Suid on ioctl

PG: Astronaut

Sat, 24 Feb 2024 00:00:00 +0000

ターゲット // Astronaut
Platform	OffSec Proving Grounds
OS	Linux
Difficulty	Easy
IP	`192.168.155.12`

Enumeration

Nmap

▶ Nmap output

PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.5 (Ubuntu Linux; protocol 2.0)
80/tcp open http Apache httpd 2.4.41 ((Ubuntu))

Two ports. SSH is a dead end without creds, so the web server is the way in. The Apache directory listing on port 80 exposes a grav-admin/ folder — a Grav CMS install. robots.txt confirms a stock Grav layout (/user/, /system/, /cache/…).

PG: Dibble

Tue, 07 Mar 2023 00:00:00 +0000

ターゲット // Dibble
Platform	OffSec Proving Grounds
OS	Linux
Difficulty	Medium
IP	`192.168.179.110`

Enumeration

Nmap

▶ Nmap output

PORT STATE SERVICE VERSION
21/tcp open ftp vsftpd 3.0.3
22/tcp open ssh OpenSSH 8.3 (protocol 2.0)
80/tcp open http Apache httpd 2.4.46 ((Fedora))
3000/tcp open http Node.js (Express middleware)
27017/tcp open mongodb MongoDB 4.2.9

Fedora box with a busy surface. Anonymous FTP is allowed but the listing hangs and holds nothing. Port 80 is a stock Drupal 9.0.6 install page (/core/install.php) — a red herring that goes nowhere. The two ports that matter are the MongoDB on 27017 (exposed with no auth) and the Node.js/Express app on 3000.

PG: Nibbles

Tue, 07 Mar 2023 00:00:00 +0000

ターゲット // Nibbles
Platform	OffSec Proving Grounds
OS	Linux
Difficulty	Medium
IP	`192.168.184.47`

Enumeration

Nmap

▶ Nmap output

PORT STATE SERVICE VERSION
21/tcp open ftp vsftpd 3.0.3
22/tcp open ssh OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)
80/tcp open http Apache httpd 2.4.38 ((Debian))
5437/tcp open postgresql PostgreSQL DB 11.3 - 11.9

Four services on a Debian 10 (Buster) box. FTP rejects anonymous login, SSH is a dead end without creds, and Apache serves nothing worth fuzzing. The odd one out is PostgreSQL on 5437 — not the default 5432. A database exposed straight to the network, on a port someone deliberately moved, is where the attention goes.