5

So I am doing a pentesting/CTF exercise against a very closed system. Only ports 22 (ssh) and 80(unidentified web server) are open. System is Linux.

SSH at least reports an up to date version with no remote vulnerabilities. The web server gives no identifying information what so ever, has nothing enabled, and only returns a 404.

I have performed some vulnerability scans against the host, and not a single finding was found.

The goal of the CTF is to gain root, and gain access to 'Tony Starks' encrypted ironman suit plans, and reverse the encryption.

Along with that goal, a dictionary of top 1000 passwords was provided. I've taken that as a hint that there could be a user with a username somehow based on or related to Tony Stark, trying variations like tonystark, tstark, starkt etc and using hydra with such usernames and the provided dictionary.

So far I have had no luck. I am currently stumped by the complete lack of info and available 'surface area' to attack, and I'm not sure how to proceed further.

Would anyone have some suggestions for further things I could try, or avenues to look investigate?

  • The KI Tony stark programmed may have a login itself. Also, have you tried root?:) – Tobi Nary Sep 12 '17 at 20:22
  • 1
    Yup tried root, no go – James Bolson Sep 12 '17 at 20:35
7

As with all things penetration testing, enumeration is absolutely critical.

Based on what you've told me, if I were in your situation I would do the following (assuming you have not already).

  • Ensure you run an nmap scan against all TCP ports

    nmap -sV -A host -p 1-65535

  • Scan UDP ports - this will take a while but perhaps you have an unauthenticated TFTP server you can try to exploit

  • Run a Nikto scan against the web server - I assume you already did this based on your comment stating that the web server gives no information whatsoever but do it just in case.

    nikto -h http://host

  • Run a dirb scan on the web host to see if you can find some previously unknown directories. You may also choose to use your top 1000 password file as a potential wordlist for this.

    dirb http://host -w /usr/share/dirb/wordlists/big.txt

  • See what HTTP methods are allowed on the web server - is PUT or UPLOAD allowed?

    curl -X OPTIONS http://host -i

  • Try an additional "primary enumeration" tool - instead of nmap, try Sparta which is a wrapper around basic tools which can automatically launch attacks, brute forces etc on detected services

  • Try running the HTTP-Enum nmap script to see if you can find any additional information that might be useful.

    nmap -sV --script=http-enum

  • Try enumerating SSH users if possible - metasploit has a scanner for this

    auxiliary/scanner/ssh/ssh_enumusers

Even though it looks grim now keep pushing forward and keep enumerating your target. The better your enumeration techniques and skills the more likely you are to find a hole to exploit.

  • Thanks for your answer! I should have been more clear with what I tried. I did try a full port scan, including UDP, I ran Nikto, tested for HTTP methods with an nmap script and none are enabled, tried the enum script..feeling lost, but will try dirb and the metasploit module for enumerating users. Thanks! – James Bolson Sep 12 '17 at 20:34
  • @JamesBolson I assume you looked for a robots.txt file as well (this would have shown up in the nikto scan). Is this box publicly available? You've piqued my interest... – DKNUCKLES Sep 12 '17 at 23:51
  • yep looked at robots.txt, does not exist. I did find the webserver gives a 400 error on /users, so there is something there, but I have not been able to figure out paramters yet. Also found a http login form on port 10010, but haven't been able to brute force anything yet. No other directories or anything as far as I can tell. I am a development intern and this was setup internally as a bit of fun, so it isn't publicly available sorry :( – James Bolson Sep 13 '17 at 12:46
  • @JamesBolson Changing your user agent might yield different results for the /users folder. View the source of the login form to see if it yields any results and test for potentially fruitful attacks such as SQLi, LFI, RFI etc. Be sure to check the HTTP options on the 10010 login page too. – DKNUCKLES Sep 13 '17 at 14:00
  • /users seems to be a script since ti returns 'missing required parameter', but I have yet to find a legitimate parameter. – James Bolson Sep 13 '17 at 15:50
1

One suggestion (that I just learned myself, since I'm a beginner at this, too) is to use cewl to generate a topical wordlist. Try slurping the IMDB pages, especially the "cast" and "quotes" and pages for the movies. Be sure to set cewl to a depth of 0, because IMDB is full of links to everything.

0

/users seems to be a script since ti returns 'missing required parameter', but I have yet to find a legitimate parameter

smells like blind SQL injection maybe try sqlmap as I think maybe this app behind server is running root database user (getting it from the contest of the task).

http login form

If you have some info on admin or other user try XSS session steeling.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.