Okay, this is gonna be a quickie. But the box contains a lot of the concepts that are also important in more complex boxes or real-life scenarios. So, let's take a gander.
As always, let's start with a port scan:
Here I didn't use the -v or -A to keep the output simple. The first option (verbose output) is helpful when the scan takes too long, because it gives us useful information during the scan that we can already put to use before the scan is actually finished. The second parameter enables more in-depth scanning, that shows information about the services running at the open ports and the OS of the target.
So, let's go through the ports one-by-one.
Port 21, as nmap says, is the default FTP (File Transfer Protocol) port. FTP is, as the name suggests, used to transfer files. If configured insecurely, the files on an FTP server can be accessed without a password.
If password-less authentication is enabled, the username we have to use is "anonymous":
When the service asks for a password, we just hit "Enter" to indicate we don't want to enter a password.
It seems that anonymous(=passwordless) authentication is enabled. So let's see what files are on the FTP server:
None... Welp, before we check whether we can do other interesting things here, let's check the other ports so we don't miss something.
I cannot overstate the importance of a broad approach when enumerating. You can collect all the information you want on a service, but if you don't check every possible access vector, you might dig yourself into a rabbit hole for hours and don't progress. Sometimes that can be a learning experience, but most of the time it's just frustrating.
So, let's check the next open port, 22. This is used for SSH (Secure SHell), a protocol that allows us to interact with a CLI (Command Line Interface) of a computer over the (inter-)net. This protocol is hard to configure completely unsecure, so it is rarely an initial attack vector. In CTF-scenarios like this, it is often used to provide an access point after a player got low-privileged access, so they don't have to repeat all the steps they did to get there everytime they pause for a while. Sometimes there's a vulnerable version of an SSH server running, which could make a good initial attack vector, but it makes sense to leave checking the SSH port for the end of the enumeration.
For the next part, we need to look at two ports simultaneously, 139 and 445. This combination of ports indicates that there is an SMB (Server Message Block) server running on the target box, which is - similar to FTP - often used for File Sharing over a network. Also similar to FTP, it can be configured to allow passwordless access. When accessing SMB from a Linux machine, the most commonly used tool for that is smbclient. A very low-privilege form of access is listing the available shares. If we are allowed to do that, we can try actually accessing the shares. If not, in all likelihood we won't be allowed to do anything else either. To list the available shares with smbclient, we use the -L option:
Welp, that didn't work. So before we spend hours trying to find a way to access SMB, let's look at the last remaining port: 3632. This is not a standardized port, but thankfully nmap tells us that this port is offering a service called "distccd". A bit of DuckDuckGoing tells us that this is the daemon for distcc. A remote way of compiling, huh? Though useful, it seems a bit dangerous if you ask me. Let's look for existing exploits, we don't have to reinvent the wheel all the time. As it happens, there is a really juicy exploit, with "command execution" in the title - exactly what we need.
On a side note: You don't always need to consult your favorite search engine to find existing exploits. If you have searchsploit, which comes pre-installed with Kali Linux, you can just enter a command like the following in your CLI:
$ searchsploit distcc ----------------------------------------------------------------- Exploit Title | Path ----------------------------------------------------------------- DistCC Daemon - Command Execution (Metasploit)| [...] ----------------------------------------------------------------- Shellcodes: No Result
Anyway, the exploit-db page tells us that there is an existing metasploit module. And while the exploit is relatively easy to pull off, I was too lazy to read in the usage of distcc enough to build it myself, so let's use the metasploit module:
Using show options we can see a list of parameters:
The RPORT parameter is already correctly set, but the RHOSTS parameter needs to be set. Once we have done that, we can execute the exploit:
Ladies and gentlemen, we have a shell. It doesn't really look familiar, though. That's because it's not a tty shell. There are several ways to spawn one, but I prefer to use python, as I like the programming language, a python interpreter is present on most Linux machines and the command is relatively easy to remember:
That looks a whole lot better, doesn't it? Now, let's take a look around the file system:
And there we have our user flag! As for the rationale what we did here:
We enumerated the directory we landed in, but found nothing of interest. We then went to the "/home" directory to look through the home directories of all the users. The home directory of user "ftp" was empty, but the home directory of the user "makis" finally contained the user flag. The other two user folders might become interesting during the next step, privilege escalation. For that step, though, I have a preferred order of enumerating possible attack surfaces.
Let's first check if we can execute any commands as "root", using "sudo":
If we had the rights to use sudo for any specific command, using the -l parameter would tell us right away, without asking for password. So this isn't it.
The next step would be looking for executable files with the SUID bit set, using find:
If you wanna know why this step makes sense, or how the parameters for the find command came together, I recommend you read my Write-Up of OverTheWire's "Bandit".
Not much out of the ordinary, but one thing should always pique your interest: nmap. Older versions of nmap, specifically versions 2.02 through 5.21, have an "interactive" mode which can help us get a root shell.
Let's check the installed nmap version:
Bingo! Now let's use the interactive mode to escalate our privileges:
We are still user daemon, but our euid (Effective User ID) is that of root, so everything we do is with the privileges of root. The root flag is usually in the "/root" directory, so let's look for it there:
And we have our root flag! Told you this would be quick, didn't I?
Thorough enumeration and information gathering are core concepts of hacking. If you have these basics down, the other steps become all the easier. So make sure to practice those skills!