Black Box 3

Pivoting + Basic Privilege's Escalation

target:

172.16.37.0/24

Goals

  • Discover and exploit all machines on the network

  • Read all flag files (one per machine)

  • Obtain root privileges on both machines (meterpreter's autoroute functionality and ncrack's minimal.usr list will prove useful)

What you will learn

  • Network discovery

  • Pivoting to other networks

  • Basic privilege escalation

Recommended tools

  • Dirb

  • Metasploit framework (recommended version 5)

  • Nmap

  • FTP Utility

My Solution:

Network+Info:

routing:

recon:

OS FingerPrinting:

First Target (Apache httpd 2.4.18 Ubuntu):

target:

going to the host via browser and checking the source code we find this:

looks like an ifconfig output shows a second network this device got access to: 172.16.50.0/24 and it got the following IP in that network 172.16.50.222 .

IP on Other Network:

looks like we will exploit it then pivote to other targets.

dir busted:

/javascript shows we don't have any permission. however let's enum dir their and see if any interesting dir:

Same thing also Forbidden let's dir enum as well, inside of it another /jquery and there, we find jQuery lib code. and that's the end of the rabbit hole.

we are stuck let' move to the next target

Second Target (ProFTPD + Apache httpd):

target:

let's start with ftp (try to crack it using ncrack but it's in non-standard port):

nothing, let's try the http.

dir enum:

/xyz found this

same as the first target we also have ifconfig shows that Target2 is conn to another network with IP 172.16.50.244 .

IP on other Network:

we won't be able to conn to either of the new IP let's comprmise one of them this machine have ftp let's try normal conn no attack:

interesting now we will use ftp to ransfere a msfvenome:

and run msfconsole to liten to the reverse_tcp while runing the payload by nav to the webpage.

also well get a privilege escalation by checking the /etc/passwd :

you can check for the flag in the www by ls -al as a hidden file so you need root to actually read it.

then will move the backups folder to www so we can download it using this command:

in that machine nmap is installed scan network:

you will notice target 1 also got ssh to access you will need to CTR+Z + autoroute:

now we will guess SSH creds using metasploit:

some time will go and new session will be created:

PreviousBlack Box 2NextBlack Box 3 - Remastered

Last updated

Was this helpful?