search

Servmon

hashtag
Gaining Access

Nmap scan:

$ nmap -p- --min-rate 5000 10.129.227.77
Starting Nmap 7.93 ( https://nmap.org ) at 2023-04-30 01:44 EDT
Nmap scan report for 10.129.227.77
Host is up (0.0077s latency).
Not shown: 65518 closed tcp ports (conn-refused)
PORT      STATE SERVICE
21/tcp    open  ftp
22/tcp    open  ssh
80/tcp    open  http
135/tcp   open  msrpc
139/tcp   open  netbios-ssn
445/tcp   open  microsoft-ds
5666/tcp  open  nrpe
6063/tcp  open  x11
6699/tcp  open  napster
8443/tcp  open  https-alt
49664/tcp open  unknown
49665/tcp open  unknown
49666/tcp open  unknown
49667/tcp open  unknown
49668/tcp open  unknown
49669/tcp open  unknown
49670/tcp open  unknown

Loads of ports. This is an easy and old machine, so it shouldn't be too complex.

hashtag
Anonymous FTP

When I see FTP, the first thing I check for is anomymous logins. This works for this machine

We can find 2 files, one Confidential.txt and a Notes to do.txt. Reading the confidential one highlights that there is a password file somewhere:

Great!

hashtag
LFI

On port 80 and port 8443, there are HTTP and HTTPS sites presents respectively. Looking at port 80, we see this is running NVMS-1000:

There are public exploits for these:

Following the PoC, we can see it works:

Great! Now, we can read the password.txt file that we found hints of earlier. Here are the passwords retrieved:

With this, we can run a crackmapexec to brute force the possible passwords.

This would find that the credentials of nadine:L1k3B1gBut7s@W0rk is the right one. With these credentials, we can SSH into the machine as the nmap scan found earlier showed port 22 was open.

Then grab the user flag.

hashtag
Privilege Escalation

hashtag
NSClient++ Privilege Escalation

Earlier, I mentioned that port 8443 was running a HTTPS site and we have not enumerated it yet. This port had NSClient++ running on it:

None of the functions work. Searching for public exploits works however:

The Privilege Escalation is the one I need now. Following the PoC, we first need to grab the administrator password:

Then we need to download nc.exe to the machine and a .bat file that executes a reverse shell

Then we need to login, but for some reason the application is blocking me. When we check the nsclient.ini configuration file, we see that it only allows localhost to access the services:

So we need to do some port forwarding using ssh.

Then we can access the site and continue.

Login using the administrator password we found earlier. There are automated PoCs for this:

LogoTriggered!*(#*!(#*!packetstormsecurity.comchevron-right

We can run it like so after downloading the relevant files onto the machine:

Rooted!

PreviousSenseNextShoppy