Bounty Hacker HIGH-LEVEL writeup draft
CATEGORIES:
Misconfigured services
SEVERITY SCORE: 10/10
The first step was an NMAP scan, I conducted one, and found that ports 21, 22, and 80 were open. Upon investigating port 80 by visiting [REDACTED MACHINE IP], I discovered
a message from what appeared to be 4 other users. After trying to edit the URL to /admin.php? and /login, which yielded nothing, I decided to investigate the open FTP port. (21)
When I prompted the FTP client for a connection, and provided no password, it revealed a vsFTPd service, and a 530 code, revealing that it was "anonymous only".
With this, I logged in as "anonymous", and began to search for sensitive information. When I prompted the terminal to reveal what files were in the directory,
I noticed "locks.txt", and "task.txt". Of which I promptly downloaded.
"locks.txt" revealed what appeared to be a list of passwords, or usernames. And was left by "lin". After my discovery, I edited the password list to include the names of the crew as far as I could see it. Jet, Ed, Ein, Faye, Spike, and Lin. And then used a bruteforce tool on the SSH service with the custom wordlist to see if I could get in. With the bruteforcing, I discovered that I had a match.
The credentials were [REDACTED], and the password was [REDACTED]. When I used this to log into SSH, I found "user.txt", which contained the user flag [REDACTED]. When I tried to privilege escalate, I saw that I could do /bin/tar. When I checked a shell website, I saw that any unprivileged user could execute it with special permissions.
After a privilege escalation shell I found, I ls-la /root, and found root.txt. When I cat, it showed [REDACTED]. Which was the root flag.SEVERITY: 10/10
SUMMARY OF AUDIT:
Due to an FTP (File Transfer Protocol) misconfiguration, an attacker could connect, and download a list of passwords.
Which can then be used to attempt to login to the SSH (secure shell, a service used for transferring files remotely) service, which hosts sensitive information.
My security assessment has revealed security risks that could endanger sensitive information on the target system.