# Antique

## Gaining Access

An Nmap scan reveals that there is only one port open:

<figure><img src="https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-71eba0abd59b5e5d0f8727e25aee4f45cc857506%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>

When trying to use this Telnet port, we needed some credentials.

<figure><img src="https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-392073a626e875b109b7ff517ac2229731abb4a6%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>

There's no way that we have to guess credentials, so I started scanning for UDP ports instead. What I found were some SNMP ports, presumably for the printer.

<figure><img src="https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-8a5ca843489a0fd923343549f1e0896163265024%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>

### SNMP Printer Exploit

When googling around for SNMP exploits related to this specific printer, I found one here.

{% embed url="<http://www.irongeek.com/i.php?page=security/networkprinterhacking>" %}

This page suggested that we can leak the password of a printer just by sending a request via SNMP. This basically dumped the password in a numerical form.

<figure><img src="https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-cb9723ad266d2c570df25c75d120d6d7805381ae%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>

However, some of these characters aren't readable via ASCII. This led me to believe they were in hex form, and converting it back to text revealed the password.

<figure><img src="https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-c502a9ced0d2fbff806d8bf35374459910a712d2%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>

The password is `P@ssw0rd@123!!123`. Now we can access the Telnet port.

### Authenticated Telnet

When accessing the telnet instance, we find out that we have the `exec` command to basically gain RCE over the machine.

<figure><img src="https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-c508fcfd1084f725e21c7366a933783b119c7a20%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>

With this, a simple reverse shell would do, and also allow us to become the **lp** user to capture the user flag.

<figure><img src="https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-df0e642b093e0a3fc8489ea1d9f4407e42d5b338%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>

## Root Flag

I ran linpeas to enumerate for me and found port 631 to be active, while remaining undetected from nmap.

<figure><img src="https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-c2d3dd5fcc4d24bcdcf2805e2908ceabc9ca2d0f%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>

Using chisel to port forward, we can easily gain access to this instance. We find that this is running CUPS v1.6.1.

<figure><img src="https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-73617d2b571273af88e9c086f5ecc0666207f0c7%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>

This version of CUPS was vulnerable to a root file read exploit. Since this was a port forwarding kind of scenario and I was a bit lazy, I took a loot at the Metasploit exploit code to see what was going on.

<figure><img src="https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-0b72d29a7146086a0c78295cac9908f1582cbdb6%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>

Simple enough, we can just read the root flag directly!

<figure><img src="https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-79251e804a0b56ae442ce70c8fc21568c230c51d%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>
