[Tut] How I used Enum4linux to Gain a Foothold Into the Target Machine (TryHackMe)

[xSicKxBot]

How I used Enum4linux to Gain a Foothold Into the Target Machine (TryHackMe)

5/5 – (1 vote)

Enum4linux is a software utility designed to extract information from both Windows and Samba systems. Its primary objective is to provide comparable functionality to the now-defunct enum.exe tool, which was previously accessible at www.bindview.com. Enum4linux is coded in PERL and essentially functions as an interface for the Samba toolset, including smbclient, rpclient, net, and nmblookup.

CHALLENGE OVERVIEW

• CTF Creator: John Hammond
  
  
• Link: Basic Pentesting
  
  
• Difficulty: Easy 
  
  
• Target: user flag and final flag
  
  
• Highlight: extracting credentials from an SMB server with SMBmap
  
  
• Tools used:
  Code:

  nmap
  ,
  Code:

  dirb
  ,
  Code:

  enum4linux
  ,
  Code:

  john
  ,
  Code:

  hydra
  ,
  Code:

  linpeas
  ,
  Code:

  ssh
  
  
• Tags: security, boot2root, cracking, webapp
  

BACKGROUND



This is a pretty standard type of CTF challenge that involves some recon, gaining an initial foothold, lateral privilege escalation, and discovery of the flags.

It was a great way to review how to use the standard pentesting tools (i.e.,

Code:

nmap

,

Code:

dirb

,

Code:

smbmap

,

Code:

john

,

Code:

hydra

).

If you are just starting with CTF challenges, you may find some of the tools and concepts to be a bit more technical. Please check out the video walkthrough if anything is unclear in this write-up! 

ENUMERATION/RECON

Code:

IP ADRESSES

Code:

export targetIP=10.10.192.10 export myIP=10.6.2.23

ENUMERATION

Code:

NMAP SCAN

Code:

nmap -A -p- -T4 -oX nmap.txt $targetIP

• Code:

  -A
  Enable OS detection, version detection, script scanning, and traceroute
  
  
• Code:

  -p-
  scan all ports
  
  
• Code:

  -T4
  speed 4 (1-5 with 5 being the fastest)
  
  
• Code:

  -oX
  output as an XML-type file
  

DIRB SCAN

Code:

dirb http://$targetIP -o dirb.txt

• Code:

  -o
  output as
  Code:

  <filename>

WALK THE WEBSITE



Check our dev note section if you need to know what to work on. (I found a hint in sourcecode)

Code:

http://10.10.192.10/development/

Reading through these two documents, we learn the following interesting things:

• User “J” has a weak password hash in /etc/shadow that can be cracked easily!
  
  
• We may be able to find an exploit for REST version 2.5.12 
  

Searching through

Code:

exploit-db

we find two possibilities:

1. https://www.exploit-db.com/exploits/45068
   
   
2. https://www.exploit-db.com/exploits/42627 (this one is probably it!)
   

I tried out this python exploit, but didn’t have any luck. Let’s move forward for now and enumerate the SMB server.

ENUMERATING SMB    

Code:

smbmap -a $targetIP

We see a listing for an anonymous login in our results. However, we aren’t able to log in as

Code:

anonymous

.

USING ENUM4LINUX TO EXTRACT SSH LOGIN CREDENTIALS

Code:

enum4linux -a 10.10.192.10

Code:

-a

  Do all simple enumeration (

Code:

-U -S -G -P -r -o -n -i

)





found users:

Code:

kay

and

Code:

jan

My guess is that our first user credential with the easy hash will be for user

Code:

jan

because the hidden file

Code:

j.txt

in the

Code:

/development

folder was written to “

Code:

J

”.

USING HYDRA TO BRUTEFORCE A PASSWORD FOR JAN/KAY

Code:

hydra -l jan -t 4 -P /home/kalisurfer/hacking-tools/rockyou.txt ssh://10.10.192.10 hydra -l kay -P /home/kalisurfer/hacking-tools/rockyou.txt ssh://10.10.192.10 discovered password for jan: armando

LOCAL RECON – LOG IN AS JAN VIA SSH



We’ll automate our local recon with

Code:

linpeas.sh

To get the script on our target system, we spin up a simple python3 HTTP server on our attack box and use

Code:

wget

to copy it to the

Code:

/tmp

directory of our target system.

After running

Code:

linpeas.sh

we review our results and found a hidden ssh key for user kay. Our next step is to prep and crack the hash to discover the hash password needed for logging in as user kay.





LATERAL PRIVILEGE ESCALATION TO USER KAY

First we’ll use

Code:

ssh2john

to prep the hash to use with John the RIpper. 



Next, we’ll crack the password for the hash with john. 



Now that we’ve brute-forced the password with hashes of the wordlist

Code:

rockyou.txt

, we can go ahead and switch users to kay with the password

Code:

beeswax

.

POST-EXPLOITATION

Locate

Code:

pass.bak

file

Cat to find “final password”



FINAL THOUGHTS



This box showed the power of

Code:

enum4linux

for enumerating Linux machines. We were able to extract two usernames that helped us to brute force our way into the server and gain our initial foothold.

Linpeas also can do similar things, but the big difference between the two is that Linpeas is for local enumeration, and

Code:

enum4linux

is for initial enumeration before gaining a foothold. 

Recommended: Web Hacking 101: Solving the TryHackMe Pickle Rick “Capture The Flag” Challenge