Posts for: #Medium

PG: Dibble

#offsec  #proving-grounds  #medium  #linux  #nodejs  #eval-rce  #mongodb  #suid  #gtfobins 
ターゲット // Dibble
PlatformOffSec Proving Grounds
OSLinux
DifficultyMedium
IP192.168.179.110

Enumeration

Nmap

▶ Nmap output
PORT      STATE SERVICE VERSION
21/tcp    open  ftp     vsftpd 3.0.3
22/tcp    open  ssh     OpenSSH 8.3 (protocol 2.0)
80/tcp    open  http    Apache httpd 2.4.46 ((Fedora))
3000/tcp  open  http    Node.js (Express middleware)
27017/tcp open  mongodb MongoDB 4.2.9

Fedora box with a busy surface. Anonymous FTP is allowed but the listing hangs and holds nothing. Port 80 is a stock Drupal 9.0.6 install page (/core/install.php) — a red herring that goes nowhere. The two ports that matter are the MongoDB on 27017 (exposed with no auth) and the Node.js/Express app on 3000.

[]

PG: Fail

#offsec  #proving-grounds  #medium  #linux  #rsync  #fail2ban  #ssh-key-injection  #writable-config 
ターゲット // Fail
PlatformOffSec Proving Grounds
OSLinux
DifficultyMedium
IP192.168.100.126

Enumeration

Nmap

▶ Nmap output
PORT    STATE SERVICE VERSION
22/tcp  open  ssh     OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)
873/tcp open  rsync   (protocol version 31)

Two ports. SSH accepts both pubkey and password auth but we have no creds, so it stays shut for now. That leaves rsync on 873 – a daemon that ships wide open more often than it should.

[]

PG: Hetemit

#offsec  #proving-grounds  #medium  #linux  #python-rce  #flask  #werkzeug  #code-injection  #systemd-service 
ターゲット // Hetemit
PlatformOffSec Proving Grounds
OSLinux
DifficultyMedium
IP192.168.149.117

Enumeration

Nmap

▶ Nmap output
PORT      STATE SERVICE     VERSION
21/tcp    open  ftp         vsftpd 3.0.3
22/tcp    open  ssh         OpenSSH 8.0 (protocol 2.0)
80/tcp    open  http        Apache httpd 2.4.37 ((centos))
139/tcp   open  netbios-ssn Samba smbd 4.6.2
445/tcp   open  netbios-ssn Samba smbd 4.6.2
50000/tcp open  http        Werkzeug httpd 1.0.1 (Python 3.6.8)

Six ports. FTP allows anonymous login but has nothing useful, port 80 is a stock Apache/CentOS test page, and SSH is a dead end. The two things worth chasing are SMB (for a username) and the Werkzeug dev server on 50000.

[]

PG: Hunit

#offsec  #proving-grounds  #medium  #linux  #api-info-disclosure  #credential-reuse  #git-server  #cron-job  #ssh-key 
ターゲット // Hunit
PlatformOffSec Proving Grounds
OSLinux
DifficultyMedium
IP192.168.142.125

Enumeration

Nmap

▶ Nmap output
PORT      STATE SERVICE      VERSION
8080/tcp  open  http-proxy   (custom web app + REST API)
12445/tcp open  netbios-ssn  Samba smbd 4.6.2
18030/tcp open  http         Apache httpd 2.4.46 ((Unix))
43022/tcp open  ssh          OpenSSH 8.4 (protocol 2.0)

Everything is on non-standard ports. SMB (12445) and the Apache instance on 18030 turn out to be dead ends — the static site on 18030 is just a landing page, and Samba exposes nothing interesting. SSH sits on 43022, so keep that port in mind: any creds we find get tried there.

[]

PG: Jacko

#offsec  #proving-grounds  #medium  #windows  #h2-database  #rce  #printspoofer  #seimpersonate  #credential-disclosure 
ターゲット // Jacko
PlatformOffSec Proving Grounds
OSWindows
DifficultyMedium
IP192.168.89.66

Enumeration

Nmap

▶ Nmap output
PORT     STATE SERVICE       VERSION
80/tcp   open  http          Microsoft IIS httpd 10.0 (redirects to H2 Database Engine)
135/tcp  open  msrpc         Microsoft Windows RPC
139/tcp  open  netbios-ssn
445/tcp  open  microsoft-ds
8082/tcp open  http          H2 database http console

Windows host. Port 80 redirects to an H2 Database Engine banner, and port 8082 serves the H2 web console directly. SMB (139/445) is present but gives nothing useful as an anonymous user.

[]

PG: Nibbles

#offsec  #proving-grounds  #medium  #linux  #postgresql  #default-credentials  #rce  #suid  #gtfobins 
ターゲット // Nibbles
PlatformOffSec Proving Grounds
OSLinux
DifficultyMedium
IP192.168.184.47

Enumeration

Nmap

▶ Nmap output
PORT     STATE SERVICE    VERSION
21/tcp   open  ftp        vsftpd 3.0.3
22/tcp   open  ssh        OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)
80/tcp   open  http       Apache httpd 2.4.38 ((Debian))
5437/tcp open  postgresql PostgreSQL DB 11.3 - 11.9

Four services on a Debian 10 (Buster) box. FTP rejects anonymous login, SSH is a dead end without creds, and Apache serves nothing worth fuzzing. The odd one out is PostgreSQL on 5437 — not the default 5432. A database exposed straight to the network, on a port someone deliberately moved, is where the attention goes.

[]

PG: UT99

#offsec  #proving-grounds  #medium  #windows  #irc  #unreal-tournament  #buffer-overflow  #seh  #unquoted-service-path 
ターゲット // UT99
PlatformOffSec Proving Grounds
OSWindows
DifficultyMedium
IP192.168.206.44

Enumeration

Nmap

A full port sweep is deliberately noisy here — the box parks an InspIRCd instance on dozens of ports across the 6660-7007 range, enough to make autorecon choke. Trimmed to the services that actually matter:

▶ Nmap output
PORT      STATE SERVICE   VERSION
21/tcp    open  ftp       FileZilla ftpd
80/tcp    open  http      Apache httpd 2.4.16 (OpenSSL/1.0.1p PHP/5.6.12)
443/tcp   open  ssl/http  Apache httpd 2.4.16 (OpenSSL/1.0.1p PHP/5.6.12)
3306/tcp  open  mysql     MySQL (unauthorized)
6660-7007 open  irc       InspIRCd
64738/tcp open  murmur    Murmur 1.2.10

FTP wants credentials, MySQL refuses external connections, and the web app on 80/443 is a stock CMS with nothing exploitable after directory fuzzing. Everything obvious is a dead end. The name of the box — UT99 — plus the wall of IRC ports is the actual hint: this is about Unreal Tournament, and the IRC server is where the map lives.

[]

PG: Zino

#offsec  #proving-grounds  #medium  #linux  #booked-scheduler  #rce  #file-upload  #cron  #python 
ターゲット // Zino
PlatformOffSec Proving Grounds
OSLinux
DifficultyMedium
IP192.168.206.64

Enumeration

Nmap

▶ Nmap output
PORT     STATE SERVICE VERSION
21/tcp   open  ftp     vsftpd 3.0.3
22/tcp   open  ssh     OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)
139/tcp  open  netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
445/tcp  open  netbios-ssn Samba smbd 4.9.5-Debian (workgroup: WORKGROUP)
3306/tcp open  mysql   MariaDB (host not allowed)
8003/tcp open  http    Apache httpd 2.4.38

A Debian box with a broad surface. FTP has no anonymous login, MySQL rejects remote connections (localhost-only MariaDB), and SSH is a dead end without creds. That leaves the web app on 8003 and the open SMB shares.

[]

PG: Nickel

#offsec  #proving-grounds  #medium  #windows  #api-enumeration  #curl  #pdf-cracking  #command-injection 
ターゲット // Nickel
PlatformOffSec Proving Grounds
OSWindows
DifficultyMedium
IP192.168.57.99

Enumeration

Nmap

▶ Nmap output
PORT      STATE SERVICE       VERSION
21/tcp    open  ftp           FileZilla ftpd
22/tcp    open  ssh           OpenSSH for_Windows_8.1
135/tcp   open  msrpc         Microsoft Windows RPC
139/tcp   open  netbios-ssn
3389/tcp  open  ms-wbt-server Microsoft Terminal Services
8089/tcp  open  http          Microsoft HTTPAPI httpd 2.0
33333/tcp open  http          Microsoft HTTPAPI httpd 2.0

Two HTTP APIs on non-standard ports. FTP requires credentials, no anonymous access.

[]

PG: Banzai

#offsec  #proving-grounds  #medium  #linux  #ftp  #weak-credentials  #mysql  #udf  #privilege-escalation 
ターゲット // Banzai
PlatformOffSec Proving Grounds
OSLinux
DifficultyMedium
IP192.168.89.56

Enumeration

Nmap

▶ Full nmap output
20/tcp   closed ftp-data
21/tcp   open   ftp        vsftpd 3.0.3
22/tcp   open   ssh        OpenSSH 7.4p1 Debian 10+deb9u7 (protocol 2.0)
25/tcp   open   smtp       Postfix smtpd
5432/tcp open   postgresql PostgreSQL DB 9.6.4 - 9.6.6 or 9.6.13 - 9.6.19
8080/tcp open   http       Apache httpd 2.4.25
8295/tcp open   http       Apache httpd 2.4.25 ((Debian))

Port 21 - FTP

No anonymous access. No public exploits for vsftpd 3.0.3 (aside from DoS).

[]