Posts for: #Proving-Grounds

PG: Shifty

#offsec  #proving-grounds  #hard  #linux  #memcached  #pickle-deserialization  #cve-2021-33026  #flask  #des 
ターゲット // Shifty
PlatformOffSec Proving Grounds
OSLinux
DifficultyHard
IP192.168.244.59

Enumeration

Nmap

▶ Nmap output
PORT      STATE SERVICE   VERSION
22/tcp    open  ssh       OpenSSH 7.4p1 Debian 10+deb9u7 (protocol 2.0)
80/tcp    open  http      nginx 1.10.3
5000/tcp  open  http      Werkzeug httpd 1.0.1 (Python 3.5.3)
11211/tcp open  memcached Memcached 1.4.33 (uptime 388 seconds)

Four ports, but two of them talk to each other. Port 5000 is a Flask app (Werkzeug/Python), and port 11211 is memcached — sitting wide open with no auth. That pairing is the whole box.

[]

PG: UT99

#offsec  #proving-grounds  #medium  #windows  #irc  #unreal-tournament  #buffer-overflow  #seh  #unquoted-service-path 
ターゲット // UT99
PlatformOffSec Proving Grounds
OSWindows
DifficultyMedium
IP192.168.206.44

Enumeration

Nmap

A full port sweep is deliberately noisy here — the box parks an InspIRCd instance on dozens of ports across the 6660-7007 range, enough to make autorecon choke. Trimmed to the services that actually matter:

▶ Nmap output
PORT      STATE SERVICE   VERSION
21/tcp    open  ftp       FileZilla ftpd
80/tcp    open  http      Apache httpd 2.4.16 (OpenSSL/1.0.1p PHP/5.6.12)
443/tcp   open  ssl/http  Apache httpd 2.4.16 (OpenSSL/1.0.1p PHP/5.6.12)
3306/tcp  open  mysql     MySQL (unauthorized)
6660-7007 open  irc       InspIRCd
64738/tcp open  murmur    Murmur 1.2.10

FTP wants credentials, MySQL refuses external connections, and the web app on 80/443 is a stock CMS with nothing exploitable after directory fuzzing. Everything obvious is a dead end. The name of the box — UT99 — plus the wall of IRC ports is the actual hint: this is about Unreal Tournament, and the IRC server is where the map lives.

[]

PG: Zino

#offsec  #proving-grounds  #medium  #linux  #booked-scheduler  #rce  #file-upload  #cron  #python 
ターゲット // Zino
PlatformOffSec Proving Grounds
OSLinux
DifficultyMedium
IP192.168.206.64

Enumeration

Nmap

▶ Nmap output
PORT     STATE SERVICE VERSION
21/tcp   open  ftp     vsftpd 3.0.3
22/tcp   open  ssh     OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)
139/tcp  open  netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
445/tcp  open  netbios-ssn Samba smbd 4.9.5-Debian (workgroup: WORKGROUP)
3306/tcp open  mysql   MariaDB (host not allowed)
8003/tcp open  http    Apache httpd 2.4.38

A Debian box with a broad surface. FTP has no anonymous login, MySQL rejects remote connections (localhost-only MariaDB), and SSH is a dead end without creds. That leaves the web app on 8003 and the open SMB shares.

[]

PG: Algernon

#offsec  #proving-grounds  #easy  #windows  #smartermail  #rce  #cve-2019-7214 
ターゲット // Algernon
PlatformOffSec Proving Grounds
OSWindows
DifficultyEasy
IP192.168.197.65

Enumeration

Nmap

▶ Full nmap output
21/tcp    open  ftp           Microsoft ftpd
80/tcp    open  http          Microsoft IIS httpd 10.0
135/tcp   open  msrpc         Microsoft Windows RPC
139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn
445/tcp   open  microsoft-ds?
5040/tcp  open  unknown
9998/tcp  open  http          Microsoft IIS httpd 10.0
17001/tcp open  remoting      MS .NET Remoting services

Port 21 - FTP

Anonymous access is allowed. Downloaded the FTP contents:

[]

PG: Nickel

#offsec  #proving-grounds  #medium  #windows  #api-enumeration  #curl  #pdf-cracking  #command-injection 
ターゲット // Nickel
PlatformOffSec Proving Grounds
OSWindows
DifficultyMedium
IP192.168.57.99

Enumeration

Nmap

▶ Nmap output
PORT      STATE SERVICE       VERSION
21/tcp    open  ftp           FileZilla ftpd
22/tcp    open  ssh           OpenSSH for_Windows_8.1
135/tcp   open  msrpc         Microsoft Windows RPC
139/tcp   open  netbios-ssn
3389/tcp  open  ms-wbt-server Microsoft Terminal Services
8089/tcp  open  http          Microsoft HTTPAPI httpd 2.0
33333/tcp open  http          Microsoft HTTPAPI httpd 2.0

Two HTTP APIs on non-standard ports. FTP requires credentials, no anonymous access.

[]

PG: Banzai

#offsec  #proving-grounds  #medium  #linux  #ftp  #weak-credentials  #mysql  #udf  #privilege-escalation 
ターゲット // Banzai
PlatformOffSec Proving Grounds
OSLinux
DifficultyMedium
IP192.168.89.56

Enumeration

Nmap

▶ Full nmap output
20/tcp   closed ftp-data
21/tcp   open   ftp        vsftpd 3.0.3
22/tcp   open   ssh        OpenSSH 7.4p1 Debian 10+deb9u7 (protocol 2.0)
25/tcp   open   smtp       Postfix smtpd
5432/tcp open   postgresql PostgreSQL DB 9.6.4 - 9.6.6 or 9.6.13 - 9.6.19
8080/tcp open   http       Apache httpd 2.4.25
8295/tcp open   http       Apache httpd 2.4.25 ((Debian))

Port 21 - FTP

No anonymous access. No public exploits for vsftpd 3.0.3 (aside from DoS).

[]

PG: Slort

#offsec  #proving-grounds  #medium  #windows  #lfi  #rfi  #php-wrapper  #scheduled-task  #xampp 
ターゲット // Slort
PlatformOffSec Proving Grounds
OSWindows
DifficultyMedium
IP192.168.105.53

Enumeration

Nmap

▶ Nmap output
PORT     STATE SERVICE VERSION
21/tcp   open  ftp     FileZilla ftpd 0.9.41 beta
135/tcp  open  msrpc   Microsoft Windows RPC
139/tcp  open  netbios-ssn
445/tcp  open  microsoft-ds
3306/tcp open  mysql   MariaDB (host not allowed)
4443/tcp open  http    Apache httpd 2.4.43 (XAMPP)
8080/tcp open  http    Apache httpd 2.4.43 (XAMPP)

Windows box running XAMPP on two HTTP ports (4443 and 8080); the vulnerable app lives on 8080, so 4443 stays untouched. FTP requires credentials, MySQL is localhost-only.

[]

PG: Wombo

#offsec  #proving-grounds  #easy  #linux  #redis  #redis-rce 
ターゲット // Wombo
PlatformOffSec Proving Grounds
OSLinux
DifficultyEasy
IP192.168.105.69

Enumeration

Nmap

▶ Nmap output
PORT      STATE SERVICE  VERSION
22/tcp    open  ssh      OpenSSH 7.4p1 Debian 10+deb9u7
80/tcp    open  http     nginx 1.10.3
6379/tcp  open  redis    Redis key-value store 5.0.9
8080/tcp  open  http-proxy
27017/tcp open  mongod?

Multiple services, but Redis on 6379 with no authentication is the obvious target. Port 8080 runs NodeBB – a rabbit hole.

[]

PG: ClamAV

#offsec  #proving-grounds  #easy  #linux  #clamav  #sendmail  #snmp  #smtp 
ターゲット // ClamAV
PlatformOffSec Proving Grounds
OSLinux
DifficultyEasy
IP192.168.57.42

Enumeration

Nmap

▶ Full nmap output (TCP)
PORT      STATE SERVICE     VERSION
22/tcp    open  ssh         OpenSSH 3.8.1p1 Debian 8.sarge.6 (protocol 2.0)
25/tcp    open  smtp        Sendmail 8.13.4/8.13.4/Debian-3sarge3
80/tcp    open  http        Apache httpd 1.3.33 ((Debian GNU/Linux))
139/tcp   open  netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
199/tcp   open  smux        Linux SNMP multiplexer
445/tcp   open  netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
60000/tcp open  ssh         OpenSSH 3.8.1p1 Debian 8.sarge.6 (protocol 2.0)
▶ Full nmap output (UDP)
PORT     STATE         SERVICE      VERSION
137/udp  open          netbios-ns   Samba nmbd netbios-ns (workgroup: WORKGROUP)
161/udp  open          snmp         SNMPv1 server (public)
[ 警告 ]
Don’t forget to enumerate UDP. This box has SNMP v1 on UDP 161 which reveals critical information.

Ports 199 (smux – the SNMP multiplexer, tied to the SNMP service on UDP 161) and 60000 (a second OpenSSH listener) are open but weren’t part of the path.

[]