search

Forward

hashtag
Gaining Access

Nmap scan:

$ nmap -p- --min-rate 3000 -Pn 192.168.157.157
Starting Nmap 7.93 ( https://nmap.org ) at 2023-07-14 13:51 +08
Nmap scan report for 192.168.157.157
Host is up (0.17s latency).
Not shown: 65530 closed tcp ports (conn-refused)
PORT      STATE    SERVICE
22/tcp    open     ssh
25/tcp    open     smtp
139/tcp   open     netbios-ssn
445/tcp   open     microsoft-d

We might need to exploit SMTP to 'forward' messages.

hashtag
SMB Shares -> Teamviewer Creds

There's one share readable with NULL credentials.

$ smbmap -H 192.168.157.157                             
[+] IP: 192.168.157.157:445     Name: 192.168.157.157                                   
        Disk                                                    Permissions     Comment
        ----                                                    -----------     -------
        utils                                                   READ ONLY       Utilities
        print$                                                  NO ACCESS       Printer Drivers
        IPC$                                                    NO ACCESS       IPC Service (Samba 4.9.5-Debian)

Within it, there were some files present:

We can download all of these files to our machine.

We can first view the README.all:

TeamViewer credentials can actually be decrypted.

TeamViewerWhyNotSecuritychevron-right

We can use parts of the script above to decrypt our files:

Each of the .reg files have this hex string within it:

We can decrypt each password and test it with both ssh and SMB. I extracted each of the passowrds like this:

Then, decrypted them using the script:

The password above is for the user fox, and using those credentials grants us access to another SMB Share.

hashtag
New Shares -> Forward Shell

This print$ share has some interesting stuff:

But I couldn't make sense of any of those. Let's check the fox share next:

There's an interesting folder called .forward present.

I read more about this file here:

LogoProcess your email with procmail - Linux.comLinux.comchevron-right

Whenever the user receives mail, this output of the mail is piped to this binary. Since we have write access over the fox share, we can replace this with our own reverse shell.

Then, replace the .forward file in the share and send fox@localhost an email via swaks:

This would give us a reverse shell:

hashtag
Privilege Escalation

hashtag
X11 Research + Fox Creds

Earlier I saw a .dosbox file within the fox share, so I checked whether it was an SUID binary:

To exploit this, we need some form of GUI but RDP and VNC are both not available on this machine. Googling for 'SSH Dosbox Forwarding' brought up this Reddit post referring to x11:

Reading the manual for ssh reveals the -X flag is for x11 forwarding:

In short, this allows us to spawn the GUI needed to exploit this. Dropping our SSH key doesn't work, so we need to find creds for fox.

The /home directory had some other users, and one had a .bash_history folder:

This password works for fox.

hashtag
Dosbox SUID -> Root

We can use the -X option after finding the user's password:

I tested by running dosbox, which spawns the GUI for me:

We can then run this:

This would mount the Linux file system within the C Drive of the termnal:

To exploit this, first create a new hash:

Then, run these commands on a fox SSH session:

Then, on the dosbox instance, run this:

We can then ssh in using the new hacker user:

PreviousFlaskyNextHawat

Last updated