┌──(kali㉿kali)-[~/Downloads/dawn] └─$ sudo nmap --min-rate 10000 -p- 192.168.56.134 Starting Nmap 7.94 ( https://nmap.org ) at 2023-08-12 13:21 EDT Nmap scan report for 192.168.56.134 Host is up (0.00035s latency). Not shown: 65531 closed tcp ports (reset) PORT STATE SERVICE 80/tcp open http 139/tcp open netbios-ssn 445/tcp open microsoft-ds 3306/tcp open mysql MAC Address: 08:00:27:84:97:E0 (Oracle VirtualBox virtual NIC)
Nmap done: 1 IP address (1 host up) scanned in 9.46 seconds
┌──(kali㉿kali)-[~/Downloads/dawn] └─$ sudo nmap -sT -sV -sC -O -p80,139,445,3306 192.168.56.134 Starting Nmap 7.94 ( https://nmap.org ) at 2023-08-12 13:24 EDT Nmap scan report for 192.168.56.134 Host is up (0.00031s latency).
PORT STATE SERVICE VERSION 80/tcp open http Apache httpd 2.4.38 ((Debian)) |_http-server-header: Apache/2.4.38 (Debian) |_http-title: Site doesn\'t have a title (text/html). 139/tcp open netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP) 445/tcp open Samba smbd 4.9.5-Debian (workgroup: WORKGROUP) 3306/tcp open mysql MySQL 5.5.5-10.3.15-MariaDB-1 | mysql-info: | Protocol: 10 | Version: 5.5.5-10.3.15-MariaDB-1 | Thread ID: 16 | Capabilities flags: 63486 | Some Capabilities: Support41Auth, ConnectWithDatabase, SupportsLoadDataLocal, Speaks41ProtocolNew, Speaks41ProtocolOld, IgnoreSpaceBeforeParenthesis, SupportsTransactions, InteractiveClient, DontAllowDatabaseTableColumn, FoundRows, IgnoreSigpipes, ODBCClient, SupportsCompression, LongColumnFlag, SupportsMultipleStatments, SupportsAuthPlugins, SupportsMultipleResults | Status: Autocommit | Salt: &@QV;b_5*ouz)ZgzO[\= |_ Auth Plugin Name: mysql_native_password MAC Address: 08:00:27:84:97:E0 (Oracle VirtualBox virtual NIC) Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port Device type: general purpose Running: Linux 3.X|4.X OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4 OS details: Linux 3.2 - 4.9 Network Distance: 1 hop Service Info: Host: DAWN
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 19.87 seconds
┌──(kali㉿kali)-[~/Downloads/dawn] └─$ sudo nmap --script=vuln -p80,139,445,3306 192.168.56.134 Starting Nmap 7.94 ( https://nmap.org ) at 2023-08-13 11:17 EDT Pre-scan script results: | broadcast-avahi-dos: | Discovered hosts: | 224.0.0.251 | After NULL UDP avahi packet DoS (CVE-2011-1002). |_ Hosts are all up (not vulnerable). Nmap scan report for 192.168.56.134 Host is up (0.00031s latency).
PORT STATE SERVICE 80/tcp open http |_http-dombased-xss: Couldn\'t find any DOM based XSS. |_http-csrf: Couldn\'t find any CSRF vulnerabilities. |_http-stored-xss: Couldn\'t find any stored XSS vulnerabilities. | http-enum: |_ /logs/: Logs 139/tcp open netbios-ssn 445/tcp open microsoft-ds 3306/tcp open mysql |_mysql-vuln-cve2012-2122: ERROR: Script execution failed (use -d to debug) MAC Address: 08:00:27:84:97:E0 (Oracle VirtualBox virtual NIC)
Host script results: |_smb-vuln-ms10-061: false | smb-vuln-regsvc-dos: | VULNERABLE: | Service regsvc in Microsoft Windows systems vulnerable to denial of service | State: VULNERABLE | The service regsvc in Microsoft Windows 2000 systems is vulnerable to denial of service caused by a null deference | pointer. This script will crash the service if it is vulnerable. This vulnerability was discovered by Ron Bowes | while working on smb-enum-sessions. |_ |_smb-vuln-ms10-054: false
Nmap done: 1 IP address (1 host up) scanned in 71.14 seconds
80 端口发现 logs 目录
ftp 和 MySQL 渗透
尝试一下 ftp 匿名登陆和 MySQL 无密码登录
1 2 3 4 5 6 7 8 9 10 11 12 13 14
┌──(kali㉿kali)-[~/Downloads/dawn] └─$ ftp 192.1.1.142 Connected to 192.1.1.142. 220 (vsFTPd 3.0.3) Name (192.1.1.142:kali): anonymous 331 Please specify the password. Password: 530 Login incorrect. ftp: Login failed
┌──(kali㉿kali)-[~/Downloads/dawn] └─$ mysql -u root -h 192.168.56.134 -p Enter password: ERROR 1045 (28000): Access denied for user 'root'@'192.168.56.106' (using password: NO)
┌──(kali㉿kali)-[~/Downloads/dawn] └─$ sudo smbmap -H 192.168.56.134 [sudo] password for kali: [+] IP: 192.168.56.134:445 Name: 192.168.56.134 Disk Permissions Comment ---- ----------- ------- print$ NO ACCESS Printer Drivers ITDEPT READ ONLY PLEASE DO NOT REMOVE THIS SHARE. IN CASE YOU ARE NOT AUTHORIZED TO USE THIS SYSTEM LEAVE IMMEADIATELY. IPC$ NO ACCESS IPC Service (Samba 4.9.5-Debian)
┌──(kali㉿kali)-[~/Downloads/dawn] └─$ smbclient //192.168.56.134/ITDEPT Password for [WORKGROUP\kali]: Try "help" to get a list of possible commands. smb: \> ls . D 0 Fri Aug 2 23:23:20 2019 .. D 0 Fri Aug 2 23:21:39 2019
7158264 blocks of size 1024. 0 blocks available smb: \> pwd Current directory is \\192.168.56.134\ITDEPT\
www-data@dawn:/home/ganimedes$ cat /etc/crontab cat /etc/crontab # /etc/crontab: system-wide crontab # Unlike any other crontab you don't have to run the `crontab' # command to install the new version when you edit this file # and files in /etc/cron.d. These files also have username fields, # that none of the other crontabs do.
dawn# cd /root cd /root dawn# ls ls flag.txt pspy64 dawn# cat flag.txt cat flag.txt Hello! whitecr0wz here. I would like to congratulate and thank you for finishing the ctf, however, there is another way of getting a shell(very similar though). Also, 4 other methods are available for rooting this box!
