{"id":585,"date":"2020-07-25T11:19:06","date_gmt":"2020-07-25T10:19:06","guid":{"rendered":"http:\/\/vroamam.com\/wordpress\/?p=585"},"modified":"2020-09-15T17:41:03","modified_gmt":"2020-09-15T16:41:03","slug":"lame-htb-writeup","status":"publish","type":"post","link":"https:\/\/vroamam.com\/wordpress\/blog\/lame-htb-writeup\/","title":{"rendered":"Lame &#8211; HTB Writeup"},"content":{"rendered":"\n<p>The third in my series of write-ups from HTB and The Cyber Mentor&#8217;s mid course capstone from his Practical Ethical Hacking Course, this time we are doing Lame<\/p>\n\n\n\n<p>So as you should be aware by now we start with our normal reconnaissance using <em>Nmap<\/em><\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">sudo nmap -A -T4 -p- 10.10.10.3<\/pre>\n\n\n\n<p>and as you would expect we have some output<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"alignleft size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"2428\" height=\"1934\" src=\"http:\/\/vroamam.com\/wordpress\/wp-content\/uploads\/2020\/07\/image-46.png\" alt=\"\" class=\"wp-image-586\" srcset=\"https:\/\/vroamam.com\/wordpress\/wp-content\/uploads\/2020\/07\/image-46.png 2428w, https:\/\/vroamam.com\/wordpress\/wp-content\/uploads\/2020\/07\/image-46-1000x797.png 1000w, https:\/\/vroamam.com\/wordpress\/wp-content\/uploads\/2020\/07\/image-46-768x612.png 768w, https:\/\/vroamam.com\/wordpress\/wp-content\/uploads\/2020\/07\/image-46-1536x1223.png 1536w, https:\/\/vroamam.com\/wordpress\/wp-content\/uploads\/2020\/07\/image-46-2048x1631.png 2048w\" sizes=\"auto, (max-width: 2428px) 100vw, 2428px\" \/><figcaption>screenshot showing the output of an Nmap scan<\/figcaption><\/figure><\/div>\n\n\n\n<p>So what does this tell us? Well we have open ports 21, 22, 139 and 445. That should tell you that we have FTP, SSH and SMB all running<\/p>\n\n\n\n<p>What is the OS? What version of those services are running? The <em>Nmap<\/em> scan give us that information<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1100\" height=\"851\" src=\"http:\/\/vroamam.com\/wordpress\/wp-content\/uploads\/2020\/07\/image-48.png\" alt=\"\" class=\"wp-image-588\" srcset=\"https:\/\/vroamam.com\/wordpress\/wp-content\/uploads\/2020\/07\/image-48.png 1100w, https:\/\/vroamam.com\/wordpress\/wp-content\/uploads\/2020\/07\/image-48-1000x774.png 1000w, https:\/\/vroamam.com\/wordpress\/wp-content\/uploads\/2020\/07\/image-48-768x594.png 768w\" sizes=\"auto, (max-width: 1100px) 100vw, 1100px\" \/><figcaption>screenshot of the Nmap scan output with the services and OS versions highlighted<\/figcaption><\/figure><\/div>\n\n\n\n<ul class=\"wp-block-list\"><li>FTP is running vsftpd 2.3.4<\/li><li>SSH is running on OpenSSG 4.7 for Debian<\/li><li>SMB is using Samba, 3.0.20 for Debian<\/li><\/ul>\n\n\n\n<p>As I&#8217;ve worked through the course material, TCM has suggested that SMB should be the first port of call, at the time I didn&#8217;t know that so I started with FTP<\/p>\n\n\n\n<p>First of all, it tells us that anonymous FTP is allowed<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1100\" height=\"851\" src=\"http:\/\/vroamam.com\/wordpress\/wp-content\/uploads\/2020\/07\/image-49.png\" alt=\"\" class=\"wp-image-589\" srcset=\"https:\/\/vroamam.com\/wordpress\/wp-content\/uploads\/2020\/07\/image-49.png 1100w, https:\/\/vroamam.com\/wordpress\/wp-content\/uploads\/2020\/07\/image-49-1000x774.png 1000w, https:\/\/vroamam.com\/wordpress\/wp-content\/uploads\/2020\/07\/image-49-768x594.png 768w\" sizes=\"auto, (max-width: 1100px) 100vw, 1100px\" \/><figcaption>Screenshot of Nmap output highlighting that FTP allows Anonymous login is allowed<\/figcaption><\/figure>\n\n\n\n<p>What can we see if we login to FTP? Anonymous login from a terminal is easy<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">ftp 10.10.10.3\n Connected to 10.10.10.3.\n 220 (vsFTPd 2.3.4)\n Name (10.10.10.3:htb-sailingbikeruk): anonymous\n 331 Please specify the password.\n Password:<em><strong>&lt;manually enter something\/anything here&gt;<\/strong><\/em>\n 230 Login successful.\n Remote system type is UNIX.\n Using binary mode to transfer files.\n ftp&gt;\n<\/pre>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"644\" height=\"176\" src=\"http:\/\/vroamam.com\/wordpress\/wp-content\/uploads\/2020\/07\/image-50.png\" alt=\"\" class=\"wp-image-590\"\/><figcaption>screenshot of console connecting to ftp session with anonymous login<\/figcaption><\/figure><\/div>\n\n\n\n<p>Have a look around using standard FTP commands<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"415\" height=\"167\" src=\"http:\/\/vroamam.com\/wordpress\/wp-content\/uploads\/2020\/07\/image-51.png\" alt=\"\" class=\"wp-image-591\"\/><figcaption>screenshot of the output from the ftp commands pwd &amp; ls -al<\/figcaption><\/figure>\n\n\n\n<p>As can be seen from the screenshots, there wasn&#8217;t much available via FTP, we were in the root directory for FTP and there were no other hidden directories we can move to.<\/p>\n\n\n\n<p>Lets have a look at that FTP software version, is it exploitable? I used <em>Searchsploit<\/em><\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">searchsploit vsftpd<\/pre>\n\n\n\n<p>It looks as though it might be (excitement grew at this point)<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"810\" height=\"191\" src=\"http:\/\/vroamam.com\/wordpress\/wp-content\/uploads\/2020\/07\/image-54.png\" alt=\"\" class=\"wp-image-594\" srcset=\"https:\/\/vroamam.com\/wordpress\/wp-content\/uploads\/2020\/07\/image-54.png 810w, https:\/\/vroamam.com\/wordpress\/wp-content\/uploads\/2020\/07\/image-54-768x181.png 768w\" sizes=\"auto, (max-width: 810px) 100vw, 810px\" \/><figcaption>screenshot showing the output of searchsploit with vsftpd exploit highlighted<\/figcaption><\/figure>\n\n\n\n<p>Time to fire up <em>Metasploit <\/em>again<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">msfconsole<\/pre>\n\n\n\n<p>As I had checked using <em>Searchsploit<\/em> but I am still more comfortable using <em>Metasploit <\/em>I repeated the search in the <em>msfconsole<\/em>. <\/p>\n\n\n\n<p>Set the options and run the exploit<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">search vsftpd\nuse 0\nshow options\nset rhosts 10.10.10.3\nrun<\/pre>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"959\" height=\"620\" src=\"http:\/\/vroamam.com\/wordpress\/wp-content\/uploads\/2020\/07\/image-55.png\" alt=\"\" class=\"wp-image-595\" srcset=\"https:\/\/vroamam.com\/wordpress\/wp-content\/uploads\/2020\/07\/image-55.png 959w, https:\/\/vroamam.com\/wordpress\/wp-content\/uploads\/2020\/07\/image-55-768x497.png 768w\" sizes=\"auto, (max-width: 959px) 100vw, 959px\" \/><figcaption>Screenshot showing the msfconsole commands and output with listed commands highlighted<\/figcaption><\/figure>\n\n\n\n<p>It seems that FTP, whilst there is a vulnerability in that version, wasn&#8217;t the route to success on this occasion.<\/p>\n\n\n\n<p>back to the <em>Nmap<\/em> output, we have SSH and SMB. SMB is know to be vulnerable so I chose to have a look at that next. <\/p>\n\n\n\n<p>The OS is Linux, reported as Debian and SMB on Linux uses Samba. The <em>Nmap<\/em> scan reports the Samba version as 3.0.20 &#8211; let&#8217;s check.<\/p>\n\n\n\n<p>As mentioned, I am much more comfortable using <em>Metasploit<\/em> so I tried to search in the console<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">search samba 3.0.20<\/pre>\n\n\n\n<p>It brought back a lot of results and didn&#8217;t give any specific detail about versions <\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1118\" height=\"601\" src=\"http:\/\/vroamam.com\/wordpress\/wp-content\/uploads\/2020\/07\/image-58.png\" alt=\"\" class=\"wp-image-598\" srcset=\"https:\/\/vroamam.com\/wordpress\/wp-content\/uploads\/2020\/07\/image-58.png 1118w, https:\/\/vroamam.com\/wordpress\/wp-content\/uploads\/2020\/07\/image-58-1000x538.png 1000w, https:\/\/vroamam.com\/wordpress\/wp-content\/uploads\/2020\/07\/image-58-768x413.png 768w\" sizes=\"auto, (max-width: 1118px) 100vw, 1118px\" \/><figcaption>screenshot showing output of search in metasploit<\/figcaption><\/figure><\/div>\n\n\n\n<p>So I tried S<em>earcshploit <\/em>and it did come back with a specific exploit for this version of Samba, but I couldn&#8217;t match it against anything in <em>Metasploit<\/em>. Maybe there is a way, I just don&#8217;t now it at this point.<\/p>\n\n\n\n<p>So I turned to my old hacking friend Google. The first option led me to <a href=\"https:\/\/www.rapid7.com\/db\/modules\/exploit\/multi\/samba\/usermap_script\">this exploit<\/a> on the Rapid7 website, specifically listed for this version of Samba<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"901\" height=\"403\" src=\"http:\/\/vroamam.com\/wordpress\/wp-content\/uploads\/2020\/07\/image-60.png\" alt=\"\" class=\"wp-image-600\" srcset=\"https:\/\/vroamam.com\/wordpress\/wp-content\/uploads\/2020\/07\/image-60.png 901w, https:\/\/vroamam.com\/wordpress\/wp-content\/uploads\/2020\/07\/image-60-768x344.png 768w\" sizes=\"auto, (max-width: 901px) 100vw, 901px\" \/><\/figure>\n\n\n\n<p>I just copy and pasted the path and filename from the bottom of the web page into <em>Metasploit<\/em> and started the work as normal&#8230;<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">use \/exploit\/multi\/samba\/usermap_script\nshow options\nset rhost 10.10.10.3<\/pre>\n\n\n\n<p>That should be that&#8230; you should end up with a command shell in the root directory as root.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"901\" height=\"695\" src=\"http:\/\/vroamam.com\/wordpress\/wp-content\/uploads\/2020\/07\/image-59.png\" alt=\"\" class=\"wp-image-599\" srcset=\"https:\/\/vroamam.com\/wordpress\/wp-content\/uploads\/2020\/07\/image-59.png 901w, https:\/\/vroamam.com\/wordpress\/wp-content\/uploads\/2020\/07\/image-59-768x592.png 768w\" sizes=\"auto, (max-width: 901px) 100vw, 901px\" \/><figcaption>screenshot showing the metasploit console commands and the command shell after successful exploit<\/figcaption><\/figure>\n\n\n\n<p> It was along winded way round, but I got there in the end.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>The third in my series of write-ups from HTB and The Cyber Mentor&#8217;s mid course capstone from his Practical Ethical Hacking Course, this time we are doing Lame So as you should be aware by now we start with our normal reconnaissance using Nmap sudo nmap -A -T4 -p- 10.10.10.3 and as you would expect [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"ocean_post_layout":"","ocean_both_sidebars_style":"","ocean_both_sidebars_content_width":0,"ocean_both_sidebars_sidebars_width":0,"ocean_sidebar":"","ocean_second_sidebar":"","ocean_disable_margins":"enable","ocean_add_body_class":"","ocean_shortcode_before_top_bar":"","ocean_shortcode_after_top_bar":"","ocean_shortcode_before_header":"","ocean_shortcode_after_header":"","ocean_has_shortcode":"","ocean_shortcode_after_title":"","ocean_shortcode_before_footer_widgets":"","ocean_shortcode_after_footer_widgets":"","ocean_shortcode_before_footer_bottom":"","ocean_shortcode_after_footer_bottom":"","ocean_display_top_bar":"default","ocean_display_header":"default","ocean_header_style":"","ocean_center_header_left_menu":"","ocean_custom_header_template":"","ocean_custom_logo":0,"ocean_custom_retina_logo":0,"ocean_custom_logo_max_width":0,"ocean_custom_logo_tablet_max_width":0,"ocean_custom_logo_mobile_max_width":0,"ocean_custom_logo_max_height":0,"ocean_custom_logo_tablet_max_height":0,"ocean_custom_logo_mobile_max_height":0,"ocean_header_custom_menu":"","ocean_menu_typo_font_family":"","ocean_menu_typo_font_subset":"","ocean_menu_typo_font_size":0,"ocean_menu_typo_font_size_tablet":0,"ocean_menu_typo_font_size_mobile":0,"ocean_menu_typo_font_size_unit":"px","ocean_menu_typo_font_weight":"","ocean_menu_typo_font_weight_tablet":"","ocean_menu_typo_font_weight_mobile":"","ocean_menu_typo_transform":"","ocean_menu_typo_transform_tablet":"","ocean_menu_typo_transform_mobile":"","ocean_menu_typo_line_height":0,"ocean_menu_typo_line_height_tablet":0,"ocean_menu_typo_line_height_mobile":0,"ocean_menu_typo_line_height_unit":"","ocean_menu_typo_spacing":0,"ocean_menu_typo_spacing_tablet":0,"ocean_menu_typo_spacing_mobile":0,"ocean_menu_typo_spacing_unit":"","ocean_menu_link_color":"","ocean_menu_link_color_hover":"","ocean_menu_link_color_active":"","ocean_menu_link_background":"","ocean_menu_link_hover_background":"","ocean_menu_link_active_background":"","ocean_menu_social_links_bg":"","ocean_menu_social_hover_links_bg":"","ocean_menu_social_links_color":"","ocean_menu_social_hover_links_color":"","ocean_disable_title":"default","ocean_disable_heading":"default","ocean_post_title":"","ocean_post_subheading":"","ocean_post_title_style":"","ocean_post_title_background_color":"","ocean_post_title_background":0,"ocean_post_title_bg_image_position":"","ocean_post_title_bg_image_attachment":"","ocean_post_title_bg_image_repeat":"","ocean_post_title_bg_image_size":"","ocean_post_title_height":0,"ocean_post_title_bg_overlay":0.5,"ocean_post_title_bg_overlay_color":"","ocean_disable_breadcrumbs":"default","ocean_breadcrumbs_color":"","ocean_breadcrumbs_separator_color":"","ocean_breadcrumbs_links_color":"","ocean_breadcrumbs_links_hover_color":"","ocean_display_footer_widgets":"default","ocean_display_footer_bottom":"default","ocean_custom_footer_template":"","ocean_post_oembed":"","ocean_post_self_hosted_media":"","ocean_post_video_embed":"","ocean_link_format":"","ocean_link_format_target":"self","ocean_quote_format":"","ocean_quote_format_link":"post","ocean_gallery_link_images":"on","ocean_gallery_id":[],"footnotes":""},"categories":[87,2,86,3],"tags":[88,7,93,85,91,92,94,90],"class_list":["post-585","post","type-post","status-publish","format-standard","hentry","category-ctf","category-cybersec","category-hackthebox","category-training","tag-ctf","tag-cyber-security","tag-ftp","tag-hackthebox","tag-htb","tag-samba","tag-vstftpd","tag-walkthrough","entry"],"_links":{"self":[{"href":"https:\/\/vroamam.com\/wordpress\/wp-json\/wp\/v2\/posts\/585","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/vroamam.com\/wordpress\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/vroamam.com\/wordpress\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/vroamam.com\/wordpress\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/vroamam.com\/wordpress\/wp-json\/wp\/v2\/comments?post=585"}],"version-history":[{"count":2,"href":"https:\/\/vroamam.com\/wordpress\/wp-json\/wp\/v2\/posts\/585\/revisions"}],"predecessor-version":[{"id":602,"href":"https:\/\/vroamam.com\/wordpress\/wp-json\/wp\/v2\/posts\/585\/revisions\/602"}],"wp:attachment":[{"href":"https:\/\/vroamam.com\/wordpress\/wp-json\/wp\/v2\/media?parent=585"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/vroamam.com\/wordpress\/wp-json\/wp\/v2\/categories?post=585"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/vroamam.com\/wordpress\/wp-json\/wp\/v2\/tags?post=585"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}