I then ran smbmap -H IP_Address, and got the following output:
[+] Guest session IP: 10.10.98.192:445 Name: 10.10.98.192
Disk Permissions Comment
---- ----------- -------
print$ NO ACCESS Printer Drivers
shares READ ONLY VulnNet Business Shares
IPC$ NO ACCESS IPC Service (vulnnet-internal server (Samba, Ubuntu))
I then ran smbclient \\\\10.10.98.192\\shares, and got the following output:
Enter WORKGROUP\kali's password:
Try "help" to get a list of possible commands.
smb: \> ls
. D 0 Tue Feb 2 04:20:09 2021
.. D 0 Tue Feb 2 04:28:11 2021
temp D 0 Sat Feb 6 06:45:10 2021
data D 0 Tue Feb 2 04:27:33 2021
11309648 blocks of size 1024. 3278156 blocks available
In the temp folder, there was the following file:
smb: \temp\> ls
. D 0 Sat Feb 6 06:45:10 2021
.. D 0 Tue Feb 2 04:20:09 2021
services.txt N 38 Sat Feb 6 06:45:09 2021
In the data folder, there was the following file:
smb: \data\> ls
. D 0 Tue Feb 2 04:27:33 2021
.. D 0 Tue Feb 2 04:20:09 2021
data.txt N 48 Tue Feb 2 04:21:18 2021
business-req.txt N 190 Tue Feb 2 04:27:33 2021
Looking through the files, I found the flag for the services.txt:
I then ran a metasploit module auxiliary/scanner/rsync/modules_list. This is what I got from the result from it:
I then mounted the system to my machine:
Viewing through the files I came across some sort of password in the redis.conf file:
I then followed the same write-up to understand my next step. This was to use redis-cli in order to connect to the database and see what is there using the pasword we found earlier. I ran redis-cli -h 10.10.98.192 -a <requirepass_from_earlier> in order to login to the database. I then was able to find the flag for internal:
When I ran LRANGE authlist 1 20, I got the following:
The three values were the exact same, and seemed to be base64 encoded. I decoded it online and got the following:
So now we have to connect to rsync with this password:
There is a sys-internal directory that I ave to find a way to get access into. I followed the aforementioned write-up and ran the following commands (tweaked to work for me):
This allowed me to download the folder to my local drive. In that directory, I found the user.txt file:
I got stuck here, so I had to view the write-up again. I was meant to create an SSH keypair and upload it using rsync. So I ran the following commands:
Visiting localhost:8111 led me to the following page:
I then searched for the word token in the whole filesystem to find a token for the following webpage:
The second to last authentication token worked for me! I then created a new project:
I then created a build config:
I then ran the script from the choice on top, and when I went back to my previous shell, I ran /bin/bash -p, and I was able to get root:
I wan then able to get the root flag:
I then read and realized that I did not use the showmount command. I then followed the write-up to run showmeant -e IP_Address. I then got the following:
For the previous step, I ended up getting stuck, and found that actually clarified the situation for me. This same write-up led me to run ss-tulpn to find out what ports were open. I used the same write-up to figure out we have to do port forwarding. In order to do this, I ran the following command:
I then went to Build Steps and followed a bit of for this part. I following the following image:
