✅Sunday (Easy)
Lesson Learn
Report-Penetration
Vulnerable Exploit: Username Enumerate and Allow BruteForce
System Vulnerable: 10.10.10.76
Vulnerability Explanation: The machine use Finger service which could allow us to enumerate username and not restrict logon attempt which could allow us to bruteforce. On the machine misconfigure file permission which allow user to read sensitive file and crack password of other user.
Privilege Escalation Vulnerability: Misconfigure of restricted permission
Vulnerability Fix: Should be disable service Finger and Use Strong password
Severity: High
Step to Compromise the Host:
Reconnaissance
Enumeration
Port 79 Finger
Finger displays information about users on a specified remote computer (typically a computer running UNIX) that is running the finger service or daemon. The remote computer specifies the format and output of the user information display.
Let check if there is any user logged on.
On finger service could allow us to enumerate user.
We can download the tool finger-enum from pentest monkey.
Exploitation
BruteForce
As we got 2 interesting username "sammy" and "sunny". Let start bruteforce the password
SSH
Let connect ssh to the machine with valid credential.
We need to add -oKexAlgorithms and specify key exchange.
Privilege Escalation
First thing first, I will sudo -l which we can run /root/troll as root without password and it just display the id as root.
On the machine, we see folder /backup and there is hash of user sammy.
Let just save the hash and try to crack it if it's a weak password. Checking the hash type of hashcat seem like it's sha256crypt $5$,
We now can ssh to user sammy on other session.
Once I run sudo -l which we can run wget as root permission.
#1 Wget -i
#2 Wget POST
#3 OverWrite Wget
We can write a script and same the name as troll.
Let start HTTP Server and let our victim machine grab that file and replace with existing.
So, we have to login 2 sessions. Session 1 on user sammy which has permission to run wget. Once we download the file and replace with the existing one, we go to session 2 on user sunny to execute /root/troll.
Last updated