🏠 Home BlogGitHub📚 Buy Me a Book
Edit

🔬Linux Black Box Pentest

🔬 INE LAB - Metasploitable2

  • Target IP: 10.2.20.205

  • Metasploit Framework is permitted

Port Scanning & Enumeration

  • Obtain the target IP address from the /etc/hosts file

cat /etc/hosts
	10.2.20.205 demo.ine.local
ping 10.2.20.205
ping demo.ine.local
mkdir Desktop/Linux
cd Desktop/Linux/ # To store all the notes and files about the target

  • Port scanning with nmap

nmap -sV -p 1-10000 10.2.20.205 -oX nmap_10k
# Scans first 10000 ports
21/tcp   open  ftp         vsftpd 2.3.4
22/tcp   open  ssh         OpenSSH 8.2p1 Ubuntu 4ubuntu0.2 (Ubuntu Linux; protocol 2.0)
23/tcp   open  telnet      Linux telnetd
25/tcp   open  smtp        Postfix smtpd
51/tcp   open  ssh         OpenSSH 4.7p1 Debian 8ubuntu1 (protocol 2.0)
80/tcp   open  http        Apache httpd 2.2.8 ((Ubuntu) DAV/2)
111/tcp  open  rpcbind     2 (RPC #100000)
139/tcp  open  netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
445/tcp  open  netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
512/tcp  open  exec?
513/tcp  open  login?
514/tcp  open  tcpwrapped
1099/tcp open  java-rmi    GNU Classpath grmiregistry
1524/tcp open  ingreslock?
3306/tcp open  mysql       MySQL 5.0.51a-3ubuntu5
3632/tcp open  distccd     distccd v1 ((GNU) 4.2.4 (Ubuntu 4.2.4-1ubuntu4))
5432/tcp open  postgresql  PostgreSQL DB 8.3.0 - 8.3.7
6667/tcp open  irc         UnrealIRCd
6697/tcp open  irc         UnrealIRCd
8009/tcp open  ajp13       Apache Jserv (Protocol v1.3)
8180/tcp open  http        Apache Tomcat/Coyote JSP engine 1.1
8787/tcp open  drb         Ruby DRb RMI (Ruby 1.8; path /usr/lib/ruby/1.8/drb)

Service Info: Hosts:  metasploitable.localdomain, irc.Metasploitable.LAN; OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel

  • Check the ports without service banner

📌 There is a BIND SHELL Listener on the port 1524

nc -nc 10.2.20.205 1524

  • Access the web server with a browser

    • http://10.2.20.205/

    • There are intentional vulnerable applications present

Targeting

vsFTPd

  • Try anonymous:anonymous with FTP

  • Exploit vsFTPd

  • 📌 Exploits might not work because the vulnerability may have been patched!

  • Enumerate user accounts via SMTP brute-force

📌 FTP credentials found:

  • service:service

  • Upload a PHP reverse shell via FTP to the /dav directory and launch it with the browser

  • Open the browser and run the shell.php file

    • http://10.2.20.205/dav/

Reverse shell received

PHP

  • Try to browse

    • http://10.2.20.205/phpinfo.php

Manual/Script Exploitation

  • Find an exploit

python2 18836.py 10.2.20.205 80

  • Modify pwn_code variable and insert PHP reverse shell code

Unprivileged access with "www-data" user

  • Automatic MSF exploit/multi/http/php_cgi_arg_injection module can be used too.

exploit/multi/http/php_cgi_arg_injection

SAMBA

  • Banner grabbing

  • Enumerate the exact version of Samba

Privileged "root" session

  • 📌 This exploit gives back direct root access.

Previous🔬Win Black Box PentestNextPost-Exploitation

Last updated

Was this helpful?