CyberSecLabs – “Lazy” Walkthrough

Lazy from CyberSecLabs is a quick and excellent beginner box that only requires a few skills to achieve root. Basic nmap scanning, service enumeration, and exploitation through Metasploit. No privilege escalation required, and it does have a lazy feel to it.

Lazy’s IP address is 172.31.1.1

Scanning

I start with a Nmap scan running default scripts, and service enumeration against the target’s IP address.

Nmap shows SSH, HTTP, and SMB ports open. SSH isn’t a typical entry point for most beginner boxes, its mostly used after you’ve either obtained credentials, or cracked a password hash. HTTP obviously hosts a web server, in this case Nginx 1.1.19. Lastly, we have the SMB ports of 139 and 445.

Service Enumeration

I start with checking out the Nginx web server on port 80.

Not much there to be honest. We could run Nikto, and further enumerate Nginx. Which I did and didn’t find anything interesting.

That leaves us with SMB. If you look back at the original nmap scan, in the Host-script results section. There we see the Samba version is 3.6.25.

I ran a nmap script to enumerate shares against the target. Which revealed a \home\Public share that we can read/write to with anonymous access enabled.

Let’s confirm our Nmap results are accurate with Smbmap.

Smbmap is making a connection with a “” or blank user and a blank password, which otherwise equals anonymous user access. In the Public folder we have Read/Write access. This confirms the Nmap script results.

Exploitation

I start by running Searchsploit for Samba 3.6.25. If you don’t get the same result, try updating the Searchsploit repository with the –update switch.

Awesome we have a Metasploit module. The ‘is_known_pipename’ exploit loads a hacked library file into a vulnerable samba server and provides a reverse shell. There are a few requirements for this module to work properly.

• A writable samba share is required or valid credentials to a samba share that allows write access to the share.
• Knowledge of the server side location path of the writable share.

We have a writable share, \home\Public and we know that we can access the share anonymous thus providing valid credentials. Given our Nmap, and Smbmap results we have satisfied all the requirements to run the exploit successfully.

Fire up msfconsole and search for “is_known_pipename”.

Load the is_known_pipename module. Set the module parameters, in this case all that’s needed is the RHOSTS IP address.

Run the exploit. The payload is uploaded to \\172.31.1.1\Public\ and shortly after a command shell session is opened. We’ve got our reverse shell.

It’s a crappy shell, just a blank cursor, the first thing we want to do is upgrade it and spawn python bash prompt. Always keep this command handy, or better yet memorize it.

python -c ‘import pty;pty.spawn(“/bin/bash”)’

Notice now we have nice root@lazy prompt!

Capture all the flags!

There you have it. Nice and easy. With only a couple of tools, and a few techniques we achieved root. Lazy and Eternal from CyberSecLabs are the boxes you should start with if you are new to pentesting or CTFs.