----- / \ ) | :================: " )/ /|| || )_ /* / || System || * | || Down || (=====~*~======) \ || Please wait || 0 \ / 0 ================== // (====*====) || ........... / \............. // * || :\ ############ \ || (=====*======) || : --------------------------------- V * V : | * |__________|| :::::::::: | o (======*=======) o \ | | || ....... | \\ * || --------------------------------- 8 || (=====*======) // 8 V * V --------------------------------- 8 =|=; (==/ * \==) =|= \ ########################### \ / ! \ _ * __ / | \ \ +++++++++++++++++++++++++++ \ ! ! ! (__/ \__) ! ! ! \ ++++++++++++++++++++++++++++ \ 0 \ \V/ / 0 \________________________________\ () \o o/ () ********************************* () () EW GET IT ?!?!?! THE GUY IS WAITING FOR THE MACHINE AND HE'S A SKELETON BECAUSE HE DIED AND DECAYED HE WAS WAITING SO LONG !!!! STILL DON'T GET IT ??? HERE LET ME DRAW A DIAGRAM ::: _ _ __ __ _____ _____________________________|\ | | / \ | \/ | ____| | \ | | / _ \ | |\/| | _| |_____________________________ / | |___ / ___ \| | | | |___ |/ |_____/_/ \_\_| |_|_____| tQn

This box was pretty easy, even easier with using Metasploit.

  • Don’t go down the rabbit hole with Port 21.
  • There are some other writeups that use smbclient -L 10.10.10.3 to find an exploit. Back in the day I was able to find the user.txt by connecting //10.10.10.3/tmp using anonymous login, but it seems it has been patched, as now I am receiving an error: 
    protocol negotiation failed: NT_STATUS_CONNECTION_DISCONNECTED



1) Scanned and saw that on port 21 you are able to log into the FTP service using anonymous login. Also port 445 Samba smbd service specifies a version on which we will search for vulnerabilties. NMAP

2) Was able to FTP with the anonymous login (press enter for password), after looking through the directories I did not find anything special. FTP

3) Found an exploit for Samba smbd version 3.0.20 - be sure to install the required pysmb depenedencies. https://raw.githubusercontent.com/amriunix/CVE-2007-2447/master/usermap_script.py whoami

4) Ran the usermap_script.py exploit and was able to get a root reverse shell. Found the user.txt and root.txt.

Once connected with a reverse shell and if python is installed on the victim’s machine, you can make the shell interactive with the following command:

python -c 'import pty; pty.spawn("/bin/sh")'

reverseShell
user
root