Machine Shocker - Easy

Machine Shocker - Easy

NMAP

80/tcp   open  http         syn-ack ttl 63
2222/tcp open  EtherNetIP-1 syn-ack ttl 63

PORT     STATE SERVICE VERSION
80/tcp   open  http    Apache httpd 2.4.18 ((Ubuntu))
|_http-title: Site doesn't have a title (text/html).
|_http-server-header: Apache/2.4.18 (Ubuntu)
2222/tcp open  ssh     OpenSSH 7.2p2 Ubuntu 4ubuntu2.2 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
|   2048 c4:f8:ad:e8:f8:04:77:de:cf:15:0d:63:0a:18:7e:49 (RSA)
|   256 22:8f:b1:97:bf:0f:17:08:fc:7e:2c:8f:e9:77:3a:48 (ECDSA)
|_  256 e6:ac:27:a3:b5:a9:f1:12:3c:34:a5:5d:5b:eb:3d:e9 (ED25519)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Enumeration

• fuzz on the port 80
  • HINT :( there is cgi-bin
  • I didn’t found it cause I did not put the final / in the FUZZ
  • maybe we should run wfuzz and dirb
  • HINT: there is an exploit when we see a script in there like user.sh
  • got reverse shell
  • sudo -l show that I can run perl as root
  • sudo perl -e ‘exec “chmod u+s /bin/bash”;’
• ssh is using OpenSSH 7.2
  • it shows there is a username enumeration vuln
  • lets try it out…
  • nothing found in there