SolidState

Enumeration

As always, we start with the enumeration phase, in which we try to scan the machine looking for open ports and finding out services and versions of those opened ports.

The following nmap command will scan the target machine looking for open ports in a fast way and saving the output into a file:

nmap -sS --min-rate 5000 -p- -T5 -Pn -n 10.10.10.51 -oN allPorts

  • -sS use the TCP SYN scan option. This scan option is relatively unobtrusive and stealthy, since it never completes TCP connections.

  • --min-rate 5000 nmap will try to keep the sending rate at or above 5000 packets per second.

  • -p- scanning the entire port range, from 1 to 65535.

  • -T5 insane mode, it is the fastest mode of the nmap time template.

  • -Pn assume the host is online.

  • -n scan without reverse DNS resolution.

  • -oN save the scan result into a file, in this case the allports file.

As we see, only ports 22, 25, 80, 110, 119 and 4555 are open.

Now that we know which ports are open, let's try to obtain the services and versions running on these ports. The following command will scan these ports more in depth and save the result into a file:

nmap -sC -sV -p22,25,80,110,119,4555 10.10.10.51 -oN targeted

  • -sC performs the scan using the default set of scripts.

  • -sV enables version detection.

  • -oN save the scan result into file, in this case the targeted file.

Exploitation

As we see, nmap reported that port 4555 is open, which host the JAMES Remote Administration Tool 2.3.2. If you do your own research, you'll find that the default credentials for the administration tool are the user root, and the password root. Let's try to connect to that server with these credentials.

nc 10.10.10.51 4555

Let's see which commands we can execute.

help

With the listusers command, we can see a list of users.

listusers

We can also change the password of any user. The idea here is to change the password of every user and check their email inbox looking for any emails. We can change the passwords with the setpassword command.

Now let's log in with each user on port 110, which contains the pop3 server.

telnet 10.10.10.51 110

If we log in with the user james, we'll see that there is are no emails. We can list the emails with the list command.

If we log in with the user thomas, we won't see any emails either.

telnet 10.10.10.51 110

If we log in with the user john, we'll see there is one email. We can see that email with the RETR command.

telnet 10.10.10.51 110

The email says that the john user has to send the mindy user a temporary SSH password. Let's look at the inbox of the mindy user.

telnet 10.10.10.51 110

And there are two emails. The first one is informative, but the second one has some valid SSH credentials, mindy/P@55W0rd1!2@. Let's use those to log in to the SSH server. Then we could grab the user flag.

sshpass -p 'P@55W0rd1!2@' ssh mindy@10.10.10.51

The problem is that, if we see the PATH variable, we'll see that we can only execute binaries under the /home/mindy/bin directory, which are the cat, env, and ls binaries.

echo $PATH

ls -l $PATH

We can get a normal bash shell by adding the command we want to execute at the end of the SSH login command. If we add bash, we'll get a normal bash shell.

ssh mindy@10.10.10.51 bash

Privilege Escalation

First of all, let's set an interactive TTY shell.

script /dev/null -c /bin/bash

Then I press Ctrl+Z and execute the following command on my local machine:

stty raw -echo; fg

reset

Terminal type? xterm

Next, I export a few variables:

export TERM=xterm

export SHELL=bash

Finally, I run the following command in our local machine:

stty size

And set the proper dimensions in the victim machine:

stty rows 51 columns 236

Let's go to the /dev/shm directory. I made the following bash script, which basically show what commands are being executed on the system in a short period of time.

nano procmon.sh && chmod +x procmon.sh

If we executed and wait for a bit, we'll see that the /opt/tmp.py script is being executed.

./procmon.sh

Let's take a look at it.

ls -l /opt/tmp.py

As the script is owned by root, and we can modify it, we could change the script so when it is executed by root, the SUID permission will be assigned to the bash binary.

nano /opt/tmp-py

If we wait, we'll see that the /bin/bash permissions will change.

watch -n 1 ls -l /bin/bash

Finally, if we execute bash with the owner permissions, all we have to do is reap the harvest and take the root flag.

bash -p

Last updated

Was this helpful?