🔓Solid State

It was originally created for HackTheBox

1. Reconnaissance

Scanning the network to find vulnerable machine's IP

arp-scan -l                                                                                    root@j0zack
Interface: enp0s3, type: EN10MB, MAC: 08:00:27:9c:9d:c8, IPv4: 192.168.10.25
Starting arp-scan 1.9.7 with 256 hosts (https://github.com/royhills/arp-scan)
192.168.10.1	52:54:00:12:35:00	QEMU
192.168.10.2	52:54:00:12:35:00	QEMU
192.168.10.3	08:00:27:46:7f:87	PCS Systemtechnik GmbH
192.168.10.28	08:00:27:d4:af:6c	PCS Systemtechnik GmbH

4 packets received by filter, 0 packets dropped by kernel
Ending arp-scan 1.9.7: 256 hosts scanned in 2.276 seconds (112.48 hosts/sec). 4 responded

  • We find the IP of the vulnerable machine to be 192.168.10.28

2. Scanning

2.1 Nmap

  • Using nmap to find the open ports and their services

  • We find open ports 22, 25, 80, 110, 119, 4555 with services ssh, smtp, http, pop3 , nntp and a Apache James running respectively.

  • We do not find anything interesting in the webpage

2.2 James Remote Admin

  • Default credentials of James Remote Administration toll is root : root

  • Logging in to the server via nc and using the default credentials.

  • We find 5 users

  • We can use the setpassword command to reset all users passwords to 123456

2.3 POP3

  • We can use telnet to log in to the pop3 servers to retrieve any useful information from the mails. (user mindy got some juicy info.)

  • We can log in as mindy with the password 123456 and retrieve their mail.

  • We find 2 mails for mindy

  • Getting 1st mail

  • We find out that mindy recently joined the team and this is her welcome address mail.

  • Getting 2nd mail

  • Here we get the ssh access credentials for mindy

mindy : P@55W0rd1!2@

3. Initial Foothold

3.1 SSH

  • Using ssh to remotely log in as mindy

  • Here we find the user.txt and also notice that we are using a restricted bash (rbash) with limited commands

  • In order to spawn a regular bash shell to get its full functionality, we simply use ssh again to login as mindy as well as specify bash at the end of the command.

  • Stabilizing the shell; We find 2 users james and mindy

4. Privilege Escalation

4.1LinPeas

  • We can use the script LinPeas to find any vulnerabilities or potential privilege escalation vectors.

  • Downloading the script from its GitHub repository to /tmp directory, making it executable and running it.

  • The script shows an interesting file /opt/tmp.py which is writable

  • Viewing the file, we see that it is a script which is run by root to execute a command that removes every file and folders from the /tmp directory at regular intervals.

  • Since the file is writable, we can modify it to include a nc reverse shell ( make sure to change the IP)

  • We can open up a netcat listener and after a few moments, we get a shell as root.

  • We can stabilize the shell and get the root.txt file

PreviousPWNLABNextStapler

Last updated