goes nowhere. The two ports that matter are the MongoDB on 27017 (exposed with no auth) and the Node.js/Express app on 3000.

[]

PG: Nibbles

#offsec  #proving-grounds  #medium  #linux  #postgresql  #default-credentials  #rce  #suid  #gtfobins 
ターゲット // Nibbles
PlatformOffSec Proving Grounds
OSLinux
DifficultyMedium
IP192.168.184.47

Enumeration

Nmap

▶ Nmap output
PORT     STATE SERVICE    VERSION
21/tcp   open  ftp        vsftpd 3.0.3
22/tcp   open  ssh        OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)
80/tcp   open  http       Apache httpd 2.4.38 ((Debian))
5437/tcp open  postgresql PostgreSQL DB 11.3 - 11.9

Four services on a Debian 10 (Buster) box. FTP rejects anonymous login, SSH is a dead end without creds, and Apache serves nothing worth fuzzing. The odd one out is PostgreSQL on 5437 — not the default 5432. A database exposed straight to the network, on a port someone deliberately moved, is where the attention goes.

[]