ClamAV

Gaining Access

Nmap scan:

$ nmap -p- --min-rate 4000 192.168.175.42
Starting Nmap 7.93 ( https://nmap.org ) at 2023-07-01 21:01 +08
Warning: 192.168.175.42 giving up on port because retransmission cap hit (10).
Nmap scan report for 192.168.175.42
Host is up (0.17s latency).
Not shown: 65448 closed tcp ports (conn-refused), 80 filtered tcp ports (no-response)
PORT      STATE SERVICE
22/tcp    open  ssh
25/tcp    open  smtp
80/tcp    open  http
139/tcp   open  netbios-ssn
199/tcp   open  smux
445/tcp   open  microsoft-ds
60000/tcp open  unknown

ClamAV Root

This machine was obviously hinting towards abusing ClamAV, the Antivirus. The SMTP port was open, and we can search for exploits using searchsploit:

The last exploit looked interesting because it had 'Sendmail' in it. We can try it out:

This exploit would spawn a root shell on port 31337 which we can connect to:

Rooted!

PreviousChattyNextCobweb