Zino

$ nmap -p- --min-rate 3000 -Pn 192.168.157.64 
Starting Nmap 7.93 ( https://nmap.org ) at 2023-07-16 09:52 +08
Nmap scan report for 192.168.157.64
Host is up (0.17s latency).
Not shown: 65529 filtered tcp ports (no-response)
PORT     STATE SERVICE
21/tcp   open  ftp
22/tcp   open  ssh
139/tcp  open  netbios-ssn
445/tcp  open  microsoft-ds
3306/tcp open  mysql
8003/tcp open  mcreport

FTP + SMB Enumeration

FTP doesn't allow for anonymous logins, but SMB does have shares we can read.

$ smbmap -H 192.168.157.64         
[+] IP: 192.168.157.64:445      Name: 192.168.157.64                                    
        Disk                                                    Permissions     Comment
        ----                                                    -----------     -------
        zino                                                    READ ONLY       Logs
        print$                                                  NO ACCESS       Printer Drivers
        IPC$                                                    NO ACCESS       IPC Service (Samba 4.9.5-Debian)

We can login to zino:

The misc.log contained credentials for some software:

Booked RCE

The only web port was port 8003, and it led us to this login page:

There are some exploits for this:

We can use the credentials we got earlier to have RCE:

We can then get a reverse shell through nc:

Privilege Escalation

Cronjob Exploit -> Root

I downloaded linpeas.sh onto the machine and ran a scan. It found a cronjob we could hijack:

We can write to this file:

Here's the script contents:

Since there's a sys.exit(0) function at the end, we cannot just append code. What we can do is just create a completely new cleanup.py file within that directory.

Then we can just wait for a bit for the script to execute.

PreviousZenPhotoNextEvasion

Last updated