search

linuxBratarina

hashtag
Enumeration:

hashtag
Port Scanning:

┌──(kali㉿kali)-[~/…/Machines/OffsecPG/Practice/Bratarina]
└─$ sudo nmap -sCV -p- --min-rate 4000 -oA nmap/services -vv 192.168.225.71
Starting Nmap 7.95 ( https://nmap.org ) at 2025-10-05 08:38 +03
Nmap scan report for 192.168.225.71                                                   
Host is up, received echo-reply ttl 61 (0.17s latency).                                                                                                                     
Scanned at 2025-10-05 08:38:56 +03 for 231s                                           
Not shown: 65530 filtered tcp ports (no-response)                                     
PORT    STATE  SERVICE     REASON         VERSION                                                                                                                           
22/tcp  open   ssh         syn-ack ttl 61 OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)                                                                      
| ssh-hostkey:                                                                                                                                                              
|   2048 db:dd:2c:ea:2f:85:c5:89:bc:fc:e9:a3:38:f0:d7:50 (RSA)                        
| ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDJ0GZmmFtQUJbj2HgPsye2Xccyyh9mC8fsCwIivM4x3o3mwZDNi6g+Y6nIs5SuOJj2IpS+E9O5wB71MSIv7d7XYrd6paprfvnvMCyAQ9VTn8py6CQ/OsgeOITU+JnAxoe3WQ
klpyAVqhJ7ASqAInZF8oHDaebr6gBKEq4nkoLOtJSZeB8xWDHhbQZjG6AY81Y2mHPZH/LC4gSXpSmw+3h0zhlCN/kxeyhjrsrZqIVdKhg4emds8+gQyu1Wrz4AUUBGscI6Sh5rjImr+SC4rAGgn6N0MVPcZA1mS0JUplz758Y3YF
XstqO2SdaHB/Qb50fkcpclcYKibSbCv5ZLNzOf                                                
|   256 e3:b7:65:c2:a7:8e:45:29:bb:62:ec:30:1a:eb:ed:6d (ECDSA)                                                                                                             
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBOWgZAzhJ+plc4Rk/YyGvQ1KOKK9j31ix1uCWIAirjnZS/lKwcvYrkG+lVsJRBnBYVA+67ILSJR2YNVz9uZshPE=          
|   256 d5:5b:79:5b:ce:48:d8:57:46:db:59:4f:cd:45:5d:ef (ED25519)                     
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC2Z9krPXlbEN6Xl40sc3BiVLfhbtd+l5ZFNBKkF7pYT    
25/tcp  open   smtp        syn-ack ttl 61 OpenSMTPD                                                                                                                         
| smtp-commands: bratarina Hello nmap.scanme.org [192.168.45.235], pleased to meet you, 8BITMIME, ENHANCEDSTATUSCODES, SIZE 36700160, DSN, HELP                             
|_ 2.0.0 This is OpenSMTPD 2.0.0 To report bugs in the implementation, please contact bugs@openbsd.org 2.0.0 with full details 2.0.0 End of HELP info                       
80/tcp  open   http        syn-ack ttl 61 nginx 1.14.0 (Ubuntu)                                                                                                             
|_http-title:         Page not found - FlaskBB                                        
|_http-server-header: nginx/1.14.0 (Ubuntu)                                           
445/tcp open   netbios-ssn syn-ack ttl 61 Samba smbd 4.7.6-Ubuntu (workgroup: COFFEECORP)                                                                                   
Service Info: Host: bratarina; OS: Linux; CPE: cpe:/o:linux:linux_kernel

We have ssh running on port 22, smtp on port 25, http on port 80, and finally samba on port 445.

We will start with those ports one by one.

For 22 we can not do anything unless we have a set of credentials, or it is an old version, or we can perform brute forcing on some known users like root, etc.

For port 445 and port 80, I did not find anything useful actually.

hashtag
Exploitation:

hashtag
SMTP (25):

We will search for any public exploits for OpenSMTPD:

We can try any of them blindly:

The exploit above, exploit command execution vulnerability in smtp in the mail field of the mail.

When we run it without any arguments:

We will first check if this is a valid exploit by first trying to ping our own host using ping and tcpdump:

We will send a ping requests:

Indeed this the way in.

I will write a simple sh script to give me a reverse shell on port 445 because this was one of the open ports, and host it using a python web server:

If you passed it like this as argument to the exploit or even surrounded it with bash -c it will error out because of the special characters.

Host it:

Download it to the /tmp folder, then start it with bash (Or we can give it execution permissions and start it itself), but before that we should start our nc listener as well:

Run the exploit:

Check our web server and the netcat listener:

We rooted the box.

Get the flag:

PreviousSnookumsNextPebbles

Last updated