Postfish

Gaining Access

Nmap scan:

$ nmap -p- --min-rate 3000 -Pn 192.168.183.137
Starting Nmap 7.93 ( https://nmap.org ) at 2023-07-12 14:08 +08
Nmap scan report for 192.168.183.137
Host is up (0.17s latency).
Not shown: 65528 closed tcp ports (conn-refused)
PORT    STATE SERVICE
22/tcp  open  ssh
25/tcp  open  smtp
80/tcp  open  http
110/tcp open  pop3
143/tcp open  imap
993/tcp open  imaps
995/tcp open  pop3s

This box involves testing mail services. We have to add postfish.off to our /etc/hosts file to view the website on port 80.

Web Enumeration

The website looked rather static:

There was a 'Team' page, and when viewed we get some names and roles:

Interesting.

SMTP Enumeration -> Phishing Link

The website had nothing else to offer, so I went looking for exploits pertaining to the mail servers. I tested some usernames and departments like HR, and found HR existed on the server:

I tried some low hanging fruits, like logging in with hr:hr and postfish:postfish. Eventually, sales:sales worked on IMAP:

I was able to find one message present within the Inbox:

We can read this message:

So there's some password reset links being sent out, and perhaps we can trick a user into clicking on our link. I used swaks to send an email to send emails:

The above doesn't work, so I used 'Brian Moore', which is the name of the user part of the Sales team based on the website. There are tons of username generators online based on a name:

Afterwards, we can test which user is present on the server:

brian.moore exists, so let's send an email to him and start a listener port to see if he clicks on our link. swaks doesn't seem to work for some reason, so we can just use nc:

After the mail sends, we get a callback on our listener port with creds:

We can use this password to ssh in as brian.moore:

Privilege Escalation

Mail Disclaimer -> Filter Shell

I ran a linpeas.sh scan on the machine, and it found this interesting folder:

It was a bash script:

Users part of the filter group can write to this, and brian.moore is part of that group. I added this to the script:

This script is triggered by sending emails, so we can send another one to the machine without the phishing link to get another reverse shell:

Sudo Mail -> Root

This new user can execute mail using sudo:

We can get a root shell using the commands from GTFOBins:

PreviousPhobosNextPlanetExpress

Last updated