Skip to main content

THM | Network Services 2

· 9 min read

Network Exploitation Basics | Network Services 2 | Summary:​

This series of walkthroughs aims to help out complete beginners with finishing the Complete Beginner path on the TryHackMe website. It is based on the learning content provided in the Network Services 2 room.

Disclaimer: Please note that this write-up is NOT intended to replace the original room or its content, but rather serve as supplementary material for those who are stuck and need additional guidance.

Task | 01 | Get Connected​

Question 1: Ready? Let's get going!

No answer needed

Task | 02 | Understanding NFS​

Question 1: What does NFS stand for?

Network File System

Question 2: What process allows an NFS client to interact with a remote directory as though it was a physical device?

Mounting

Question 3: What does NFS use to represent files and directories on the server?

file handle

Question 4: What protocol does NFS use to communicate between the server and client?

RPC

Question 5: What two pieces of user data does the NFS server take as parameters for controlling user permissions? Format: parameter 1 / parameter 2

user id / group id

Question 6: Can a Windows NFS server share files with a Linux client? (Y/N)

Y

Question 7: Can a Linux NFS server share files with a MacOS client? (Y/N)

Y

Question 8: What is the latest version of NFS? [released in 2016, but is still up to date as of 2020] This will require external research.

4.2

Task | 03 | Enumerating NFS​

Question 1: Conduct a thorough port scan scan of your choosing, how many ports are open?

7

Question 2: Which port contains the service we're looking to enumerate?

2049

Question 3: Now, use /usr/sbin/showmount -e [IP] to list the NFS shares, what is the name of the visible share?

/home

Question 4: Time to mount the share to our local machine! First, use mkdir /tmp/mount to create a directory on your machine to mount the share to. This is in the /tmp directory- so be aware that it will be removed on restart. Then, use the mount command we broke down earlier to mount the NFS share to your local machine. Change directory to where you mounted the share- what is the name of the folder inside?

cappucino

Question 5: Have a look inside this directory, look at the files. Looks like we're inside a user's home directory...

No answer needed

Question 6: Interesting! Let's do a bit of research now, have a look through the folders. Which of these folders could contain keys that would give us remote access to the server?

.ssh

Question 7: Which of these keys is most useful to us?

id_rsa

Question 8: Copy this file to a different location your local machine, and change the permissions to "600" using chmod 600 [file]. Assuming we were right about what type of directory this is, we can pretty easily work out the name of the user this key corresponds to. Can we log into the machine using ssh -i <key-file> <username>@<ip> ? (Y/N)

Y

Task | 04 | Exploiting NFS​

Question 1: First, change directory to the mount point on your machine, where the NFS share should still be mounted, and then into the user's home directory.

No answer needed

Question 2: Download the bash executable to your Downloads directory. Then use "cp ~/Downloads/bash ." to copy the bash executable to the NFS share. The copied bash shell must be owned by a root user, you can set this using sudo chown root bash

No answer needed

Question 3: Now, we're going to add the SUID bit permission to the bash executable we just copied to the share using sudo chmod +[permission] bash. What letter do we use to set the SUID bit set using chmod?

s

Question 4: Let's do a sanity check, let's check the permissions of the "bash" executable using ls -la bash. What does the permission set look like? Make sure that it ends with -sr-x.

-rwsr-sr-x

Question 5: Now, SSH into the machine as the user. List the directory to make sure the bash executable is there. Now, the moment of truth. Lets run it with ./bash -p. The -p persists the permissions, so that it can run as root with SUID- as otherwise bash will sometimes drop the permissions.

No answer needed

Question 6: Great! If all's gone well you should have a shell as root! What's the root flag?

<flag>

Task | 05 | Understanding SMTP​

Question 1: What does SMTP stand for?

Simple Mail Transfer Protocol

Question 2: What does SMTP handle the sending of? (answer in plural)

emails

Question 3: What is the first step in the SMTP process?

SMTP handshake

Question 4: What is the default SMTP port?

25

Question 5: Where does the SMTP server send the email if the recipient's server is not available?

smtp queue

Question 6: On what server does the Email ultimately end up on?

POP/IMAP

Question 7: Can a Linux machine run an SMTP server? (Y/N)

Y

Question 8: Can a Windows machine run an SMTP server? (Y/N)

Y

Task | 06 | Enumerating SMTP​

Question 1: First, lets run a port scan against the target machine, same as last time. What port is SMTP running on?

25

Question 2: Okay, now we know what port we should be targeting, let's start up Metasploit. What command do we use to do this? If you would like some more help or practice using Metasploit, TryHackMe has a module on Metasploit that you can check out here

msfconsole

Question 3: Let's search for the module "smtp_version", what's it's full module name?

auxiliary/scanner/smtp/smtp_version

Question 4: Great, now- select the module and list the options. How do we do this?

options

Question 5: Have a look through the options, does everything seem correct? What is the option we need to set?

RHOSTS

Question 6: Set that to the correct value for your target machine. Then run the exploit. What's the system mail name?

polosmtp.home

Question 7: What Mail Transfer Agent (MTA) is running the SMTP server? This will require some external research.

Postfix

Question 8: Good! We've now got a good amount of information on the target system to move onto the next stage. Let's search for the module "smtp_enum", what's it's full module name?

auxiliary/scanner/smtp/smtp_enum

Question 9: We're going to be using the "top-usernames-shortlist.txt" wordlist from the Usernames subsection of seclists (/usr/share/wordlists/SecLists/Usernames if you have it installed). Seclists is an amazing collection of wordlists. If you're running Kali or Parrot you can install seclists with: sudo apt install seclists. Alternatively, you can download the repository from here. What option do we need to set to the wordlist's path?

USER_FILE

Question 10: Once we've set this option, what is the other essential paramater we need to set?

RHOSTS

Question 11: Now, run the exploit, this may take a few minutes, so grab a cup of tea, coffee, water. Keep yourself hydrated!

No answer needed

Question 12: Okay! Now that's finished, what username is returned?

administrator

Task | 07 | Exploiting SMTP​

Question 1: What is the password of the user we found during our enumeration stage?

alejandro

Question 2: Great! Now, let's SSH into the server as the user, what is contents of smtp.txt

<flag>

Task | 08 | Understanding MySQL​

Question 1: What type of software is MySQL?

relational database management system

Question 2: What language is MySQL based on?

SQL

Question 3: What communication model does MySQL use?

client-server

Question 4: What is a common application of MySQL?

back end database

Question 5: What major social network uses MySQL as their back-end database? This will require further research.

Facebook

Task | 09 | Enumerating MySQL​

Question 1: As always, let's start out with a port scan, so we know what port the service we're trying to attack is running on. What port is MySQL using?

3306

Question 2: Good, now- we think we have a set of credentials. Let's double check that by manually connecting to the MySQL server. We can do this using the command mysql -h [IP] -u [username] -p

No answer needed

Question 3: Okay, we know that our login credentials work. Lets quit out of this session with exit and launch up Metasploit.

No answer needed

Question 4: We're going to be using the mysql_sql module. Search for, select and list the options it needs. What three options do we need to set? (in descending order).

PASSWORD/RHOSTS/USERNAME

Question 5: Run the exploit. By default it will test with the select version() command, what result does this give you?

5.7.29-0ubuntu0.18.04.1

Question 6: Great! We know that our exploit is landing as planned. Let's try to gain some more ambitious information. Change the sql option to show databases. How many databases are returned?

4

Task | 10 | Exploiting MySQL​

Question 1: First, let's search for and select the mysql_schemadump module. What's the module's full name?

auxiliary/scanner/mysql/mysql_schemadump

Question 2: Great! Now, you've done this a few times by now so I'll let you take it from here. Set the relevant options, run the exploit. What's the name of the last table that gets dumped?

x$waits_global_by_latency

Question 3: Awesome, you have now dumped the tables, and column names of the whole database. But we can do one better... search for and select the mysql_hashdump module. What's the module's full name?

auxiliary/scanner/mysql/mysql_hashdump

Question 4: Again, I'll let you take it from here. Set the relevant options, run the exploit. What non-default user stands out to you?

carl

Question 5: Another user! And we have their password hash. This could be very interesting. Copy the hash string in full, like: bob:*HASH to a text file on your local machine called "hash.txt". What is the user/hash combination string?

carl:*EA031893AA21444B170FC2162A56978B8CEECE18

Question 6: Now, we need to crack the password! Let's try John the Ripper against it using: john hash.txt. What is the password of the user we found?

doggie

Question 7: Awesome. Password reuse is not only extremely dangerous, but extremely common. What are the chances that this user has reused their password for a different service? What's the contents of MySQL.txt

<flag>

Task | 11 | Further Learning​

Question 1: Congratulations! You did it!

No answer needed