Servmon
Gaining Access
Nmap scan:
$ nmap -p- --min-rate 5000 10.129.227.77
Starting Nmap 7.93 ( https://nmap.org ) at 2023-04-30 01:44 EDT
Nmap scan report for 10.129.227.77
Host is up (0.0077s latency).
Not shown: 65518 closed tcp ports (conn-refused)
PORT STATE SERVICE
21/tcp open ftp
22/tcp open ssh
80/tcp open http
135/tcp open msrpc
139/tcp open netbios-ssn
445/tcp open microsoft-ds
5666/tcp open nrpe
6063/tcp open x11
6699/tcp open napster
8443/tcp open https-alt
49664/tcp open unknown
49665/tcp open unknown
49666/tcp open unknown
49667/tcp open unknown
49668/tcp open unknown
49669/tcp open unknown
49670/tcp open unknownLoads of ports. This is an easy and old machine, so it shouldn't be too complex.
Anonymous FTP
When I see FTP, the first thing I check for is anomymous logins. This works for this machine
We can find 2 files, one Confidential.txt and a Notes to do.txt. Reading the confidential one highlights that there is a password file somewhere:
Great!
LFI
On port 80 and port 8443, there are HTTP and HTTPS sites presents respectively. Looking at port 80, we see this is running NVMS-1000:
There are public exploits for these:
Following the PoC, we can see it works:
Great! Now, we can read the password.txt file that we found hints of earlier. Here are the passwords retrieved:
With this, we can run a crackmapexec to brute force the possible passwords.
This would find that the credentials of nadine:L1k3B1gBut7s@W0rk is the right one. With these credentials, we can SSH into the machine as the nmap scan found earlier showed port 22 was open.
Then grab the user flag.
Privilege Escalation
NSClient++ Privilege Escalation
Earlier, I mentioned that port 8443 was running a HTTPS site and we have not enumerated it yet. This port had NSClient++ running on it:
None of the functions work. Searching for public exploits works however:
The Privilege Escalation is the one I need now. Following the PoC, we first need to grab the administrator password:
Then we need to download nc.exe to the machine and a .bat file that executes a reverse shell
Then we need to login, but for some reason the application is blocking me. When we check the nsclient.ini configuration file, we see that it only allows localhost to access the services:
So we need to do some port forwarding using ssh.
Then we can access the site and continue.
Login using the administrator password we found earlier. There are automated PoCs for this:
We can run it like so after downloading the relevant files onto the machine:
Rooted!