577, Gold Plaza, Punjab Jewellers, M.G. Road, Opp. Treasure Island Mall

My File Server: 1 Walkthrough

My File Server: 1 Walkthrough Vulnhub CTF

My File Server: 1 Walkthrough Vulnhub CTF

I will share with you a new Walkthrough for Vulnhub machines. My File Server: 1 This CTF machine is Created by Akanksha Sachin Verma You can download here this CTF . I would call this box on the easy side but there are a lot of moving parts which can cause you to follow some different directions. I don’t want to say to much so let’s get at it.

Penetration Testing Methodologies

Network Scan

  • Netdicover
  • Nmap

Enumeration

  • SMBMAP
  • Nikto

Exploit

  • Injecting id_rsa.pub

Privilege Escalation

  • Kernel Exploit
  • Capture the Flag.

Network Scanning

So, as we always start with netdiscover to get the IP of the VM machine and the IP of the host I’ve found is 192.168.2.5

Let’s proceed with network scan using Nmap aggressive scan as given below

Enumeration

It was very interesting as there were so many services running on the host network. We saw FTP’s “anonymous login enabled” and port 445 was also available for SMB.

In order to enumerate SMB and identify a username as “smbuser” , I use the following command.

On applying the Nmap script for SMB we found a user named smbuser

We also explore the IP host in the web browser as port 80 has been opened for the HTTP service. There was nothing special at web page just a link to Amrour Infosec.

I chose to run Nikto for HTTP weak config listing, and luckily found an entry for “readme.txt,” let’s test this in the web browser.

I think the author has kept this file as a clue that he wants to get the password by searching the readme.txt file. So now I had the username “smbuser” and the password “rootroot1” and it was time to connect to the host machine via ssh, so I tried to use this cred for ssh login, but we got an error as connection timeout, which means that the username “smbuser” cannot connect to the host machine via ssh.

Exploitation

Now time to generate some ssh keys, thus we used ssh-keygen to generate ssh public keys without password in our local machine i.e. KALI LINUX. Moving on after the key is created, we moved into the .ssh directory on our native shell, here we saw that we have the key named “id_rsa.pub”.

Let’s generate keys for SSH so we can login into smbuser!

Steps:

  1. Create ssh key pair by running ssh-keygen.
  2. Create .ssh directory on the mounted share /home/smbuser/.ssh
  3. Copy the content of the public key to /home/smbuser/.ssh.
  4. SSH into [email protected]_victim_ip_!

With the help of above-enumerated creds “smbuser:rootroot1” we logged into FTP and create a folder as .ssh inside /home/smbuser, then try to upload the id_rsa.pub which we have generated in above mention step as authorized_keys  inside the .ssh directory.

Now we should be able to ssh with the private key:

 

I found it’s a really old version of the kernel that’s built here, so I’m trying to check for a piece of code to exploit, and luckily, I find it to be a DIRTYCOW exploit. So, I download a hack from Exploit-DB written in c.

Privilege Escalation

I downloaded the exploit inside the host machine, and then compiled it before running the exploit, so I ran the following commands.

Eureka……. Root ……

Boom! We got root the shell by running ./dasagreeva and finally, we obtain proof.txt file.

Leave a comment

WhatsApp us