Edit

Academy

Enumeration

IP -> 10.0.2.7
Nmap scan report for 10.0.2.7
Host is up (0.00017s latency).
Not shown: 65532 closed tcp ports (conn-refused)
PORT   STATE SERVICE VERSION
21/tcp open  ftp     vsftpd 3.0.3
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
|_-rw-r--r--    1 1000     1000          776 May 30  2021 note.txt
| ftp-syst: 
|   STAT: 
| FTP server status:
|      Connected to ::ffff:10.0.2.10
|      Logged in as ftp
|      TYPE: ASCII
|      No session bandwidth limit
|      Session timeout in seconds is 300
|      Control connection is plain text
|      Data connections will be plain text
|      At session startup, client count was 4
|      vsFTPd 3.0.3 - secure, fast, stable
|_End of status
22/tcp open  ssh     OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)
| ssh-hostkey: 
|   2048 c7:44:58:86:90:fd:e4:de:5b:0d:bf:07:8d:05:5d:d7 (RSA)
|   256 78:ec:47:0f:0f:53:aa:a6:05:48:84:80:94:76:a6:23 (ECDSA)
|_  256 99:9c:39:11:dd:35:53:a0:29:11:20:c7:f8:bf:71:a4 (ED25519)
80/tcp open  http    Apache httpd 2.4.38 ((Debian))
|_http-title: Apache2 Debian Default Page: It works
|_http-server-header: Apache/2.4.38 (Debian)
Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 7.76 seconds

Insteresting ports

21 -> FTP 80 -> Apache/2.4.38 ((Debian))

FTP

Apache

Step 1

Step 2

  • Search in google php reverse shell

  • Upload php-reverse-shell.php to server (photo image)

Usually would be necessary to access the url to start the script

http://10.0.2.7/academy/studentphoto/php-reverse-shell.php

However in this case, was executed automatically, only go back to terminal and shell is available

Step 3

With www-data user under our control, now is necessary to use privilege scalation.

  • Vulnerable Machine

Important notes

Useful commands to run:

  • sudo -l

  • history

  • crontab -l

  • systemctl list-timers

Run linpeas.sh again just in case

/tmp/linpeas.sh

Step 4

pspy

pspy is a command line tool designed to snoop on processes without need for root permissions. It allows you to see commands run by other users, cron jobs, etc. as they execute. Great for enumeration of Linux systems in CTFs. Also great to demonstrate your colleagues why passing secrets as arguments on the command line is a bad idea.

  • On vulnerable machine

If there`s no outside access, use the same trick with the python3 -m http.server 80 and transfer the file

  • Google reverse shell one liner

Bash reverse shell one liner cheat sheet

  • Attacker machine

  • Vulnerable machine

Edit backup.sh and add the command to be executed

PreviousBlueNextDev

Last updated