Postfish
added the IP and hostname to the hosts file for ease. sudo nano /etc/hosts
I then ran nmap to see which ports were open.
$ sudo nmap -sC -Pn -p- postfish.offsec 1 ⨯
Starting Nmap 7.92 ( https://nmap.org ) at 2021-12-21 11:33 EST
Nmap scan report for postfish.offsec (192.168.169.137)
Host is up (0.062s latency).
Not shown: 65528 closed tcp ports (reset)
PORT STATE SERVICE
22/tcp open ssh
| ssh-hostkey:
| 3072 c1:99:4b:95:22:25:ed:0f:85:20:d3:63:b4:48:bb:cf (RSA)
| 256 0f:44:8b:ad:ad:95:b8:22:6a:f0:36:ac:19:d0:0e:f3 (ECDSA)
|_ 256 32:e1:2a:6c:cc:7c:e6:3e:23:f4:80:8d:33:ce:9b:3a (ED25519)
25/tcp open smtp
| ssl-cert: Subject: commonName=ubuntu
| Subject Alternative Name: DNS:ubuntu
| Not valid before: 2021-01-26T10:26:37
|_Not valid after: 2031-01-24T10:26:37
|_smtp-commands: postfish.off, PIPELINING, SIZE 10240000, VRFY, ETRN, STARTTLS, ENHANCEDSTATUSCODES, 8BITMIME, DSN, SMTPUTF8, CHUNKING
|_ssl-date: TLS randomness does not represent time
80/tcp open http
|_http-title: Site doesn't have a title (text/html).
110/tcp open pop3
|_pop3-capabilities: USER RESP-CODES UIDL TOP CAPA AUTH-RESP-CODE STLS SASL(PLAIN) PIPELINING
| ssl-cert: Subject: commonName=ubuntu
| Subject Alternative Name: DNS:ubuntu
| Not valid before: 2021-01-26T10:26:37
|_Not valid after: 2031-01-24T10:26:37
|_ssl-date: TLS randomness does not represent time
143/tcp open imap
|_imap-capabilities: capabilities listed SASL-IR more STARTTLS IMAP4rev1 AUTH=PLAINA0001 IDLE have post-login ID LOGIN-REFERRALS LITERAL+ Pre-login ENABLE OK
| ssl-cert: Subject: commonName=ubuntu
| Subject Alternative Name: DNS:ubuntu
| Not valid before: 2021-01-26T10:26:37
|_Not valid after: 2031-01-24T10:26:37
|_ssl-date: TLS randomness does not represent time
993/tcp open imaps
| ssl-cert: Subject: commonName=ubuntu
| Subject Alternative Name: DNS:ubuntu
| Not valid before: 2021-01-26T10:26:37
|_Not valid after: 2031-01-24T10:26:37
|_ssl-date: TLS randomness does not represent time
|_imap-capabilities: capabilities listed ID more IMAP4rev1 AUTH=PLAINA0001 IDLE have post-login LITERAL+ LOGIN-REFERRALS SASL-IR Pre-login ENABLE OK
995/tcp open pop3s
|_pop3-capabilities: USER CAPA PIPELINING RESP-CODES UIDL SASL(PLAIN) TOP AUTH-RESP-CODE
| ssl-cert: Subject: commonName=ubuntu
| Subject Alternative Name: DNS:ubuntu
| Not valid before: 2021-01-26T10:26:37
|_Not valid after: 2031-01-24T10:26:37
|_ssl-date: TLS randomness does not represent time
Nmap done: 1 IP address (1 host up) scanned in 54.85 secondsI noticed we had a website running on port 80. It does not have much information but there is a team page. I have seen a couple of instances where some text in that page may be related to the user's password so I create a dictionary from this page through cewl.
I use this custom dictionary and run it through smtp-user-enum to find available email accounts on the server. This shows us that we have sales and legal.
I also take the team member's names and iterate through common email naming schemes and run this custom dictionary through smtp-user-enum as well. This confirms the accounts naming scheme.
Trying the same username and password I see that sales has the password of sales as well. We use this information to find an email on their inbox about a password reset email that will be coming in the future.
We send an email to the user with a link for them to reset their password.
sendemail -t [email protected] -f [email protected] -s postfish.off -u "Password Reset" -o tls=no
we get a call back with the user's password
We can then login through ssh as brian
Running LSE I notice a non-usual file that we have access to (/etc/postfix/disclaimer)
Reading about this file and reading the other files called within it we can derive that these files add a disclaimer text to the outgoing emails from two accounts ([email protected] and [email protected]). With this information we can try a POC.
I edit the /etc/postfix/disclaimer file and add the command
and send an email to [email protected] as we did before. As soon as I do, I get a ping packet on my machine (sudo tcpdump ip proto \\icmp -i tun0)
Using this information we modify our file once more and do a reverse shell to our kali box.
Now we have shell access, but this time as the 'filter' user. On here we see that sudo -l gives us sudo access to the /usr/bin/mail.
Looking for 'mail' in GTFObins we see how to take advantage of this command and easily privesc with sudo mail --exec='!/bin/sh'
Last updated