Bratarina Walkthrough (Practice)

Keyword: SMPT vul, wget without http, Add new user to /etc/passwd

Started with port scanning, web server , smb, smtp and ssh were open

I scanned the web directories but nothing was useful. I sacnned SMB and found some shared drive (backups)

I used smbclient to connect without password and managed to have access. There was passwd.bak file.

That was everything I could get from SMB, I moved my attention to SMPT, the smpt version is OPENSMTP, i searched for a vulnerability and there was one RCE

The exploit enabled use to run a command

I had two attack vectors here to use this vulnerbality:

1. Reverse shell:

I tried it with nc, but no shell was recevied

I also tried with msfvenom, but did not work either.

Notice that wget here does not need http

2. Password

Since the first attack surface was not successful, I moved to the next one.

I will edit the passwd.back, add new user, upload it back to the machine to replace /etc/passwd and then use the new user to have access.