search
Page cover

VulnNet: Internal (SMB, NFS, Redis, Port Forwarding)

First, we need to enumerate using nmap.

╭─hnl@hnl ~/Desktop/ctf/tryhackme/vulnnet-internal  
╰─➤  nmap -A 10.10.207.6 | tee nmap.log                                                                          130 ↵
Starting Nmap 7.80 ( https://nmap.org ) at 2022-04-24 20:57 +0630
Nmap scan report for 10.10.207.6
Host is up (0.24s latency).
Not shown: 993 closed ports
PORT     STATE    SERVICE     VERSION
22/tcp   open     ssh         OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 5e:27:8f:48:ae:2f:f8:89:bb:89:13:e3:9a:fd:63:40 (RSA)
|   256 f4:fe:0b:e2:5c:88:b5:63:13:85:50:dd:d5:86:ab:bd (ECDSA)
|_  256 82:ea:48:85:f0:2a:23:7e:0e:a9:d9:14:0a:60:2f:ad (ED25519)
111/tcp  open     rpcbind     2-4 (RPC #100000)
| rpcinfo: 
|   program version    port/proto  service
|   100000  2,3,4        111/tcp   rpcbind
|   100000  2,3,4        111/udp   rpcbind
|   100000  3,4          111/tcp6  rpcbind
|   100000  3,4          111/udp6  rpcbind
|   100003  3           2049/udp   nfs
|   100003  3           2049/udp6  nfs
|   100003  3,4         2049/tcp   nfs
|   100003  3,4         2049/tcp6  nfs
|   100005  1,2,3      35721/tcp6  mountd
|   100005  1,2,3      45401/tcp   mountd
|   100005  1,2,3      59949/udp6  mountd
|   100005  1,2,3      60579/udp   mountd
|   100021  1,3,4      34197/tcp   nlockmgr
|   100021  1,3,4      35019/tcp6  nlockmgr
|   100021  1,3,4      37326/udp   nlockmgr
|   100021  1,3,4      38819/udp6  nlockmgr
|   100227  3           2049/tcp   nfs_acl
|   100227  3           2049/tcp6  nfs_acl
|   100227  3           2049/udp   nfs_acl
|_  100227  3           2049/udp6  nfs_acl
139/tcp  open     netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
445/tcp  open     netbios-ssn Samba smbd 4.7.6-Ubuntu (workgroup: WORKGROUP)
873/tcp  open     rsync       (protocol version 31)
2049/tcp open     nfs_acl     3 (RPC #100227)
9090/tcp filtered zeus-admin
Service Info: Host: VULNNET-INTERNAL; OS: Linux; CPE: cpe:/o:linux:linux_kernel

Host script results:
|_clock-skew: mean: -41m02s, deviation: 1h09m16s, median: -1m03s
|_nbstat: NetBIOS name: VULNNET-INTERNA, NetBIOS user: <unknown>, NetBIOS MAC: <unknown> (unknown)
| smb-os-discovery: 
|   OS: Windows 6.1 (Samba 4.7.6-Ubuntu)
|   Computer name: vulnnet-internal
|   NetBIOS computer name: VULNNET-INTERNAL\x00
|   Domain name: \x00
|   FQDN: vulnnet-internal
|_  System time: 2022-04-24T16:27:04+02:00
| smb-security-mode: 
|   account_used: guest
|   authentication_level: user
|   challenge_response: supported
|_  message_signing: disabled (dangerous, but default)
| smb2-security-mode: 
|   2.02: 
|_    Message signing enabled but not required
| smb2-time: 
|   date: 2022-04-24T14:27:04
|_  start_date: N/A

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 75.78 seconds

Scan using rustscan.

hashtag
Port 139,445

You will find some interesing shares.

Connect to this shares and download all files.

You can find the very first flag at /temp/services.txt

The content of data.txt and business-req.txt in /data.

hashtag
Port 2049

You can see some interesting share in nfs.

Mount to local. Nothing interesting in this share.

You can find redis password in /redis/redis.conf

hashtag
Port 6379

Connect with redis-cli.

Here is a useful link for redis pentest https://book.hacktricks.xyz/pentesting/6379-pentesting-redis. Enumerate redis and read the flag.

Enumerate redis and read the key.

Decode the base64.

hashtag
Port 873

Here is a useful link of rsync pentest https://book.hacktricks.xyz/pentesting/873-pentesting-rsync.

List the share folder.

Download share folder into our local machine's folder.

Generate ssh key.

Upload it.

Finally, we can connect ssh with our own private key.

hashtag
User

You can read the user flag.

Download linpeas and enumerate the system. The system is vulnerable with pwnkit exploit. Here is Poc https://github.com/arthepsy/CVE-2021-4034

hashtag
Root

hashtag
The Truth (Root)

With ss command, you will see some opened TCP port.

Let's make local port forwarding.

When you broswe, http://127.0.0.1:8080, you will see teamcity page. We will need Authentication Token to login.

You will find Timecity directory on /.

Go to this directory and find token.

After login, you will see a dashboard.

At build step, run with python.

In netcat session, we got reverse shell.

PreviousGallery (SQLI, Backup, nano)NextDebug (PHP Deserialization, motd)

Last updated