Posts for: #Weak-Credentials

PG: Peppo

#offsec  #proving-grounds  #hard  #linux  #ident  #weak-credentials  #rbash-escape  #docker-privesc  #gtfobins 
ターゲット // Peppo
PlatformOffSec Proving Grounds
OSLinux
DifficultyHard
IP192.168.100.60

Enumeration

Nmap

▶ Nmap output
PORT     STATE SERVICE    VERSION
22/tcp   open  ssh        OpenSSH 7.4p1 Debian 10+deb9u7 (protocol 2.0)
113/tcp  open  ident
5432/tcp open  postgresql PostgreSQL DB 12.3 - 12.4
8080/tcp open  http       WEBrick httpd 1.4.2 (Ruby 2.6.6 (2020-03-31))

Four services, and most of them are noise. The Redmine app on 8080 and PostgreSQL on 5432 both look inviting but lead nowhere. The pivotal service is the easy-to-overlook one: ident on port 113.

[]

PG: Billyboss

#offsec  #proving-grounds  #medium  #windows  #nexus  #cve-2020-10199  #weak-credentials  #smbghost  #cve-2020-0796 
ターゲット // Billyboss
PlatformOffSec Proving Grounds
OSWindows
DifficultyMedium
IP192.168.134.61

Enumeration

Nmap

The two ports that matter — a Nexus web service and SMB:

▶ Nmap output
PORT     STATE SERVICE       VERSION
445/tcp  open  microsoft-ds
8081/tcp open  http          Sonatype Nexus Repository Manager OSS 3.21.0-05

A Windows host with a web service on port 8081 — Sonatype Nexus Repository Manager OSS 3.21.0-05. SMB (445) is also exposed, which becomes relevant for privilege escalation later.

[]

PG: Banzai

#offsec  #proving-grounds  #medium  #linux  #ftp  #weak-credentials  #mysql  #udf  #privilege-escalation 
ターゲット // Banzai
PlatformOffSec Proving Grounds
OSLinux
DifficultyMedium
IP192.168.89.56

Enumeration

Nmap

▶ Full nmap output
20/tcp   closed ftp-data
21/tcp   open   ftp        vsftpd 3.0.3
22/tcp   open   ssh        OpenSSH 7.4p1 Debian 10+deb9u7 (protocol 2.0)
25/tcp   open   smtp       Postfix smtpd
5432/tcp open   postgresql PostgreSQL DB 9.6.4 - 9.6.6 or 9.6.13 - 9.6.19
8080/tcp open   http       Apache httpd 2.4.25
8295/tcp open   http       Apache httpd 2.4.25 ((Debian))

Port 21 - FTP

No anonymous access. No public exploits for vsftpd 3.0.3 (aside from DoS).

[]