[Tut] How I used Enum4linux to Gain a Foothold Into the Target Machine (TryHackMe)

[Tut] How I used Enum4linux to Gain a Foothold Into the Target Machine (TryHackMe) - Printable Version

+- Sick Gaming (https://sickgaming.net)
+-- Forum: Programming (https://sickgaming.net/forum-76.html)
+--- Forum: Python (https://sickgaming.net/forum-83.html)
+--- Thread: [Tut] How I used Enum4linux to Gain a Foothold Into the Target Machine (TryHackMe) (/thread-100772.html)

[Tut] How I used Enum4linux to Gain a Foothold Into the Target Machine (TryHackMe) - xSicKxBot - 02-19-2023

How I used Enum4linux to Gain a Foothold Into the Target Machine (TryHackMe)

5/5 – (1 vote)

Enum4linux is a software utility designed to extract information from both Windows and Samba systems. Its primary objective is to provide comparable functionality to the now-defunct enum.exe tool, which was previously accessible at www.bindview.com. Enum4linux is coded in PERL and essentially functions as an interface for the Samba toolset, including smbclient, rpclient, net, and nmblookup.

CHALLENGE OVERVIEW

CTF Creator: John Hammond
Link: Basic Pentesting
Difficulty: Easy
Target: user flag and final flag
Highlight: extracting credentials from an SMB server with SMBmap
Tools used:
Code:
nmap
,
Code:
dirb
,
Code:
enum4linux
,
Code:
john
,
Code:
hydra
,
Code:
linpeas
,
Code:
ssh
Tags: security, boot2root, cracking, webapp

BACKGROUND

[Image: image-267.png]

This is a pretty standard type of CTF challenge that involves some recon, gaining an initial foothold, lateral privilege escalation, and discovery of the flags.

It was a great way to review how to use the standard pentesting tools (i.e.,

Code:
nmap

Code:
dirb

Code:
smbmap

Code:
john

Code:
hydra

).

If you are just starting with CTF challenges, you may find some of the tools and concepts to be a bit more technical. Please check out the video walkthrough if anything is unclear in this write-up!

ENUMERATION/RECON

[Image: image-268.png]

Code:
IP ADRESSES

Code:
export targetIP=10.10.192.10
export myIP=10.6.2.23

ENUMERATION

Code:
NMAP SCAN

Code:
nmap -A -p- -T4 -oX nmap.txt $targetIP

Code:
-A
Enable OS detection, version detection, script scanning, and traceroute
Code:
-p-
scan all ports
Code:
-T4
speed 4 (1-5 with 5 being the fastest)
Code:
-oX
output as an XML-type file

DIRB SCAN

Code:
dirb http://$targetIP -o dirb.txt

Code:
-o
output as
Code:
<filename>

WALK THE WEBSITE

[Image: image-269.png]

Check our dev note section if you need to know what to work on. (I found a hint in sourcecode)

Code:
http://10.10.192.10/development/

Reading through these two documents, we learn the following interesting things:

User “J” has a weak password hash in /etc/shadow that can be cracked easily!
We may be able to find an exploit for REST version 2.5.12

Searching through

Code:
exploit-db

we find two possibilities:

https://www.exploit-db.com/exploits/45068
https://www.exploit-db.com/exploits/42627 (this one is probably it!)

I tried out this python exploit, but didn’t have any luck. Let’s move forward for now and enumerate the SMB server.

ENUMERATING SMB

Code:
smbmap -a $targetIP

We see a listing for an anonymous login in our results. However, we aren’t able to log in as

Code:
anonymous

.

USING ENUM4LINUX TO EXTRACT SSH LOGIN CREDENTIALS

[Image: image-270.png]

Code:
enum4linux -a 10.10.192.10

Code:
-a

Do all simple enumeration (

Code:
-U -S -G -P -r -o -n -i

)

found users:

Code:
kay

and

Code:
jan

My guess is that our first user credential with the easy hash will be for user

Code:
jan

because the hidden file

Code:
j.txt

in the

Code:
/development

folder was written to “

Code:
J

”.

USING HYDRA TO BRUTEFORCE A PASSWORD FOR JAN/KAY

Code:
hydra -l jan -t 4 -P /home/kalisurfer/hacking-tools/rockyou.txt ssh://10.10.192.10
hydra -l kay -P /home/kalisurfer/hacking-tools/rockyou.txt ssh://10.10.192.10 discovered password for jan: armando

LOCAL RECON – LOG IN AS JAN VIA SSH

[Image: image-271.png]

We’ll automate our local recon with

Code:
linpeas.sh

To get the script on our target system, we spin up a simple python3 HTTP server on our attack box and use

Code:
wget

to copy it to the

Code:
/tmp

directory of our target system.

After running

Code:
linpeas.sh

we review our results and found a hidden ssh key for user kay. Our next step is to prep and crack the hash to discover the hash password needed for logging in as user kay.

[Image: image-261.png]

LATERAL PRIVILEGE ESCALATION TO USER KAY

First we’ll use

Code:
ssh2john

to prep the hash to use with John the RIpper.

[Image: image-263.png]

Next, we’ll crack the password for the hash with john.

[Image: image-264.png]

Now that we’ve brute-forced the password with hashes of the wordlist

Code:
rockyou.txt

, we can go ahead and switch users to kay with the password

Code:
beeswax

.

POST-EXPLOITATION

Locate

Code:
pass.bak

file

Cat to find “final password”

[Image: image-265.png]

FINAL THOUGHTS

[Image: image-272.png]

This box showed the power of

Code:
enum4linux

for enumerating Linux machines. We were able to extract two usernames that helped us to brute force our way into the server and gain our initial foothold.

Linpeas also can do similar things, but the big difference between the two is that Linpeas is for local enumeration, and

Code:
enum4linux

is for initial enumeration before gaining a foothold.