Kenobi
Scanning
sudo nmap -sS -A -T4 10.10.184.162 -oN initialscan.nmap
Starting Nmap 7.60 ( https://nmap.org ) at 2023-03-26 05:54 BST
Nmap scan report for ip-10-10-184-162.eu-west-1.compute.internal (10.10.184.162)
Host is up (0.00064s latency).
Not shown: 993 closed ports
PORT STATE SERVICE VERSION
21/tcp open ftp ProFTPD 1.3.5
22/tcp open ssh OpenSSH 7.2p2 Ubuntu 4ubuntu2.7 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 2048 b3:ad:83:41:49:e9:5d:16:8d:3b:0f:05:7b:e2:c0:ae (RSA)
| 256 f8:27:7d:64:29:97:e6:f8:65:54:65:22:f7:c8:1d:8a (ECDSA)
|_ 256 5a:06:ed:eb:b6:56:7e:4c:01:dd:ea:bc:ba:fa:33:79 (EdDSA)
80/tcp open http Apache httpd 2.4.18 ((Ubuntu))
| http-robots.txt: 1 disallowed entry
|_/admin.html
|_http-server-header: Apache/2.4.18 (Ubuntu)
|_http-title: Site doesn't have a title (text/html).
111/tcp open rpcbind 2-4 (RPC #100000)
| rpcinfo:
| program version port/proto service
| 100000 2,3,4 111/tcp rpcbind
| 100000 2,3,4 111/udp rpcbind
| 100003 2,3,4 2049/tcp nfs
| 100003 2,3,4 2049/udp nfs
| 100005 1,2,3 47705/tcp mountd
| 100005 1,2,3 48332/udp mountd
| 100021 1,3,4 39455/tcp nlockmgr
| 100021 1,3,4 54592/udp nlockmgr
| 100227 2,3 2049/tcp nfs_acl
|_ 100227 2,3 2049/udp nfs_acl
139/tcp open netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
445/tcp open netbios-ssn Samba smbd 4.3.11-Ubuntu (workgroup: WORKGROUP)
2049/tcp open nfs_acl 2-3 (RPC #100227)
MAC Address: 02:EE:F3:F5:03:59 (Unknown)
No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ).
TCP/IP fingerprint:
OS:SCAN(V=7.60%E=4%D=3/26%OT=21%CT=1%CU=33751%PV=Y%DS=1%DC=D%G=Y%M=02EEF3%T
OS:M=641FD021%P=x86_64-pc-linux-gnu)SEQ(SP=FB%GCD=1%ISR=FB%TI=Z%CI=I%TS=8)S
OS:EQ(SP=FB%GCD=1%ISR=FB%TI=Z%CI=I%II=I%TS=8)SEQ(SP=FB%GCD=1%ISR=FB%TI=Z%TS
OS:=8)OPS(O1=M2301ST11NW7%O2=M2301ST11NW7%O3=M2301NNT11NW7%O4=M2301ST11NW7%
OS:O5=M2301ST11NW7%O6=M2301ST11)WIN(W1=68DF%W2=68DF%W3=68DF%W4=68DF%W5=68DF
OS:%W6=68DF)ECN(R=Y%DF=Y%T=40%W=6903%O=M2301NNSNW7%CC=Y%Q=)T1(R=Y%DF=Y%T=40
OS:%S=O%A=S+%F=AS%RD=0%Q=)T2(R=N)T3(R=N)T4(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=
OS:%RD=0%Q=)T5(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%T=40%
OS:W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T7(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=
OS:)U1(R=Y%DF=N%T=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)IE(R=Y%
OS:DFI=N%T=40%CD=S)
Network Distance: 1 hop
Service Info: Host: KENOBI; OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel
Host script results:
|_nbstat: NetBIOS name: KENOBI, NetBIOS user: <unknown>, NetBIOS MAC: <unknown> (unknown)
| smb-os-discovery:
| OS: Windows 6.1 (Samba 4.3.11-Ubuntu)
| Computer name: kenobi
| NetBIOS computer name: KENOBI\x00
| Domain name: \x00
| FQDN: kenobi
|_ System time: 2023-03-25T23:54:52-05:00
| smb-security-mode:
| account_used: guest
| authentication_level: user
| challenge_response: supported
|_ message_signing: disabled (dangerous, but default)
| smb2-security-mode:
| 2.02:
|_ Message signing enabled but not required
| smb2-time:
| date: 2023-03-26 05:54:52
|_ start_date: 1600-12-31 23:58:45
TRACEROUTE
HOP RTT ADDRESS
1 0.64 ms ip-10-10-184-162.eu-west-1.compute.internal (10.10.184.162)
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 32.85 seconds
Enmerate SMB Shares
Nmap smb enumeration scripts
Connect with smbclient to the share
A file is present log.txt. Used the get command to download it.
log.txt contain important information about ftp and NFS
ssh key location
Anonymous ftp login allowed
Enumerate RPC Bind
We have /var directory as mount
Gain initial access with ProFtpd
search for exploits for proFtpd 1.3.5
The vulnerable Proftpd 1.3.5 version allows copying of files unauthenticated. copy the ssh key we found earlier to var folder.
The mod_copy module implements SITE CPFR and SITE CPTO commands, which can be used to copy files/directories from one place to another on the server. Any unauthenticated client can leverage these commands to copy files from any part of the filesystem to a chosen destination.
Now we can mount the /var folder on our machine and get the private key
copy the key to current folder and use that to access the machine
Priv Escalation
check for SUID binaries
we found a suspicious binary
checking the strings, we get to know that the binaries are being called without full path
copy the shell to the current directory and rename it to curl, add permissions to it and add it to PATH
Now run menu and select the option and we will get the root shell. using curl did not work for me
_______________________________________________________________________________________________________
Gaining direct shell
Last updated