✅FriendZone (Easy)
Lesson Learn
Report-Penetration
Vulnerable Exploit: Misconfigure on Share and LFI
System Vulnerable: 10.10.10.123
Vulnerability Explanation: The machine is misconfigured on Share which could allow us connect without password and write permission allow us to upload reverse shell. The application is vulnerable to LFI which could allow us to execute our payload and gain access on machine.
Privilege Escalation Vulnerability: Misconfigure of Privilege user
Vulnerability Fix: Restrict guess user and allow only authorizer user to access and Least Privilege
Severity: High
Step to Compromise the Host:
Reconnaissance
└─$ nmap -p- -sC -sV -T4 10.10.10.123 -Pn
Host discovery disabled (-Pn). All addresses will be marked 'up' and scan times will be slower.
Starting Nmap 7.91 ( https://nmap.org ) at 2021-11-15 11:00 EST
Nmap scan report for 10.10.10.123
Host is up (0.046s latency).
Not shown: 65528 closed ports
PORT STATE SERVICE VERSION
21/tcp open ftp vsftpd 3.0.3
22/tcp open ssh OpenSSH 7.6p1 Ubuntu 4 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 2048 a9:68:24:bc:97:1f:1e:54:a5:80:45:e7:4c:d9:aa:a0 (RSA)
| 256 e5:44:01:46:ee:7a:bb:7c:e9:1a:cb:14:99:9e:2b:8e (ECDSA)
|_ 256 00:4e:1a:4f:33:e8:a0:de:86:a6:e4:2a:5f:84:61:2b (ED25519)
53/tcp open domain ISC BIND 9.11.3-1ubuntu1.2 (Ubuntu Linux)
| dns-nsid:
|_ bind.version: 9.11.3-1ubuntu1.2-Ubuntu
80/tcp open http Apache httpd 2.4.29 ((Ubuntu))
|_http-server-header: Apache/2.4.29 (Ubuntu)
|_http-title: Friend Zone Escape software
139/tcp open netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
443/tcp open ssl/http Apache httpd 2.4.29
|_http-server-header: Apache/2.4.29 (Ubuntu)
|_http-title: 404 Not Found
| ssl-cert: Subject: commonName=friendzone.red/organizationName=CODERED/stateOrProvinceName=CODERED/countryName=JO
| Not valid before: 2018-10-05T21:02:30
|_Not valid after: 2018-11-04T21:02:30
|_ssl-date: TLS randomness does not represent time
| tls-alpn:
|_ http/1.1
445/tcp open netbios-ssn Samba smbd 4.7.6-Ubuntu (workgroup: WORKGROUP)
Service Info: Hosts: FRIENDZONE, 127.0.1.1; OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel
Host script results:
|_clock-skew: mean: -39m59s, deviation: 1h09m16s, median: 0s
|_nbstat: NetBIOS name: FRIENDZONE, NetBIOS user: <unknown>, NetBIOS MAC: <unknown> (unknown)
| smb-os-discovery:
| OS: Windows 6.1 (Samba 4.7.6-Ubuntu)
| Computer name: friendzone
| NetBIOS computer name: FRIENDZONE\x00
| Domain name: \x00
| FQDN: friendzone
|_ System time: 2021-11-15T18:01:33+02:00
| smb-security-mode:
| account_used: guest
| authentication_level: user
| challenge_response: supported
|_ message_signing: disabled (dangerous, but default)
| smb2-security-mode:
| 2.02:
|_ Message signing enabled but not required
| smb2-time:
| date: 2021-11-15T16:01:33
|_ start_date: N/AEnumeration
Port 80 Apache/2.4.29
First thing first, I will go through webpage first. It just displays a webpage and view the source code we found email with the domain name friendzoneportal.red.
Let use gobuster to find hidden directory. We didn't see any interesting there.
Port 443 Apache/2.4.29
Nothing is there. It just displays a web page show Not Found.
Port 53 domain
As we found there domain name friendzoneportal.red on the webpage and friendzone.red on nmap scan, let enumerate the DNS with zone transfer whether we can find more sub domain.
We can enumerate the zone transfer with host and dig command.
To view easily, let summary all the subdomain that we have found and add all of them in our hosts.
We need to get back to access all of those subdomains via webpage. We can check on HTTPS because on HTTP, it will return the same web page.
Let just briefly what we found below,
1/ admin.friendzoneportal.red and administrator1.friendzone.red are login page.
2/ uploads.friendzone.red file upload.
3/ friendzone.red/js/js interesting to check out.
Port 139, 445 Samba
Let check the permission on the shares drive, as it allows guess login and have Read, Write permission on Development folder.
As we can see, there is a creds.txt file stored under /general folder.
Let connect and download the creds.txt file from /general folder.
Let login with the credential we found. It's working on administrator1.friendzone.red.
Exploitation
LFI
Let upload a simple php file for testing if it works.
If we mention test.php, it doesn't display the text. If we mention only test, it will work.
Let upload php command execution.
Let start our netcat listener on port 5555 and execute reverse shell to our machine.
Privilege Escalation
Priv-Esc to Friend
on the machine, we found mysql_data.conf stored credentials.
Priv-Esc to root
Auto script python
let start our HTTP server to share file pspy for process enumerate.
After waiting for sometimes, we found that file reporter.py running as schedule.
As the python script will import os module, there is misconfigure of privilege user on os.py.
We can download script os.py from our victim machine and inject python reverse shell at the end of the script, then paste it back to our victim to replace the existing file.
Last updated