PTS: 182
[pg
pts
kodexplorer
]
usual nmap:
22/tcp open ssh OpenSSH 7.4p1 Ubuntu 10 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 2048 96:24:bc:2c:f9:50:05:97:20:c9:30:50:7a:62:c1:9d (RSA)
| 256 98:c8:90:0a:b9:90:33:a1:17:b7:90:91:89:73:a5:3e (ECDSA)
|_ 256 97:fb:0f:72:ea:11:8e:15:10:85:25:44:92:07:8c:d1 (ED25519)
80/tcp open http Apache httpd 2.4.25 ((Ubuntu))
| http-cookie-flags:
| /:
| KOD_SESSION_ID_7da51:
|_ httponly flag not set
|_http-favicon: Unknown favicon MD5: 3B31552BFDAE63C70E07F969A7FCCAF3
|_http-generator: KodExplorer 4.25
| http-git:
| 172.16.11.182:80/.git/
| Git repository found!
| Repository description: Unnamed repository; edit this file 'description' to name the...
| Remotes:
|_ https://github.com/kalcaddle/KODExplorer.git
| http-methods:
|_ Supported Methods: GET HEAD POST OPTIONS
|_http-server-header: Apache/2.4.25 (Ubuntu)
| http-title: KodExplorer - Powered by KodExplorer
|_Requested resource was ./index.php?user/login&link=http%3A%2F%2Felara.pg%2F
139/tcp open netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
445/tcp open netbios-ssn Samba smbd 4.5.4-Ubuntu (workgroup: WORKGROUP)
Service Info: Host: FILESERVER01; OS: Linux; CPE: cpe:/o:linux:linux_kernel
Host script results:
|_clock-skew: mean: 1h17m47s, deviation: 2h18m34s, median: -2m13s
| nbstat: NetBIOS name: FILESERVER01, NetBIOS user: <unknown>, NetBIOS MAC: <unknown> (unknown)
| Names:
| FILESERVER01<00> Flags: <unique><active>
| FILESERVER01<03> Flags: <unique><active>
| FILESERVER01<20> Flags: <unique><active>
| WORKGROUP<00> Flags: <group><active>
|_ WORKGROUP<1e> Flags: <group><active>
| smb-os-discovery:
| OS: Windows 6.1 (Samba 4.5.4-Ubuntu)
| Computer name: fileserver01
| NetBIOS computer name: FILESERVER01\x00
| Domain name: \x00
| FQDN: fileserver01
|_ System time: 2020-05-25T03:23:06-04:00
| smb-security-mode:
| account_used: guest
| authentication_level: user
| challenge_response: supported
|_ message_signing: disabled (dangerous, but default)
| smb2-security-mode:
| 2.02:
|_ Message signing enabled but not required
| smb2-time:
| date: 2020-05-25T07:23:06
|_ start_date: N/A
port 80: KodExplorer v4.25
https://github.com/kalcaddle/KodExplorer/blob/master/ChangeLog.md
ver4.25 2017/12/01
Security vulnerability fix: Emergency fix of file unauthorized reading vulnerability, optimization of iis6 configuration leads to optimization of security issues
smbmap:
smbmap -H elara.pg
[+] Guest session IP: elara.pg:445 Name: unknown
Disk Permissions Comment
---- ----------- -------
print$ NO ACCESS Printer Drivers
DataDump NO ACCESS
IPC$ NO ACCESS IPC Service (fileserver01 server (Samba, Ubuntu))
smb-vuln-* scan:
Host script results:
|_smb-vuln-ms10-054: false
|_smb-vuln-ms10-061: false
| smb-vuln-regsvc-dos:
| VULNERABLE:
| Service regsvc in Microsoft Windows systems vulnerable to denial of service
| State: VULNERABLE
| The service regsvc in Microsoft Windows 2000 systems is vulnerable to denial of service caused by a null deference
| pointer. This script will crash the service if it is vulnerable. This vulnerability was discovered by Ron Bowes
| while working on smb-enum-sessions.
|_
smb enum:
=========================
| Users on elara.pg |
=========================
index: 0x1 RID: 0x3e8 acb: 0x00000010 Account: dpill Name: Dennis Pill Desc:
index: 0x2 RID: 0x3e9 acb: 0x00000010 Account: armour Name: Desc:
user:[dpill] rid:[0x3e8]
user:[armour] rid:[0x3e9]
cracking truecrypt with john:
https://floatingoctothorpe.uk/2017/cracking-truecrypt-volumes-with-john-the-ripper.html
no wins.
some headway
http://elara.pg/data/User/rsauns/home/document/pw.txt
What do computers eat when they get hungry?
top google answer: chips
tried ssh: nope.
ssh rsauns@elara.pg
rsauns@elara.pg's password:
Permission denied, please try again.
rsauns@elara.pg's password:
Permission denied, please try again.
rsauns@elara.pg's password:
rsauns@elara.pg: Permission denied (publickey,password).
tried: chips, computerchips, megabytes
try smb: also nope.
smbmap -H elara.pg -u rsauns -p chips
[+] Guest session IP: elara.pg:445 Name: unknown
Disk Permissions Comment
---- ----------- -------
print$ NO ACCESS Printer Drivers
DataDump NO ACCESS
IPC$ NO ACCESS IPC Service (fileserver01 server (Samba, Ubuntu))
password also doesn’t work on kod.
http://elara.pg/data/User/rsauns/home/document/teeworlds_server.cfg
sv_name pwnysauns
sv_map dm1
sv_scorelimit 20
sv_timelimit 10
sv_gametype dm
sv_rcon_password remember
sv_motd Welcome to pwnysauns kingdom
sv_max_clients 12
sv_spectator_slots 10
sv_register 0
logfile "C:\Users\rsauns\AppData\Roaming\Teeworlds\teeworlds.log"