-sS use the TCP SYN scan option. This scan option is relatively unobtrusive and stealthy, since it never completes TCP connections.
--min-rate 5000 nmap will try to keep the sending rate at or above 5000 packets per second.
-p- scanning the entire port range, from 1 to 65535.
-T5insane mode, it is the fastest mode of the nmap time template.
-Pn assume the host is online.
-n scan without reverse DNS resolution.
-oNsave the scan result into a file, in this case the allports file.
# Nmap 7.92 scan initiated Tue Mar 22 20:00:10 2022 as: nmap -sS -p- -T5 --min-rate 5000 -n -Pn -oN allPorts 10.10.10.84
Warning: 10.10.10.84 giving up on port because retransmission cap hit (2).
Nmap scan report for 10.10.10.84
Host is up (0.060s latency).
Not shown: 58441 filtered tcp ports (no-response), 7092 closed tcp ports (reset)
PORT STATE SERVICE
22/tcp open ssh
80/tcp open http
# Nmap done at Tue Mar 22 20:00:49 2022 -- 1 IP address (1 host up) scanned in 38.45 seconds
As we see, there are a few ports open.
Let's try to obtain the services and versions of these ports. The following command will scan these ports more in depth and save the result into a file:
nmap -sC -sV -p22,80 10.10.10.84 -oN targeted
-sC performs the scan using the default set of scripts.
-sV enables version detection.
-oNsave the scan result into file, in this case the targeted file.
# Nmap 7.92 scan initiated Tue Mar 22 20:01:39 2022 as: nmap -sCV -p22,80 -oN targeted 10.10.10.84
Nmap scan report for 10.10.10.84
Host is up (0.044s latency).
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 7.2 (FreeBSD 20161230; protocol 2.0)
| ssh-hostkey:
| 2048 e3:3b:7d:3c:8f:4b:8c:f9:cd:7f:d2:3a:ce:2d:ff:bb (RSA)
| 256 4c:e8:c6:02:bd:fc:83:ff:c9:80:01:54:7d:22:81:72 (ECDSA)
|_ 256 0b:8f:d5:71:85:90:13:85:61:8b:eb:34:13:5f:94:3b (ED25519)
80/tcp open http Apache httpd 2.4.29 ((FreeBSD) PHP/5.6.32)
|_http-title: Site doesn't have a title (text/html; charset=UTF-8).
|_http-server-header: Apache/2.4.29 (FreeBSD) PHP/5.6.32
Service Info: OS: FreeBSD; CPE: cpe:/o:freebsd:freebsd
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Tue Mar 22 20:01:48 2022 -- 1 IP address (1 host up) scanned in 9.31 seconds
Let's take a look at the website.
If we put some of the .php files listed into the scriptname text field, and hit the Submit button, it will look like it is showing us the file.
Exploitation
We could try to do a Local File Inclusion (LFI) attack. If we put the /etc/passwd file, and hit Submit, we'll see that we can see the /etc/passwd file of the Poison machine, and we could also see that there are two users, the root user and the charix user.
The httpd-access.log file stores every request the server gets with information such us the IP address, the directory, the status code, the user agent, etc...
We could try to make a request to the HTTP server with a User-Agent header, which can contain PHP code that sends us back a reverse shell, so when we access the httpd-access.log file, the PHP code will be interpreted, and we'll get a reverse shell.
FreeBSD 11.1-RELEASE (GENERIC) #0 r321309: Fri Jul 21 02:08:28 UTC 2017
Welcome to FreeBSD!
Release Notes, Errata: https://www.FreeBSD.org/releases/
Security Advisories: https://www.FreeBSD.org/security/
FreeBSD Handbook: https://www.FreeBSD.org/handbook/
FreeBSD FAQ: https://www.FreeBSD.org/faq/
Questions List: https://lists.FreeBSD.org/mailman/listinfo/freebsd-questions/
FreeBSD Forums: https://forums.FreeBSD.org/
Documents installed with the system are in the /usr/local/share/doc/freebsd/
directory, or can be installed later with: pkg install en-freebsd-doc
For other languages, replace "en" with a language code like de or fr.
Show the version of FreeBSD installed: freebsd-version ; uname -a
Please include that output and any error messages when posting questions.
Introduction to manual pages: man man
FreeBSD directory layout: man hier
Edit /etc/motd to change this login announcement.
The default editor in FreeBSD is vi, which is efficient to use when you have
learned it, but somewhat user-unfriendly. To use ee (an easier but less
powerful editor) instead, set the environment variable EDITOR to /usr/bin/ee
charix@Poison:~ % whoami
charix
charix@Poison:~ % cat user.txt
eaacdfb2d141b72a589233063604209c
If we list the current directory, we'll see the secret.zip file.
ls -l
total 8
-rw-r----- 1 root charix 166 Mar 19 2018 secret.zip
-rw-r----- 1 root charix 33 Mar 19 2018 user.txt
Let's transfer it to our local machine.
python -m SimpleHTTPServer
On our local machine.
wget http://10.10.10.84:8000/secret.zip
--2022-03-23 20:26:50-- http://10.10.10.84:8000/secret.zip
Connecting to 10.10.10.84:8000... connected.
HTTP request sent, awaiting response... 200 OK
Length: 166 [application/zip]
Saving to: âsecret.zipâ
secret.zip 100%[===================================================================>] 166 --.-KB/s in 0s
2022-03-23 20:26:50 (23.3 MB/s) - âsecret.zipâ saved [166/166]
If we try to unzip it, it will ask for a password. Let's try the one we found earlier.
We see the ports 5801 and 5901, which belong to VNC.
Virtual Network Computing (VNC) is a program based on a client-server structure that allows you to observe the actions of the server computer remotely through a client computer.
We can enumerate the VNC service with the vncviewer tool on our local machine. So let's tunnel that port to our local machine with SSH.
Now we can enumerate the VNC service of the victim, through our 5901 port. The vncviewer tool has an option which allow us to authenticate with a password file. If we use the secret file that we have, we'll get a shell as the root user, and all we had to do is reap the harvest and take the root flag.
