So with that being said, I have gone ahead and spun of a machine, so go ahead and get logged into
your hack the box, a Web site into your account.
Now, if you did not watch episode one, then you are behind.
And again, we're going to repeat ourselves too much along the episode.
So what we learned last time we covered enumeration numeration legacy.
This time we're going to look at this box called lame.
Now, lame is a Linux machine, as you see by the little penguin here next to it.
And it's pretty easy on the difficulty side.
We're gonna take a look at that seems a little bit maybe more difficult rated then legacy was.
But no need to worry.
We're going to walk through everything here.
So this will be episode two, box two.
I've gone ahead and hit the little start button on the machine.
Yours should have spun up with my stalling now, and I'm going to go ahead and get this scanning.
So we're gonna do is we're going to open up a new window.
I'm going to make it nice and big for you guys.
And this is ten.
Not ten.
Not ten, not three.
So let's go ahead and just do our and map that we showed last time and we'll do 10.
That turned out ten to three like this.
We're going to let this scan.
This could take anywhere up to five minutes.
So in my stalling time, what I'm going to do is describe some different scanning methods.
So last time I told you about how this is my methodology, if I want to scan a network, if I want to
scan the machine, I'm going with this.
And that is a 100 percent true.
But there are other methodologies that are out there and maybe you find something that you like better.
We kind of talked about that last time.
One that I want to present to you and then I talk about quite a bit on my streams.
Is the idea of scanning?
There's two different ideas here.
One is doing a quick scan.
So we just say and map and we just say 10 to ten.
Not ten, not three.
We get rid of all this.
We believe leave the speed in their T4 if we want, but we get rid of all this stuff here and we just
scan this.
Now, what is that going to do?
Well, if you remember from last time, that's going to only scan the top 1000 ports because we're not
scanning all.
Sixty five thousand five hundred thirty five here.
So we're only a scan, top 1000.
Well, we can scan the top one thousand quickly and see what comes back.
And in that theory, we can then go poke and prod around some things that might be there.
It's generally pretty fast.
So that's one theory.
I don't like doing that too much.
Some people like to go that way.
Another theory or methodology to do that.
I'm not opposed to honestly is to end map all open ports, speed achee for whatever speed you like and
take out this dash.
Now this dash, eh, is the speed killer.
This is what takes as long as we're doing all those different enumerations against this machine.
Right.
We're doing the OSA numeration, the service version and numeration trace route, etc..
What we saw last time on the help menu or do all that stuff against all the parts on this machine.
Now, maybe a wiser strategy and a faster strategy could be to take this out completely quickly, scan
with and map for open ports on this machine.
All sixty five thousand.
Right.
Scan for open ports and then see what ports return.
Now, we could take that.
Let's just copy this and let's go into a new tab and our scanner results back.
Sighs Stalled successfully so we could take this and let's say something like port.
Twenty one was open and Port 80 was open and for three was open.
Right.
Say you had something like this come back and there only three ports open.
Why not just scan for three ports?
Scan all everything for three ports.
You could be wasting a lot of time here.
Just scanning with the dash.
Now, in a later video, I'll probably show you some other techniques revolving around this one that
I've been introduced to recently.
And I'm kind of maybe transitioning to I don't like to admit that I'm transitioning off and map ever,
but there is a another tool called mass scan.
I'm asking is incredibly fast for finding these ports for this purpose here.
And then we can go back and just scan all against the parts of a fine.
Now, if that's the way you want to go, we'll do it in one video just to show you guys you guys can
make up your minds on whether or not you like to go out.
Now, you can see this tech.
One hundred and forty four seconds.
That's really not that bad.
If you're doing some kind of like first blood race or you're trying to, you know, get first in something
four more points for whatever it is like capture the flag, then maybe, you know, this method is the
better method you scripted out, do whatever.
But if you're doing a PIN test or whatever, you know, you're going to be waiting on lots of stuff
anyway.
So in my opinion, there's no point in building up those few extra seconds.
So it's really up to you and how you want to do it.
OK, our skin is back.
So we have a few things here.
Let's talk first.
Four twenty one is open.
Twenty one is F t.P, the file transfer protocol.
So we can see a few things from this.
We see a version here.
Perfect.
We can Google that later.
We see anonymous log in is allowed.
Nice.
OK.
So this in itself, if we're doing a pen test may be a finding.
Right.
Why.
Why is anonymous log in allowed.
Why should anybody be able to access a server and put files on and take files off, especially if this
is a public facing server?
If it's internal.
OK.
Little bit more leniency on the external side.
Why?
You know why.
So we've got that.
We can see that they connected.
And that's about it.
OK, so we've got twenty one now.
Twenty one by itself is not exploitable in the fact that you can put files and get files off of it.
Now versions, versions might be exploitable.
A very common one that I know of is the Konica Minolta.
FCP has a buffer overflow.
So something like a buffer overflow attack against a service version.
Perfect.
Right.
That might be explainable.
But by nature, typically, if we're looking at port twenty one and there's no version exploit.
It's not really a vulnerability per say.
It's a vulnerability.
If you change some things like anonymous FPP, log in.
OK, we're logged in.
Now you can put some files on the server.
But the second part of that is how do we execute the files on the server?
Now, we're not going to see that today because there is going to be no way to execute these.
But think about that.
If I put a file on the server, I need to either be able to execute it myself or I need to get somebody
to execute it for me.
So I have to do some sort of social engineering trick, somebody into opening a file or if the files
maybe on a Web server, I can go in and I can open it myself and exploit it.
I have to have some kind of command execution.
Right, in order to do that.
So putting a file onto a server, not malicious enough.
We need a second part of that, typically, unless there's some sort of version exploit.
OK, so downward, we've got 20 to open.
Twenty two is as age.
So S.O.S age.
In my opinion is not what we're looking for when we're trying to trying to run exploits.
Now, SS age can be exploitable ie in the wild and really an even CTF.
I have never seen a version exploit for SS age.
So with that being said, some options that we have are brute force attacks or gathering credentials
and trying to log in that way right now when I am doing a test.
Of course I'll check and see if there's any sort of vulnerability here.
There are vulnerabilities with SS age.
I'm just saying I've never encountered them personally.
I have seen them.
So the the SS age thing, if I'm doing a PIN test and you can consider this maybe last resort or, you
know, you're going to brute force it anyway, you're going to say I'll send an attack at route with
like five hundred or a thousand bad passwords.
And there's reasoning behind this one.
If I log in with a bad password or top 1000 password, why did that happen?
How bad is your password policy?
Right to if I got a thousand times under way and nothing blocked me, no alerts were given to the client,
then there's an issue with the SIM, right.
What?
What's wrong with their alerting?
Why are they not catching this?
Do they have some sort of detection?
If they do?
Why is it not seeing brute force attacks?
So I like to hammer away.
I am very, very loud, very intentionally noisy pen duster.
Now, that is completely different from the red team side where you're trying to be as quiet as possible.
And my belief as a pen tester, if I am loud and you catch me great, I'll start getting quieter and
quieter.
But if I'm being loud, you're not catching me.
This helps me identify your weakest spots, which is your SIM, which helps with the detection.
So I will bang on the SS H door if I have to.
OK.
So another thing, as we pointed out here is a lot of times in these CTF machines, and I consider hack
the box ETF is when you see SS age like this, you're going to gather credentials likely from some other
aspect, some other exploit, some place you're going to find them, stumble upon them, and then you're
going to use SS age to log in and get your lower shell.
That happens quite frequently.
In fact, a lot of the boxes that we're going to encounter are something like Port 20 to open and Port
80 open.
And that's all you got.
So, you know, you have to probably exploit Port 80 to get into port twenty two because Port 80 is
way more chance.
The higher chance of being exploitable and twenty two is OK.
So going down the list.
We have got one thirty nine and four forty five.
Now, these relate to Sambar, we talked about this last time, right?
SMB file shares known vulnerabilities all across the board.
So many bad things with S&P.
Oh, my God.
S&P is the worst.
Right.
So we need to look into this.
Samba SMB D 3.0 point zero version and see if there's any kind of exploit for it.
And then lastly, this.
Thirty six.
Thirty two.
I actually don't know dis CCD is I know somebody is going to comment and tell me what it is because
that happens all the time.
So please do comment and tell me what this is.
I have no friggin idea, but depen testing methodology behind this is to Google what this version one
is and this maybe four point two four and is if there is an exploit behind this.
Right.
So we'll we will look into it because that's not the path of the machine.
But if it were if we were blind in this situation, we'd absolutely look into this.
OK, so he come down, it gives us some OS best guesses and it guesses white Russian.
Zero point nine.
That is my favorite alcoholic beverage.
But I don't think that's a Linux version we're seeing here.
That is Bundu and his guest is coming to as white Russian.
So as I told you last time, the best guesses are not always accurate.
And here we can see that as we come down to the bottom, we can see some information around the actual
SMB results.
The OS discovery, it is running UNIX Samba 3.0 point two zero dash Debian OK.
Workgroup, blah, blah, blah.
Perfect.
So we see that SMB is open.
So.
If we go through the steps as a refresher first time, let's go ahead.
Let's start with SMB.
SMB is fresh in our mind.
We covered it in the previous episode.
So we're gonna stay with SMB first.
So what we're going to do is first things first, we're going to check with SMB client.
Do we have any kind of log in?
Right, SMB client Dash L.
Just to list the folders.
And I'm going to say ten, 10, 10.
I believe this was three.
I'll try to list it.
Enter a password.
OK.
We can list a folder here.
What.
That's awesome.
Right.
So we can lissome folders and it looks like they're probably trolling us Ohno's here on the temp folder.
So we've got the print IPC admin really ideally we're after like this folder, but we can enumerate
here and see if there's anything.
So one thing I can do is I can just delete this and we can try to connect to to say try to connect to
the temple there with Anonymous.
And then we say L.
S and OK, there's there's nothing really here.
Right.
There's these files that there's I mean, we can we can grab this file.
There's no no bite size on it.
This J.
SBC.
There's nothing here in this temp folder.
Now we can put something into the temp folder.
And this is the same kind of idea as f T.P.
But how are we going to execute it when we get to SMB and we get into these files shares?
We're after numeration on top of that, as you'll find out at a later time, is if we get credentials
and we have admin credentials to access his admin group.
We're after Admon Shell.
We can get a shell with something like Piesse Exact and in own this machine very fast.
If we got the right credentials so we can run through these and see where we have access to.
Now, this would be a finding on a pen test again, right?
Like why?
Why default credentials.
Why?
You know, anonymous log in or whatever into this as and B, it shouldn't happen.
So we can say X it and then we can try to navigate into the OP's folder and see if it'll let us.
And now you're seeing access denied.
So off to be a more juicy folder to get some information on maybe what kind of programs they got installed.
But obviously, we're not we're not getting there.
And now we could check the Abin folder spray and pray here and you could see access denied as well.
So we would need route's password to really get into this.
And we we're at a little bit of a dead end here, so that's fine.
The other thing that we talked about last time was that we could use my display to gather information
SMB version about this exploit or about this this version.
But you see here last time, the version wasn't provided for us.
But this time the version of Sambar or SMB was provided for us.
So this is really nice.
And we can just copy this.
We you take this over to Google and we can ask Google some stuff, right?
We could say, hey, Google, hi.
Look, it starts to know you.
And it starts to know things about certain, like the samba.
It probably knows we're looking for an exploit.
But more and more that I Google stuff.
It starts coming up.
Exploit, exploit, exploit for everything.
And you can see I've been in here before.
So, again, from last time, we've got options, right?
The first thing that comes up is Rapid 7th Love Rapid seven.
Why?
Again, because they make Matus Boy this is properly Amandus Boit module here.
Perfect.
We also have this here.
Three point zero point to zero Debian exploit through 3.0 point to five using a map script that looks
like it fits what we need.
Right.
So we can come in here.
And this is just the Métis flight ruby module anyway.
OK.
So I thought maybe we'd have a manual exploit here.
We we don't.
There might be one out there for this.
But what we're looking at is a Ruby module for Matus flight.
That just means it's already built in.
Anyway.
Ninety nine percent of the time.
So if we come in here, we review the exploit says this module exploits command, execution, vulnerability
and samba version three point zero point to zero through 3.0 four to five.
Check.
We meet that when using the non default user name map script configuration option by specifying a username
containing Shell Medek characters, attackers can execute arbitrary commands with no authentication
is needed.
This is perfect.
OK.
So I think this is money.
We could try it.
Give it a go.
See what it looks like.
So let's copy this.
And let's go ahead and open up Métis.
We can say MSF consul.
Now it'll take a second to boot, if you wanted to boot faster and your newer, you can do something
like service posts, grass, cue owls start or what is it?
System CTO PostgreSQL QoL enable or enable PostgreSQL.
Well, and that'll have the postgrad database running, which is what matters play runs off of every
time your computer starts.
I just don't mind a little five second wait or whatever that goes on in the beginning, so.
OK.
So anyway, we can say now we just pace this right.
I think we copied it.
So let's try to paste it.
Boom.
Say options.
OK.
We've got to set our house, remember, our host is the remote host.
That is our victim.
That is who we are attacking.
Stand at ten.
Ten to three.
We always show targets just to be safe.
Only one target.
And that is automatics.
Let's run this bad boy and see what happens.
Boom.
We just popped a shell.
OK.
So last time we popped a shell and we were in mature Sprouter in windows, this time we are in a Linux
machine.
Let's say, who am I?
Hey, we are rude hostname print the working directory or present working directory.
OK.
And then we can see in2 or you do allus see all the options.
Right.
I could see these in the home less.
So, you know, there's a lot of options here.
c.D, Dad.
We could see the entire route.
And we can grab the route text if it has locate available.
You could just say locate route dot text.
Whether or not that comes back with anything, it doesn't.
It has update D.V..
And then we could try locate root contacts.
That works.
Could also locate user dot text.
And you could see that the other user is this my keys?
Mochis?
I don't know.
But if you want to grab your flags here, your flags.
OK, so a couple other things, we talked last time about the enumeration that we want to do in post
exploitation right now, we are rude.
So rude means that we have full access to this machine.
We own this machine right now.
Up until this point has been easy.
There has been no privilege escalation.
And that's OK in our books.
We are we are dummies.
We are newbies.
We are going to build up into that.
OK.
So for now, take these easy wins and enjoy them.
So as root and as post enumeration, some things that we can look at.
We can take, for example, the Etsy file, Etsy shadow file, an Etsy password.
So let's cat out the Etsy password.
Now, you may have access to this and should have access to this as most users.
So if we were to have a lower level shell, you could have access to this file.
Now, what this is, is the password to file is misleading.
There are no passwords in this file.
You see this nice little X here.
Now, back in the day, they used to put passwords in the password file, but they stopped doing that.
Instead, they created what is called a shadow file as well.
The shadow file will take the password and it will put it or the password hash and they'll put it in
this X place holder here.
So I'll show you that in a second.
But what we can do is we can print this out.
This shows you some information routes always at the top and then you start coming down the bottom.
Your users, your real users are down at the bottom.
The rest of these are service accounts.
And I've seen that ninety nine percent of the time where it's like this.
So you'll always see our users at the bottom.
We only have this one user that is as Mockus user or McKees or however you pronounce it.
So the other thing that we can do is we could say Cat Etsi Shadow.
And this will give you that idea too, as to what accounts have passwords.
And you could see there are a few accounts here with passwords.
So now this password, this hash here, this hash will go in where the axe is.
OK.
So the root has that X this hash will go in there and that combines the whole file in order to be in
one.
This called Unshattered.
One is unshattered.
Like this, it's combined into one long format.
Now there is a tool that we can get into if we go into what is going to a new tab here.
So it is called Unshattered on Chatto.
So let's do something first.
Let's go ahead and copy here.
Let's copy the ETSI password file.
We'll say cat at the actually g it sorry password.
I've got an old one in here.
Perfect.
I'll say this and then will just copy this other one.
I show you what unshattered looks like.
Copy this guy.
Here, the shadow.
We're going to get it.
The Shadow.
And then we could save that one.
And then we can say unshattered.
And we run on Shadow that anything it's going to ask us say, hey, we want your password file.
And we want your shadow file.
So all you got to do is one shadow, password, shadow.
Run that.
And look what it does for you.
It prints out a nice on shadowed file.
See, the X now has been replaced with this hash.
Now, why is this important?
Why the heck do we care?
Well, we can take this and we can try to crack these passwords in hash cat.
OK.
So you can tell your hash this is an empty five, I believe.
Don't quote me.
I'm pretty sure MDT five is dollar sign, one dollar sign.
So the dollar sign, blank dollar sign is a good way to tell your hash.
Some are five.
Some are six.
And that's a quick way to say, hey, Google, what's dollar sign?
One dollar sign and a hash form.
I'm 90 percent sure it's empty.
Fine.
So you can run this through hash cat.
Unfortunately, I'm actually using my hash cat right now to work on an assessment, so I can't show
you this, but I have made videos on cracking hash.
If we come back in two, let's see my videos and we scroll through all of these.
There is a hash cat video in here somewhere.
So if you look through my videos, it is this one here cracking Linux password hashes.
I will link this down in the description below, if you're curious.
Very similar process.
You just run hash cat against this ice planet.
It more detail here.
So if you're if you want to know and you have a little bit more research.
There you go.
OK.
So we talked about post exploitation.
We're gonna gather the first thing I'm after.
Right.
Is is gathering these hashes.
I'm going to crack these hashes or try to crack these hashes and see where I can go from there.
From that point, you know, I also want to gather networking information.
We talked about that last time.
What's the IAFF config?
What is the what's the ah, what's the routing table etc.
If you don't know what the heck I'm talking about when it comes to networking, you should probably
look into learning a little bit more networking before you get too too far and depen testing.
Having a good networking background goes a long way.
You don't have to have a detailed networking background.
Just understand the basics.
So I'll look at those kind of things, you know, and and see what the connections are.
Net stat as well.
Just to see what kind of the connections are.
But, you know, I'm mainly after this all look through user files, see if there's anything interesting
and how we can access or leverage what we gain from this machine.
How can we take this machine and use it to get other places?
Right.
That's all post exploitation is what information can we gather again?
So there are renumeration is always key numeration prior to exploitation numeration.
If you have a lower level user to try to get that higher level user and then a numeration once you have
and have own the machine completely to move further, you're always looking for the next step.
And the more information you can gather, the better off you are.
Now, we won't talk about it for a very long time, but if you're saying, hey, what about the other
machines that we were supposed to exploit or the other services we're supposed to exploit?
OK.
There is one other service here.
Well, there's there's three, really.
Right.
If we were to have done this box, if I were to have done this blind, I would have enumerated this
version as well.
And let's take a look at it so we can go out to Google and just go.
Paste and look, Rapid Seven has one too rapid seven has a backdoor code execution on this.
Now it says is introduced for this between Bob of law.
Just gives us and says that, you know, this this exploit belongs to this version.
So we could come in and we could use this, try to exploit it, etc..
Now, the owner of the box put this on here as a rabbit hole.
So if you tried this if you've done this before, if you've looked at this box, you tried this, that's
perfectly OK.
I would have fallen down this rabbit hole as well.
In fact, I am sure I did when I tend to the box.
A long, long time ago.
But once you get past the hey, I've attempted this however many times and it's not working.
Time to move on.
Right.
Don't get stuck down the rabbit holes.
A lot of boxes you're going to find have them.
Don't waste too much time.
That's really the lesson.
The appropriate thing is to do your research as you just saw.
Another thing that we should do, too, and I do not show you, is we should F.T. Paech of the machine.
Right.
What's in that file folder?
If we can just type in anonymous here?
I just always type Anonymous for the password.
We could say less and say, OK, what's here?
Well, there's nothing here.
So and we're in the base directory.
So there's there's literally nothing.
Now, again, we could put a file in here.
We.
But where how we can access the file.
And that's the issue.
If this was like a Web server or something that we could go and access a file, ones have uploaded it,
then we can start talking about how we can get malicious.
But in this sense, we can upload the file.
But unless we can get somebody to go open the file, there's nothing that we can do right now.
So this is why we didn't spend a lot of time here.
But I do know that when you get FPP, you've got to have a second form of getting that file to exploit.
You can be malicious, but you have to have somebody exploit it for you or a way to exploit it.
And if you're looking for the version, you see a version that's going to be your.
Your exploit.
This is gonna get you reverse shell before a file upload.
Will, most likely you need to change here.
Had to change.
You need these two chains of attack here.
And then you need one potential here.
So we search for this exploit.
It's just not it's not valid on this machine.
But this is the right methodology, and that's really what we're after.
Same thing here.
We could search for this.
There's, like I said, not a ton of exploits for SS age.
SS age is usually a brute force or I found credentials somewhere logging in with that for a shell.
So.
And then lastly, we could search this as well.
But on this machine, this does not lead anywhere.
So if you're curious about it and you want to research it, you are more than welcome to do it.
So for the sake of time, that is really, really it for this lesson.
This is just another box, another way of seeing methodology.
And what I wanted to do is I wanted to try to build off the previous lesson where we learned about SMB
and now we got to see SMB again and we got to exploit it again.
But we also saw some extra versions and stuff to enumerate.
So next time I have a box in mind already that I'm going to take for us and we're going to build upon
some of the things I talked about this time and just keep going in that methodology.