search
Page cover

Aratus (SSH, Process, Ansible)

First, we need to enumerate using nmap.

$ nmap -A -p21,22,80,139,443 10.10.184.32

Starting Nmap 7.80 ( https://nmap.org ) at 2022-03-30 13:13 +0630
Nmap scan report for 10.10.184.32
Host is up (0.28s latency).

PORT    STATE SERVICE     VERSION
21/tcp  open  ftp         vsftpd 3.0.2
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
|_drwxr-xr-x    2 0        0               6 Jun 09  2021 pub
| ftp-syst: 
|   STAT: 
| FTP server status:
|      Connected to ::ffff:10.9.0.140
|      Logged in as ftp
|      TYPE: ASCII
|      No session bandwidth limit
|      Session timeout in seconds is 300
|      Control connection is plain text
|      Data connections will be plain text
|      At session startup, client count was 1
|      vsFTPd 3.0.2 - secure, fast, stable
|_End of status
22/tcp  open  ssh         OpenSSH 7.4 (protocol 2.0)
| ssh-hostkey: 
|   2048 09:23:62:a2:18:62:83:69:04:40:62:32:97:ff:3c:cd (RSA)
|   256 33:66:35:36:b0:68:06:32:c1:8a:f6:01:bc:43:38:ce (ECDSA)
|_  256 14:98:e3:84:70:55:e6:60:0c:c2:09:77:f8:b7:a6:1c (ED25519)
80/tcp  open  http        Apache httpd 2.4.6 ((CentOS) OpenSSL/1.0.2k-fips)
| http-methods: 
|_  Potentially risky methods: TRACE
|_http-server-header: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips
|_http-title: Apache HTTP Server Test Page powered by CentOS
139/tcp open  netbios-ssn Samba smbd 4.10.16 (workgroup: WORKGROUP)
Service Info: Host: ARATUS; OS: Unix

Host script results:
|_clock-skew: mean: -40m50s, deviation: 1h09m13s, median: -53s
| smb-os-discovery: 
|   OS: Windows 6.1 (Samba 4.10.16)
|   Computer name: aratus
|   NetBIOS computer name: ARATUS\x00
|   Domain name: \x00
|   FQDN: aratus
|_  System time: 2022-03-30T08:43:22+02:00
| smb-security-mode: 
|   account_used: guest
|   authentication_level: user
|   challenge_response: supported
|_  message_signing: disabled (dangerous, but default)
| smb2-security-mode: 
|   2.02: 
|_    Message signing enabled but not required
| smb2-time: 
|   date: 2022-03-30T06:43:21
|_  start_date: N/A

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 38.70 seconds

Let's connect ftp and see what files are sharing. We found only pub diretory in this ftp. But no files are inside this directory.

Enumerate smb share and we found interesting share name temporary share

Connect it and see what files store in this share. And download message-to-simeon.txt. When I download .bash_history or something, I got access denied error.

Read this interesting files. By reviewing message, he/she place the web directory on /home directory.

Let's enumerate to http service. We found only default httpd website which is hosted on centos or redhat.

http://10.10.184.32/simeon/ point to you some interesting page. There are too many words in this page and subpage.

So, we will change those words into wordlist.

And then, we will bruteforce ssh using this wordlists.

After bruteforcing it, you will found a vaild username and password. Let's login to ssh using this creds.

After checking some process, we found some interesting which is running ping command using root privileges.

Check again using pspy64, we found another interesting process which is run /home/theodore/scripts/test-www-auth.py

You already seen ping command is running with root privileges. Let's listen with tcpdump in loopback interface.

Decode from base64. You will found theodore password.

Let's login ssh using theodore credentials.

With sudo -l command something is running with automation user privileges.

Ansible is running on this host. You can read what is ansible on google. It run all playbooks from this directory /opt/ansible/playbooks/.

We will create reverse shell file on /tmp directory.

At the end of the file, we will insert this malicious definations.

Run this playbooks.

In netcat session, we got reverse shell.

PreviousCorpNextFlatline (FreeSwitch, OpenClinic)

Last updated