Posts for: #Linux

PG: Dibble

#offsec  #proving-grounds  #medium  #linux  #nodejs  #eval-rce  #mongodb  #suid  #gtfobins 
ターゲット // Dibble
PlatformOffSec Proving Grounds
OSLinux
DifficultyMedium
IP192.168.179.110

Enumeration

Nmap

▶ Nmap output
PORT      STATE SERVICE VERSION
21/tcp    open  ftp     vsftpd 3.0.3
22/tcp    open  ssh     OpenSSH 8.3 (protocol 2.0)
80/tcp    open  http    Apache httpd 2.4.46 ((Fedora))
3000/tcp  open  http    Node.js (Express middleware)
27017/tcp open  mongodb MongoDB 4.2.9

Fedora box with a busy surface. Anonymous FTP is allowed but the listing hangs and holds nothing. Port 80 is a stock Drupal 9.0.6 install page (/core/install.php) — a red herring that goes nowhere. The two ports that matter are the MongoDB on 27017 (exposed with no auth) and the Node.js/Express app on 3000.

[]

PG: Fail

#offsec  #proving-grounds  #medium  #linux  #rsync  #fail2ban  #ssh-key-injection  #writable-config 
ターゲット // Fail
PlatformOffSec Proving Grounds
OSLinux
DifficultyMedium
IP192.168.100.126

Enumeration

Nmap

▶ Nmap output
PORT    STATE SERVICE VERSION
22/tcp  open  ssh     OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)
873/tcp open  rsync   (protocol version 31)

Two ports. SSH accepts both pubkey and password auth but we have no creds, so it stays shut for now. That leaves rsync on 873 – a daemon that ships wide open more often than it should.

[]

PG: Hetemit

#offsec  #proving-grounds  #medium  #linux  #python-rce  #flask  #werkzeug  #code-injection  #systemd-service 
ターゲット // Hetemit
PlatformOffSec Proving Grounds
OSLinux
DifficultyMedium
IP192.168.149.117

Enumeration

Nmap

▶ Nmap output
PORT      STATE SERVICE     VERSION
21/tcp    open  ftp         vsftpd 3.0.3
22/tcp    open  ssh         OpenSSH 8.0 (protocol 2.0)
80/tcp    open  http        Apache httpd 2.4.37 ((centos))
139/tcp   open  netbios-ssn Samba smbd 4.6.2
445/tcp   open  netbios-ssn Samba smbd 4.6.2
50000/tcp open  http        Werkzeug httpd 1.0.1 (Python 3.6.8)

Six ports. FTP allows anonymous login but has nothing useful, port 80 is a stock Apache/CentOS test page, and SSH is a dead end. The two things worth chasing are SMB (for a username) and the Werkzeug dev server on 50000.

[]

PG: Hunit

#offsec  #proving-grounds  #medium  #linux  #api-info-disclosure  #credential-reuse  #git-server  #cron-job  #ssh-key 
ターゲット // Hunit
PlatformOffSec Proving Grounds
OSLinux
DifficultyMedium
IP192.168.142.125

Enumeration

Nmap

▶ Nmap output
PORT      STATE SERVICE      VERSION
8080/tcp  open  http-proxy   (custom web app + REST API)
12445/tcp open  netbios-ssn  Samba smbd 4.6.2
18030/tcp open  http         Apache httpd 2.4.46 ((Unix))
43022/tcp open  ssh          OpenSSH 8.4 (protocol 2.0)

Everything is on non-standard ports. SMB (12445) and the Apache instance on 18030 turn out to be dead ends — the static site on 18030 is just a landing page, and Samba exposes nothing interesting. SSH sits on 43022, so keep that port in mind: any creds we find get tried there.

[]

PG: Nibbles

#offsec  #proving-grounds  #medium  #linux  #postgresql  #default-credentials  #rce  #suid  #gtfobins 
ターゲット // Nibbles
PlatformOffSec Proving Grounds
OSLinux
DifficultyMedium
IP192.168.184.47

Enumeration

Nmap

▶ Nmap output
PORT     STATE SERVICE    VERSION
21/tcp   open  ftp        vsftpd 3.0.3
22/tcp   open  ssh        OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)
80/tcp   open  http       Apache httpd 2.4.38 ((Debian))
5437/tcp open  postgresql PostgreSQL DB 11.3 - 11.9

Four services on a Debian 10 (Buster) box. FTP rejects anonymous login, SSH is a dead end without creds, and Apache serves nothing worth fuzzing. The odd one out is PostgreSQL on 5437 — not the default 5432. A database exposed straight to the network, on a port someone deliberately moved, is where the attention goes.

[]

PG: Shifty

#offsec  #proving-grounds  #hard  #linux  #memcached  #pickle-deserialization  #cve-2021-33026  #flask  #des 
ターゲット // Shifty
PlatformOffSec Proving Grounds
OSLinux
DifficultyHard
IP192.168.244.59

Enumeration

Nmap

▶ Nmap output
PORT      STATE SERVICE   VERSION
22/tcp    open  ssh       OpenSSH 7.4p1 Debian 10+deb9u7 (protocol 2.0)
80/tcp    open  http      nginx 1.10.3
5000/tcp  open  http      Werkzeug httpd 1.0.1 (Python 3.5.3)
11211/tcp open  memcached Memcached 1.4.33 (uptime 388 seconds)

Four ports, but two of them talk to each other. Port 5000 is a Flask app (Werkzeug/Python), and port 11211 is memcached — sitting wide open with no auth. That pairing is the whole box.

[]

PG: Zino

#offsec  #proving-grounds  #medium  #linux  #booked-scheduler  #rce  #file-upload  #cron  #python 
ターゲット // Zino
PlatformOffSec Proving Grounds
OSLinux
DifficultyMedium
IP192.168.206.64

Enumeration

Nmap

▶ Nmap output
PORT     STATE SERVICE VERSION
21/tcp   open  ftp     vsftpd 3.0.3
22/tcp   open  ssh     OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)
139/tcp  open  netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
445/tcp  open  netbios-ssn Samba smbd 4.9.5-Debian (workgroup: WORKGROUP)
3306/tcp open  mysql   MariaDB (host not allowed)
8003/tcp open  http    Apache httpd 2.4.38

A Debian box with a broad surface. FTP has no anonymous login, MySQL rejects remote connections (localhost-only MariaDB), and SSH is a dead end without creds. That leaves the web app on 8003 and the open SMB shares.

[]

PG: Banzai

#offsec  #proving-grounds  #medium  #linux  #ftp  #weak-credentials  #mysql  #udf  #privilege-escalation 
ターゲット // Banzai
PlatformOffSec Proving Grounds
OSLinux
DifficultyMedium
IP192.168.89.56

Enumeration

Nmap

▶ Full nmap output
20/tcp   closed ftp-data
21/tcp   open   ftp        vsftpd 3.0.3
22/tcp   open   ssh        OpenSSH 7.4p1 Debian 10+deb9u7 (protocol 2.0)
25/tcp   open   smtp       Postfix smtpd
5432/tcp open   postgresql PostgreSQL DB 9.6.4 - 9.6.6 or 9.6.13 - 9.6.19
8080/tcp open   http       Apache httpd 2.4.25
8295/tcp open   http       Apache httpd 2.4.25 ((Debian))

Port 21 - FTP

No anonymous access. No public exploits for vsftpd 3.0.3 (aside from DoS).

[]

PG: Wombo

#offsec  #proving-grounds  #easy  #linux  #redis  #redis-rce 
ターゲット // Wombo
PlatformOffSec Proving Grounds
OSLinux
DifficultyEasy
IP192.168.105.69

Enumeration

Nmap

▶ Nmap output
PORT      STATE SERVICE  VERSION
22/tcp    open  ssh      OpenSSH 7.4p1 Debian 10+deb9u7
80/tcp    open  http     nginx 1.10.3
6379/tcp  open  redis    Redis key-value store 5.0.9
8080/tcp  open  http-proxy
27017/tcp open  mongod?

Multiple services, but Redis on 6379 with no authentication is the obvious target. Port 8080 runs NodeBB – a rabbit hole.

[]

PG: ClamAV

#offsec  #proving-grounds  #easy  #linux  #clamav  #sendmail  #snmp  #smtp 
ターゲット // ClamAV
PlatformOffSec Proving Grounds
OSLinux
DifficultyEasy
IP192.168.57.42

Enumeration

Nmap

▶ Full nmap output (TCP)
PORT      STATE SERVICE     VERSION
22/tcp    open  ssh         OpenSSH 3.8.1p1 Debian 8.sarge.6 (protocol 2.0)
25/tcp    open  smtp        Sendmail 8.13.4/8.13.4/Debian-3sarge3
80/tcp    open  http        Apache httpd 1.3.33 ((Debian GNU/Linux))
139/tcp   open  netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
199/tcp   open  smux        Linux SNMP multiplexer
445/tcp   open  netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
60000/tcp open  ssh         OpenSSH 3.8.1p1 Debian 8.sarge.6 (protocol 2.0)
▶ Full nmap output (UDP)
PORT     STATE         SERVICE      VERSION
137/udp  open          netbios-ns   Samba nmbd netbios-ns (workgroup: WORKGROUP)
161/udp  open          snmp         SNMPv1 server (public)
[ 警告 ]
Don’t forget to enumerate UDP. This box has SNMP v1 on UDP 161 which reveals critical information.

Ports 199 (smux – the SNMP multiplexer, tied to the SNMP service on UDP 161) and 60000 (a second OpenSSH listener) are open but weren’t part of the path.

[]