-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathstapler1.html
4000 lines (3664 loc) · 221 KB
/
stapler1.html
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta name="description" content="">
<meta http-equiv="X-UA-Compatible" content="IE=edge">
<meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no">
<!-- The above 4 meta tags *must* come first in the head; any other head content must come *after* these tags -->
<!-- Title -->
<title>Gandosha - Autodidacticism.</title>
<!-- Core Stylesheet -->
<link rel="stylesheet" href="style.css">
</head>
<body>
<!-- Preloader -->
<div id="preloader">
<div class="loader"></div>
</div>
<div class="vcard-main-wrapper">
<div class="vcard-content-wrapper bg-img" style="background-image: url(img/bg-img/bgssss.jpg);">
<!-- Header Area -->
<header class="header_area">
<!-- Logo -->
<div class="logo d-flex justify-content-center align-items-center">
<a href="index-horizontal-about.html"><img src="img/core-img/logo3.png" alt=""></a>
<!-- Navbar Toggle -->
<div class="nav-toggle">
<i class="fa fa-bars"></i>
</div>
</div>
<!-- Menu -->
<ul class="vcard-nav">
<li><a href="https://github.com/Gandosha" data-toggle="tooltip" data-placement="top" title="Github"><i class="fa fa-fw fa-github" aria-hidden="true"></i></a></li>
<li><a href="index.html">About</a></li>
<li class="active"><a href="walkthroughs.html">CTF Walkthroughs</a></li>
<li><a href="cheatsheets.html">Cheat Sheets</a></li>
</ul>
</header>
<!-- Vcard Page Content -->
<div class="vcard-page-content-wrapper d-flex align-items-end">
<div class="page-content">
<!-- ##### VM Title and link ##### -->
<div class="about-me-area section-padding-100 clearfix">
<div class="container-fluid">
<div class="row align-items-end">
<div class="about-me-text">
<hr>
<p><h2>Stapler: 1</h2>
<h8><b>Service discovery --> FTP with anonymous access --> Samba users and shares enumeration --> Web directories fuzzing --> Local File Inclusion --> Webshell upload via mysql --> Privilege Escalation (cronjob manipulation)</b></h8></p>
<h7>VM: https://www.vulnhub.com/entry/stapler-1,150/</h7></p>
<hr>
<br>
<br>
<br>
<br>
<p><h3>Service discovery:</h3></p>
<hr>
<p><font size="3.5" color="black">First, I fired up HaGashash in order to gain some information about which host to attack and what interesting services run there. (https://github.com/Gandosha/HaGashash).</font></p>
<pre style="background-color:black;color:white;">
[GandoPC ~]# go run go/src/github.com/Gandosha/HaGashash/main.go -project=Stapler -subnet=true -interface=enp0s3
<-=|HaGashash by Gandosha|=->
[+] nmap executable is in '/usr/bin/nmap'
[+] ifconfig executable is in '/usr/bin/ifconfig'
[!] Dependencies check is completed successfully.
[!] Starting to scan your subnet.
[+] Alive hosts in 192.168.43.0/24 are:
192.168.43.1
192.168.43.2
192.168.43.10
192.168.43.3
[+] Directory created at: /HaGashash_Projects/Stapler/192.168.43.1.
[!] Starting to scan 192.168.43.1 for TCP interesting stuff.
[!] Starting to scan 192.168.43.1 for UDP interesting stuff.
[+] Directory created at: /HaGashash_Projects/Stapler/192.168.43.2.
[!] Starting to scan 192.168.43.2 for TCP interesting stuff.
[!] Starting to scan 192.168.43.2 for UDP interesting stuff.
[+] Directory created at: /HaGashash_Projects/Stapler/192.168.43.10.
[!] Starting to scan 192.168.43.10 for TCP interesting stuff.
[!] Starting to scan 192.168.43.10 for UDP interesting stuff.
[+] Directory created at: /HaGashash_Projects/Stapler/192.168.43.3.
[!] Starting to scan 192.168.43.3 for UDP interesting stuff.
[!] Starting to scan 192.168.43.3 for TCP interesting stuff.
[+] Nmap's TCP script scanning on 192.168.43.3 is completed successfully.
[+] Nmap's UDP script scanning on 192.168.43.3 is completed successfully.
[+] Nmap's TCP script scanning on 192.168.43.10 is completed successfully.
[+] Nmap's TCP script scanning on 192.168.43.1 is completed successfully.
[+] Nmap's TCP script scanning on 192.168.43.2 is completed successfully.
[+] Nmap's UDP script scanning on 192.168.43.10 is completed successfully.
[+] Nmap's UDP script scanning on 192.168.43.1 is completed successfully.
[+] Nmap's UDP script scanning on 192.168.43.2 is completed successfully.
[+] Summary file for 192.168.43.10 is ready.
[+] Summary file for 192.168.43.1 is ready.
[+] Summary file for 192.168.43.3 is ready.
[+] Summary file for 192.168.43.2 is ready.
[gandosha@GandoPC ~]$ cat /HaGashash_Projects/Stapler/192.168.43.10/nmap_TCP_scan_output
# Nmap 7.70 scan initiated Tue Sep 25 13:16:02 2018 as: nmap -sS -p- -A -T4 -Pn -vv -oN /HaGashash_Projects/Stapler/192.168.43.10/nmap_TCP_scan_output 192.168.43.10
mass_dns: warning: Unable to determine any DNS servers. Reverse DNS is disabled. Try using --system-dns or specify valid servers with --dns-servers
Nmap scan report for 192.168.43.10
Host is up, received arp-response (0.0063s latency).
Scanned at 2018-09-25 13:16:04 IDT for 143s
Not shown: 65523 filtered ports
Reason: 65523 no-responses
PORT STATE SERVICE REASON VERSION
20/tcp closed ftp-data reset ttl 64
21/tcp open ftp syn-ack ttl 64 vsftpd 2.0.8 or later
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
|_Can't get directory listing: PASV failed: 550 Permission denied.
| ftp-syst:
| STAT:
| FTP server status:
| Connected to 192.168.43.3
| Logged in as ftp
| TYPE: ASCII
| No session bandwidth limit
| Session timeout in seconds is 300
| Control connection is plain text
| Data connections will be plain text
| At session startup, client count was 1
| vsFTPd 3.0.3 - secure, fast, stable
|_End of status
22/tcp open ssh syn-ack ttl 64 OpenSSH 7.2p2 Ubuntu 4 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 2048 81:21:ce:a1:1a:05:b1:69:4f:4d:ed:80:28:e8:99:05 (RSA)
| ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDc/xrBbi5hixT2B19dQilbbrCaRllRyNhtJcOzE8x0BM1ow9I80RcU7DtajyqiXXEwHRavQdO+/cHZMyOiMFZG59OCuIouLRNoVO58C91gzDgDZ1fKH6BDg+FaSz+iYZbHg2lzaMPbRje6oqNamPR4QGISNUpxZeAsQTLIiPcRlb5agwurovTd3p0SXe0GknFhZwHHvAZWa2J6lHE2b9K5IsSsDzX2WHQ4vPb+1DzDHV0RTRVUGviFvUX1X5tVFvVZy0TTFc0minD75CYClxLrgc+wFLPcAmE2C030ER/Z+9umbhuhCnLkLN87hlzDSRDPwUjWr+sNA3+7vc/xuZul
| 256 5b:a5:bb:67:91:1a:51:c2:d3:21:da:c0:ca:f0:db:9e (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBNQB5n5kAZPIyHb9lVx1aU0fyOXMPUblpmB8DRjnP8tVIafLIWh54wmTFVd3nCMr1n5IRWiFeX1weTBDSjjz0IY=
| 256 6d:01:b7:73:ac:b0:93:6f:fa:b9:89:e6:ae:3c:ab:d3 (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJ9wvrF4tkFMApswOmWKpTymFjkaiIoie4QD0RWOYnny
53/tcp open domain syn-ack ttl 64 dnsmasq 2.75
| dns-nsid:
|_ bind.version: dnsmasq-2.75
80/tcp open http syn-ack ttl 64 PHP cli server 5.5 or later
| http-methods:
|_ Supported Methods: GET HEAD POST OPTIONS
|_http-title: 404 Not Found
123/tcp closed ntp reset ttl 64
137/tcp closed netbios-ns reset ttl 64
138/tcp closed netbios-dgm reset ttl 64
139/tcp open netbios-ssn syn-ack ttl 64 Samba smbd 4.3.9-Ubuntu (workgroup: WORKGROUP)
666/tcp open doom? syn-ack ttl 64
| fingerprint-strings:
| NULL:
| message2.jpgUT
| QWux
| "DL[E
| #;3[
| \xf6
| u([r
| qYQq
| Y_?n2
| 3&M~{
| 9-a)T
| L}AJ
|_ .npy.9
3306/tcp open mysql syn-ack ttl 64 MySQL 5.7.12-0ubuntu1
| mysql-info:
| Protocol: 10
| Version: 5.7.12-0ubuntu1
| Thread ID: 7
| Capabilities flags: 63487
| Some Capabilities: Support41Auth, InteractiveClient, Speaks41ProtocolNew, SupportsLoadDataLocal, ODBCClient, SupportsCompression, SupportsTransactions, DontAllowDatabaseTableColumn, ConnectWithDatabase, LongPassword, IgnoreSigpipes, FoundRows, LongColumnFlag, IgnoreSpaceBeforeParenthesis, Speaks41ProtocolOld, SupportsMultipleResults, SupportsMultipleStatments, SupportsAuthPlugins
| Status: Autocommit
| Salt: :#x}t ]g\x14\x1A\x07OuH'S@){[
|_ Auth Plugin Name: 88
12380/tcp open http syn-ack ttl 64 Apache httpd 2.4.18 ((Ubuntu))
| http-methods:
|_ Supported Methods: GET HEAD POST OPTIONS
|_http-server-header: Apache/2.4.18 (Ubuntu)
|_http-title: Tim, we need to-do better next year for Initech
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
SF-Port666-TCP:V=7.70%I=7%D=9/25%Time=5BAA0B42%P=x86_64-unknown-linux-gnu%
SF:r(NULL,1000,"PK\x03\x04\x14\0\x02\0\x08\0d\x80\xc3Hp\xdf\x15\x81\xaa,\0
SF:\0\x152\0\0\x0c\0\x1c\0message2\.jpgUT\t\0\x03\+\x9cQWJ\x9cQWux\x0b\0\x
SF:01\x04\xf5\x01\0\0\x04\x14\0\0\0\xadz\x0bT\x13\xe7\xbe\xefP\x94\x88\x88
SF:A@\xa2\x20\x19\xabUT\xc4T\x11\xa9\x102>\x8a\xd4RDK\x15\x85Jj\xa9\"DL\[E
SF:\xa2\x0c\x19\x140<\xc4\xb4\xb5\xca\xaen\x89\x8a\x8aV\x11\x91W\xc5H\x20\
SF:x0f\xb2\xf7\xb6\x88\n\x82@%\x99d\xb7\xc8#;3\[\r_\xcddr\x87\xbd\xcf9\xf7
SF:\xaeu\xeeY\xeb\xdc\xb3oX\xacY\xf92\xf3e\xfe\xdf\xff\xff\xff=2\x9f\xf3\x
SF:99\xd3\x08y}\xb8a\xe3\x06\xc8\xc5\x05\x82>`\xfe\x20\xa7\x05:\xb4y\xaf\x
SF:f8\xa0\xf8\xc0\^\xf1\x97sC\x97\xbd\x0b\xbd\xb7nc\xdc\xa4I\xd0\xc4\+j\xc
SF:e\[\x87\xa0\xe5\x1b\xf7\xcc=,\xce\x9a\xbb\xeb\xeb\xdds\xbf\xde\xbd\xeb\
SF:x8b\xf4\xfdis\x0f\xeeM\?\xb0\xf4\x1f\xa3\xcceY\xfb\xbe\x98\x9b\xb6\xfb\
SF:xe0\xdc\]sS\xc5bQ\xfa\xee\xb7\xe7\xbc\x05AoA\x93\xfe9\xd3\x82\x7f\xcc\x
SF:e4\xd5\x1dx\xa2O\x0e\xdd\x994\x9c\xe7\xfe\x871\xb0N\xea\x1c\x80\xd63w\x
SF:f1\xaf\xbd&&q\xf9\x97'i\x85fL\x81\xe2\\\xf6\xb9\xba\xcc\x80\xde\x9a\xe1
SF:\xe2:\xc3\xc5\xa9\x85`\x08r\x99\xfc\xcf\x13\xa0\x7f{\xb9\xbc\xe5:i\xb2\
SF:x1bk\x8a\xfbT\x0f\xe6\x84\x06/\xe8-\x17W\xd7\xb7&\xb9N\x9e<\xb1\\\.\xb9
SF:\xcc\xe7\xd0\xa4\x19\x93\xbd\xdf\^\xbe\xd6\xcdg\xcb\.\xd6\xbc\xaf\|W\x1
SF:c\xfd\xf6\xe2\x94\xf9\xebj\xdbf~\xfc\x98x'\xf4\xf3\xaf\x8f\xb9O\xf5\xe3
SF:\xcc\x9a\xed\xbf`a\xd0\xa2\xc5KV\x86\xad\n\x7fou\xc4\xfa\xf7\xa37\xc4\|
SF:\xb0\xf1\xc3\x84O\xb6nK\xdc\xbe#\)\xf5\x8b\xdd{\xd2\xf6\xa6g\x1c8\x98u\
SF:(\[r\xf8H~A\xe1qYQq\xc9w\xa7\xbe\?}\xa6\xfc\x0f\?\x9c\xbdTy\xf9\xca\xd5
SF:\xaak\xd7\x7f\xbcSW\xdf\xd0\xd8\xf4\xd3\xddf\xb5F\xabk\xd7\xff\xe9\xcf\
SF:x7fy\xd2\xd5\xfd\xb4\xa7\xf7Y_\?n2\xff\xf5\xd7\xdf\x86\^\x0c\x8f\x90\x7
SF:f\x7f\xf9\xea\xb5m\x1c\xfc\xfef\"\.\x17\xc8\xf5\?B\xff\xbf\xc6\xc5,\x82
SF:\xcb\[\x93&\xb9NbM\xc4\xe5\xf2V\xf6\xc4\t3&M~{\xb9\x9b\xf7\xda-\xac\]_\
SF:xf9\xcc\[qt\x8a\xef\xbao/\xd6\xb6\xb9\xcf\x0f\xfd\x98\x98\xf9\xf9\xd7\x
SF:8f\xa7\xfa\xbd\xb3\x12_@N\x84\xf6\x8f\xc8\xfe{\x81\x1d\xfb\x1fE\xf6\x1f
SF:\x81\xfd\xef\xb8\xfa\xa1i\xae\.L\xf2\\g@\x08D\xbb\xbfp\xb5\xd4\xf4Ym\x0
SF:bI\x96\x1e\xcb\x879-a\)T\x02\xc8\$\x14k\x08\xae\xfcZ\x90\xe6E\xcb, NetBIOS MAC: (unknown)
| Names:
| RED<00> Flags:
| RED<03> Flags:
| RED<20> Flags:
| \x01\x02__MSBROWSE__\x02<01> Flags:
| WORKGROUP<00> Flags:
| WORKGROUP<1d> Flags:
| WORKGROUP<1e> Flags:
| Statistics:
| 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
| 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|_ 00 00 00 00 00 00 00 00 00 00 00 00 00 00
| p2p-conficker:
| Checking for Conficker.C or higher...
| Check 1 (port 34093/tcp): CLEAN (Timeout)
| Check 2 (port 56485/tcp): CLEAN (Timeout)
| Check 3 (port 25126/udp): CLEAN (Timeout)
| Check 4 (port 2249/udp): CLEAN (Failed to receive data)
|_ 0/4 checks are positive: Host is CLEAN or ports are blocked
| smb-os-discovery:
| OS: Windows 6.1 (Samba 4.3.9-Ubuntu)
| Computer name: red
| NetBIOS computer name: RED\x00
| Domain name: \x00
| FQDN: red
|_ System time: 2018-09-25T14:17:50+01:00
| smb-security-mode:
| account_used: guest
| authentication_level: user
| challenge_response: supported
|_ message_signing: disabled (dangerous, but default)
| smb2-security-mode:
| 2.02:
|_ Message signing enabled but not required
| smb2-time:
| date: 2018-09-25 16:17:50
|_ start_date: N/A
TRACEROUTE
HOP RTT ADDRESS
1 6.32 ms 192.168.43.10
Read data files from: /usr/bin/../share/nmap
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Tue Sep 25 13:18:27 2018 -- 1 IP address (1 host up) scanned in 146.83 seconds
</pre>
<hr>
<br>
<br>
<p><h3>Port 21 check:</h3></p>
<hr>
<p><font size="3.5" color="black">Attempt to access FTP with anonymous creds (U:anonymous,P:anonymous):</font></p>
<pre style="background-color:black;color:white;">
[GandoPC 192.168.43.10]# ftp 192.168.43.10
Connected to 192.168.43.10.
220-
220-|-----------------------------------------------------------------------------------------|
220-| Harry, make sure to update the banner when you get a chance to show who has access here |
220-|-----------------------------------------------------------------------------------------|
220-
220
Name (192.168.43.10:root): anonymous
331 Please specify the password.
Password:
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> ls
200 PORT command successful. Consider using PASV.
150 Here comes the directory listing.
-rw-r--r-- 1 0 0 107 Jun 03 2016 note
226 Directory send OK.
ftp> get note
200 PORT command successful. Consider using PASV.
150 Opening BINARY mode data connection for note (107 bytes).
226 Transfer complete.
107 bytes received in 0.00887 seconds (11.8 kbytes/s)
ftp> quit
221 Goodbye.
[GandoPC 192.168.43.10]# cat note
Elly, make sure you update the payload information. Leave it in your FTP account once your are done, John.
[GandoPC 192.168.43.10]# printf 'Elly\nJohn\n' > potential_users
</pre>
<p><font size="3.5" color="black">Got some user names for future brute force attack. I always keep this option as a "last stand" if everything goes wrong.</font></p>
<hr>
<br>
<br>
<p><h3>Port 80 check:</h3></p>
<hr>
<p><font size="3.5" color="black">Attempt to access via http port 80:</font></p>
<img src="img/Stapler1/screenshots/port80/1.png" alt="decode base64 password" style="border:1px solid black;">
<br>
<br>
<p><font size="3.5" color="black">There's nothing here? I tried to use some power in order to discover some content:</font></p>
<img src="img/Stapler1/screenshots/port80/2.png" alt="login page" style="border:1px solid black;">
<br>
<br>
<p><font size="3.5" color="black">NADA :(</font></p>
<p><font size="3.5" color="black">Attempt to access via https port 80:</font></p>
<img src="img/Stapler1/screenshots/port80/3.png" alt="upload" style="border:1px solid black;">
<br>
<br>
<p><font size="3.5" color="black">Nothing here too.</font></p>
<hr>
<br>
<br>
<p><h3>Port 139 check:</h3></p>
<hr>
<p><font size="3.5" color="black">Attempt to enumerate some shares:</font></p>
<pre style="background-color:black;color:white;">
[GandoPC 192.168.43.10]# enum4linux 192.168.43.10
Starting enum4linux v0.8.9 ( http://labs.portcullis.co.uk/application/enum4linux/ ) on Tue Sep 25 14:16:33 2018
==========================
| Target Information |
==========================
Target ........... 192.168.43.10
RID Range ........ 500-550,1000-1050
Username ......... ''
Password ......... ''
Known Usernames .. administrator, guest, krbtgt, domain admins, root, bin, none
=====================================================
| Enumerating Workgroup/Domain on 192.168.43.10 |
=====================================================
[+] Got domain/workgroup name: WORKGROUP
=============================================
| Nbtstat Information for 192.168.43.10 |
=============================================
Looking up status of 192.168.43.10
RED <00> - H Workstation Service
RED <03> - H Messenger Service
RED <20> - H File Server Service
..__MSBROWSE__. <01> - H Master Browser
WORKGROUP <00> - H Domain/Workgroup Name
WORKGROUP <1d> - H Master Browser
WORKGROUP <1e> - H Browser Service Elections
MAC Address = 00-00-00-00-00-00
======================================
| Session Check on 192.168.43.10 |
======================================
[+] Server 192.168.43.10 allows sessions using username '', password ''
============================================
| Getting domain SID for 192.168.43.10 |
============================================
Domain Name: WORKGROUP
Domain Sid: (NULL SID)
[+] Can't determine if host is part of domain or part of a workgroup
=======================================
| OS information on 192.168.43.10 |
=======================================
Use of uninitialized value $os_info in concatenation (.) or string at /usr/bin/enum4linux line 464.
[+] Got OS info for 192.168.43.10 from smbclient:
[+] Got OS info for 192.168.43.10 from srvinfo:
RED Wk Sv PrQ Unx NT SNT red server (Samba, Ubuntu)
platform_id : 500
os version : 6.1
server type : 0x809a03
==============================
| Users on 192.168.43.10 |
==============================
Use of uninitialized value $users in print at /usr/bin/enum4linux line 874.
Use of uninitialized value $users in pattern match (m//) at /usr/bin/enum4linux line 877.
Use of uninitialized value $users in print at /usr/bin/enum4linux line 888.
Use of uninitialized value $users in pattern match (m//) at /usr/bin/enum4linux line 890.
==========================================
| Share Enumeration on 192.168.43.10 |
==========================================
Sharename Type Comment
--------- ---- -------
print$ Disk Printer Drivers
kathy Disk Fred, What are we doing here?
tmp Disk All temporary files should be stored here
IPC$ IPC IPC Service (red server (Samba, Ubuntu))
Reconnecting with SMB1 for workgroup listing.
Server Comment
--------- -------
Workgroup Master
--------- -------
WORKGROUP RED
[+] Attempting to map shares on 192.168.43.10
//192.168.43.10/print$ Mapping: DENIED, Listing: N/A
//192.168.43.10/kathy Mapping: OK, Listing: OK
//192.168.43.10/tmp Mapping: OK, Listing: OK
//192.168.43.10/IPC$ [E] Can't understand response:
NT_STATUS_OBJECT_NAME_NOT_FOUND listing \*
=====================================================
| Password Policy Information for 192.168.43.10 |
=====================================================
[E] Dependent program "polenum.py" not present. Skipping this check. Download polenum from http://labs.portcullis.co.uk/application/polenum/
===============================
| Groups on 192.168.43.10 |
===============================
[+] Getting builtin groups:
[+] Getting builtin group memberships:
[+] Getting local groups:
[+] Getting local group memberships:
[+] Getting domain groups:
[+] Getting domain group memberships:
========================================================================
| Users on 192.168.43.10 via RID cycling (RIDS: 500-550,1000-1050) |
========================================================================
[I] Found new SID: S-1-22-1
[I] Found new SID: S-1-5-21-864226560-67800430-3082388513
[I] Found new SID: S-1-5-32
[+] Enumerating users using SID S-1-5-21-864226560-67800430-3082388513 and logon username '', password ''
S-1-5-21-864226560-67800430-3082388513-500 *unknown*\*unknown* (8)
S-1-5-21-864226560-67800430-3082388513-501 RED\nobody (Local User)
S-1-5-21-864226560-67800430-3082388513-502 *unknown*\*unknown* (8)
S-1-5-21-864226560-67800430-3082388513-503 *unknown*\*unknown* (8)
S-1-5-21-864226560-67800430-3082388513-504 *unknown*\*unknown* (8)
S-1-5-21-864226560-67800430-3082388513-505 *unknown*\*unknown* (8)
S-1-5-21-864226560-67800430-3082388513-506 *unknown*\*unknown* (8)
S-1-5-21-864226560-67800430-3082388513-507 *unknown*\*unknown* (8)
S-1-5-21-864226560-67800430-3082388513-508 *unknown*\*unknown* (8)
S-1-5-21-864226560-67800430-3082388513-509 *unknown*\*unknown* (8)
S-1-5-21-864226560-67800430-3082388513-510 *unknown*\*unknown* (8)
S-1-5-21-864226560-67800430-3082388513-511 *unknown*\*unknown* (8)
S-1-5-21-864226560-67800430-3082388513-512 *unknown*\*unknown* (8)
S-1-5-21-864226560-67800430-3082388513-513 RED\None (Domain Group)
S-1-5-21-864226560-67800430-3082388513-514 *unknown*\*unknown* (8)
S-1-5-21-864226560-67800430-3082388513-515 *unknown*\*unknown* (8)
S-1-5-21-864226560-67800430-3082388513-516 *unknown*\*unknown* (8)
S-1-5-21-864226560-67800430-3082388513-517 *unknown*\*unknown* (8)
S-1-5-21-864226560-67800430-3082388513-518 *unknown*\*unknown* (8)
S-1-5-21-864226560-67800430-3082388513-519 *unknown*\*unknown* (8)
S-1-5-21-864226560-67800430-3082388513-520 *unknown*\*unknown* (8)
S-1-5-21-864226560-67800430-3082388513-521 *unknown*\*unknown* (8)
S-1-5-21-864226560-67800430-3082388513-522 *unknown*\*unknown* (8)
S-1-5-21-864226560-67800430-3082388513-523 *unknown*\*unknown* (8)
S-1-5-21-864226560-67800430-3082388513-524 *unknown*\*unknown* (8)
S-1-5-21-864226560-67800430-3082388513-525 *unknown*\*unknown* (8)
S-1-5-21-864226560-67800430-3082388513-526 *unknown*\*unknown* (8)
S-1-5-21-864226560-67800430-3082388513-527 *unknown*\*unknown* (8)
S-1-5-21-864226560-67800430-3082388513-528 *unknown*\*unknown* (8)
S-1-5-21-864226560-67800430-3082388513-529 *unknown*\*unknown* (8)
S-1-5-21-864226560-67800430-3082388513-530 *unknown*\*unknown* (8)
S-1-5-21-864226560-67800430-3082388513-531 *unknown*\*unknown* (8)
S-1-5-21-864226560-67800430-3082388513-532 *unknown*\*unknown* (8)
S-1-5-21-864226560-67800430-3082388513-533 *unknown*\*unknown* (8)
S-1-5-21-864226560-67800430-3082388513-534 *unknown*\*unknown* (8)
S-1-5-21-864226560-67800430-3082388513-535 *unknown*\*unknown* (8)
S-1-5-21-864226560-67800430-3082388513-536 *unknown*\*unknown* (8)
S-1-5-21-864226560-67800430-3082388513-537 *unknown*\*unknown* (8)
S-1-5-21-864226560-67800430-3082388513-538 *unknown*\*unknown* (8)
S-1-5-21-864226560-67800430-3082388513-539 *unknown*\*unknown* (8)
S-1-5-21-864226560-67800430-3082388513-540 *unknown*\*unknown* (8)
S-1-5-21-864226560-67800430-3082388513-541 *unknown*\*unknown* (8)
S-1-5-21-864226560-67800430-3082388513-542 *unknown*\*unknown* (8)
S-1-5-21-864226560-67800430-3082388513-543 *unknown*\*unknown* (8)
S-1-5-21-864226560-67800430-3082388513-544 *unknown*\*unknown* (8)
S-1-5-21-864226560-67800430-3082388513-545 *unknown*\*unknown* (8)
S-1-5-21-864226560-67800430-3082388513-546 *unknown*\*unknown* (8)
S-1-5-21-864226560-67800430-3082388513-547 *unknown*\*unknown* (8)
S-1-5-21-864226560-67800430-3082388513-548 *unknown*\*unknown* (8)
S-1-5-21-864226560-67800430-3082388513-549 *unknown*\*unknown* (8)
S-1-5-21-864226560-67800430-3082388513-550 *unknown*\*unknown* (8)
S-1-5-21-864226560-67800430-3082388513-1000 *unknown*\*unknown* (8)
S-1-5-21-864226560-67800430-3082388513-1001 *unknown*\*unknown* (8)
S-1-5-21-864226560-67800430-3082388513-1002 *unknown*\*unknown* (8)
S-1-5-21-864226560-67800430-3082388513-1003 *unknown*\*unknown* (8)
S-1-5-21-864226560-67800430-3082388513-1004 *unknown*\*unknown* (8)
S-1-5-21-864226560-67800430-3082388513-1005 *unknown*\*unknown* (8)
S-1-5-21-864226560-67800430-3082388513-1006 *unknown*\*unknown* (8)
S-1-5-21-864226560-67800430-3082388513-1007 *unknown*\*unknown* (8)
S-1-5-21-864226560-67800430-3082388513-1008 *unknown*\*unknown* (8)
S-1-5-21-864226560-67800430-3082388513-1009 *unknown*\*unknown* (8)
S-1-5-21-864226560-67800430-3082388513-1010 *unknown*\*unknown* (8)
S-1-5-21-864226560-67800430-3082388513-1011 *unknown*\*unknown* (8)
S-1-5-21-864226560-67800430-3082388513-1012 *unknown*\*unknown* (8)
S-1-5-21-864226560-67800430-3082388513-1013 *unknown*\*unknown* (8)
S-1-5-21-864226560-67800430-3082388513-1014 *unknown*\*unknown* (8)
S-1-5-21-864226560-67800430-3082388513-1015 *unknown*\*unknown* (8)
S-1-5-21-864226560-67800430-3082388513-1016 *unknown*\*unknown* (8)
S-1-5-21-864226560-67800430-3082388513-1017 *unknown*\*unknown* (8)
S-1-5-21-864226560-67800430-3082388513-1018 *unknown*\*unknown* (8)
S-1-5-21-864226560-67800430-3082388513-1019 *unknown*\*unknown* (8)
S-1-5-21-864226560-67800430-3082388513-1020 *unknown*\*unknown* (8)
S-1-5-21-864226560-67800430-3082388513-1021 *unknown*\*unknown* (8)
S-1-5-21-864226560-67800430-3082388513-1022 *unknown*\*unknown* (8)
S-1-5-21-864226560-67800430-3082388513-1023 *unknown*\*unknown* (8)
S-1-5-21-864226560-67800430-3082388513-1024 *unknown*\*unknown* (8)
S-1-5-21-864226560-67800430-3082388513-1025 *unknown*\*unknown* (8)
S-1-5-21-864226560-67800430-3082388513-1026 *unknown*\*unknown* (8)
S-1-5-21-864226560-67800430-3082388513-1027 *unknown*\*unknown* (8)
S-1-5-21-864226560-67800430-3082388513-1028 *unknown*\*unknown* (8)
S-1-5-21-864226560-67800430-3082388513-1029 *unknown*\*unknown* (8)
S-1-5-21-864226560-67800430-3082388513-1030 *unknown*\*unknown* (8)
S-1-5-21-864226560-67800430-3082388513-1031 *unknown*\*unknown* (8)
S-1-5-21-864226560-67800430-3082388513-1032 *unknown*\*unknown* (8)
S-1-5-21-864226560-67800430-3082388513-1033 *unknown*\*unknown* (8)
S-1-5-21-864226560-67800430-3082388513-1034 *unknown*\*unknown* (8)
S-1-5-21-864226560-67800430-3082388513-1035 *unknown*\*unknown* (8)
S-1-5-21-864226560-67800430-3082388513-1036 *unknown*\*unknown* (8)
S-1-5-21-864226560-67800430-3082388513-1037 *unknown*\*unknown* (8)
S-1-5-21-864226560-67800430-3082388513-1038 *unknown*\*unknown* (8)
S-1-5-21-864226560-67800430-3082388513-1039 *unknown*\*unknown* (8)
S-1-5-21-864226560-67800430-3082388513-1040 *unknown*\*unknown* (8)
S-1-5-21-864226560-67800430-3082388513-1041 *unknown*\*unknown* (8)
S-1-5-21-864226560-67800430-3082388513-1042 *unknown*\*unknown* (8)
S-1-5-21-864226560-67800430-3082388513-1043 *unknown*\*unknown* (8)
S-1-5-21-864226560-67800430-3082388513-1044 *unknown*\*unknown* (8)
S-1-5-21-864226560-67800430-3082388513-1045 *unknown*\*unknown* (8)
S-1-5-21-864226560-67800430-3082388513-1046 *unknown*\*unknown* (8)
S-1-5-21-864226560-67800430-3082388513-1047 *unknown*\*unknown* (8)
S-1-5-21-864226560-67800430-3082388513-1048 *unknown*\*unknown* (8)
S-1-5-21-864226560-67800430-3082388513-1049 *unknown*\*unknown* (8)
S-1-5-21-864226560-67800430-3082388513-1050 *unknown*\*unknown* (8)
[+] Enumerating users using SID S-1-22-1 and logon username '', password ''
S-1-22-1-1000 Unix User\peter (Local User)
S-1-22-1-1001 Unix User\RNunemaker (Local User)
S-1-22-1-1002 Unix User\ETollefson (Local User)
S-1-22-1-1003 Unix User\DSwanger (Local User)
S-1-22-1-1004 Unix User\AParnell (Local User)
S-1-22-1-1005 Unix User\SHayslett (Local User)
S-1-22-1-1006 Unix User\MBassin (Local User)
S-1-22-1-1007 Unix User\JBare (Local User)
S-1-22-1-1008 Unix User\LSolum (Local User)
S-1-22-1-1009 Unix User\IChadwick (Local User)
S-1-22-1-1010 Unix User\MFrei (Local User)
S-1-22-1-1011 Unix User\SStroud (Local User)
S-1-22-1-1012 Unix User\CCeaser (Local User)
S-1-22-1-1013 Unix User\JKanode (Local User)
S-1-22-1-1014 Unix User\CJoo (Local User)
S-1-22-1-1015 Unix User\Eeth (Local User)
S-1-22-1-1016 Unix User\LSolum2 (Local User)
S-1-22-1-1017 Unix User\JLipps (Local User)
S-1-22-1-1018 Unix User\jamie (Local User)
S-1-22-1-1019 Unix User\Sam (Local User)
S-1-22-1-1020 Unix User\Drew (Local User)
S-1-22-1-1021 Unix User\jess (Local User)
S-1-22-1-1022 Unix User\SHAY (Local User)
S-1-22-1-1023 Unix User\Taylor (Local User)
S-1-22-1-1024 Unix User\mel (Local User)
S-1-22-1-1025 Unix User\kai (Local User)
S-1-22-1-1026 Unix User\zoe (Local User)
S-1-22-1-1027 Unix User\NATHAN (Local User)
S-1-22-1-1028 Unix User\www (Local User)
S-1-22-1-1029 Unix User\elly (Local User)
[+] Enumerating users using SID S-1-5-32 and logon username '', password ''
S-1-5-32-500 *unknown*\*unknown* (8)
S-1-5-32-501 *unknown*\*unknown* (8)
S-1-5-32-502 *unknown*\*unknown* (8)
S-1-5-32-503 *unknown*\*unknown* (8)
S-1-5-32-504 *unknown*\*unknown* (8)
S-1-5-32-505 *unknown*\*unknown* (8)
S-1-5-32-506 *unknown*\*unknown* (8)
S-1-5-32-507 *unknown*\*unknown* (8)
S-1-5-32-508 *unknown*\*unknown* (8)
S-1-5-32-509 *unknown*\*unknown* (8)
S-1-5-32-510 *unknown*\*unknown* (8)
S-1-5-32-511 *unknown*\*unknown* (8)
S-1-5-32-512 *unknown*\*unknown* (8)
S-1-5-32-513 *unknown*\*unknown* (8)
S-1-5-32-514 *unknown*\*unknown* (8)
S-1-5-32-515 *unknown*\*unknown* (8)
S-1-5-32-516 *unknown*\*unknown* (8)
S-1-5-32-517 *unknown*\*unknown* (8)
S-1-5-32-518 *unknown*\*unknown* (8)
S-1-5-32-519 *unknown*\*unknown* (8)
S-1-5-32-520 *unknown*\*unknown* (8)
S-1-5-32-521 *unknown*\*unknown* (8)
S-1-5-32-522 *unknown*\*unknown* (8)
S-1-5-32-523 *unknown*\*unknown* (8)
S-1-5-32-524 *unknown*\*unknown* (8)
S-1-5-32-525 *unknown*\*unknown* (8)
S-1-5-32-526 *unknown*\*unknown* (8)
S-1-5-32-527 *unknown*\*unknown* (8)
S-1-5-32-528 *unknown*\*unknown* (8)
S-1-5-32-529 *unknown*\*unknown* (8)
S-1-5-32-530 *unknown*\*unknown* (8)
S-1-5-32-531 *unknown*\*unknown* (8)
S-1-5-32-532 *unknown*\*unknown* (8)
S-1-5-32-533 *unknown*\*unknown* (8)
S-1-5-32-534 *unknown*\*unknown* (8)
S-1-5-32-535 *unknown*\*unknown* (8)
S-1-5-32-536 *unknown*\*unknown* (8)
S-1-5-32-537 *unknown*\*unknown* (8)
S-1-5-32-538 *unknown*\*unknown* (8)
S-1-5-32-539 *unknown*\*unknown* (8)
S-1-5-32-540 *unknown*\*unknown* (8)
S-1-5-32-541 *unknown*\*unknown* (8)
S-1-5-32-542 *unknown*\*unknown* (8)
S-1-5-32-543 *unknown*\*unknown* (8)
S-1-5-32-544 BUILTIN\Administrators (Local Group)
S-1-5-32-545 BUILTIN\Users (Local Group)
S-1-5-32-546 BUILTIN\Guests (Local Group)
S-1-5-32-547 BUILTIN\Power Users (Local Group)
S-1-5-32-548 BUILTIN\Account Operators (Local Group)
S-1-5-32-549 BUILTIN\Server Operators (Local Group)
S-1-5-32-550 BUILTIN\Print Operators (Local Group)
S-1-5-32-1000 *unknown*\*unknown* (8)
S-1-5-32-1001 *unknown*\*unknown* (8)
S-1-5-32-1002 *unknown*\*unknown* (8)
S-1-5-32-1003 *unknown*\*unknown* (8)
S-1-5-32-1004 *unknown*\*unknown* (8)
S-1-5-32-1005 *unknown*\*unknown* (8)
S-1-5-32-1006 *unknown*\*unknown* (8)
S-1-5-32-1007 *unknown*\*unknown* (8)
S-1-5-32-1008 *unknown*\*unknown* (8)
S-1-5-32-1009 *unknown*\*unknown* (8)
S-1-5-32-1010 *unknown*\*unknown* (8)
S-1-5-32-1011 *unknown*\*unknown* (8)
S-1-5-32-1012 *unknown*\*unknown* (8)
S-1-5-32-1013 *unknown*\*unknown* (8)
S-1-5-32-1014 *unknown*\*unknown* (8)
S-1-5-32-1015 *unknown*\*unknown* (8)
S-1-5-32-1016 *unknown*\*unknown* (8)
S-1-5-32-1017 *unknown*\*unknown* (8)
S-1-5-32-1018 *unknown*\*unknown* (8)
S-1-5-32-1019 *unknown*\*unknown* (8)
S-1-5-32-1020 *unknown*\*unknown* (8)
S-1-5-32-1021 *unknown*\*unknown* (8)
S-1-5-32-1022 *unknown*\*unknown* (8)
S-1-5-32-1023 *unknown*\*unknown* (8)
S-1-5-32-1024 *unknown*\*unknown* (8)
S-1-5-32-1025 *unknown*\*unknown* (8)
S-1-5-32-1026 *unknown*\*unknown* (8)
S-1-5-32-1027 *unknown*\*unknown* (8)
S-1-5-32-1028 *unknown*\*unknown* (8)
S-1-5-32-1029 *unknown*\*unknown* (8)
S-1-5-32-1030 *unknown*\*unknown* (8)
S-1-5-32-1031 *unknown*\*unknown* (8)
S-1-5-32-1032 *unknown*\*unknown* (8)
S-1-5-32-1033 *unknown*\*unknown* (8)
S-1-5-32-1034 *unknown*\*unknown* (8)
S-1-5-32-1035 *unknown*\*unknown* (8)
S-1-5-32-1036 *unknown*\*unknown* (8)
S-1-5-32-1037 *unknown*\*unknown* (8)
S-1-5-32-1038 *unknown*\*unknown* (8)
S-1-5-32-1039 *unknown*\*unknown* (8)
S-1-5-32-1040 *unknown*\*unknown* (8)
S-1-5-32-1041 *unknown*\*unknown* (8)
S-1-5-32-1042 *unknown*\*unknown* (8)
S-1-5-32-1043 *unknown*\*unknown* (8)
S-1-5-32-1044 *unknown*\*unknown* (8)
S-1-5-32-1045 *unknown*\*unknown* (8)
S-1-5-32-1046 *unknown*\*unknown* (8)
S-1-5-32-1047 *unknown*\*unknown* (8)
S-1-5-32-1048 *unknown*\*unknown* (8)
S-1-5-32-1049 *unknown*\*unknown* (8)
S-1-5-32-1050 *unknown*\*unknown* (8)
==============================================
| Getting printer info for 192.168.43.10 |
==============================================
No printers returned.
enum4linux complete on Tue Sep 25 14:17:16 2018
[GandoPC 192.168.43.10]# cat users.txt
S-1-22-1-1000 Unix User\peter (Local User)
S-1-22-1-1001 Unix User\RNunemaker (Local User)
S-1-22-1-1002 Unix User\ETollefson (Local User)
S-1-22-1-1003 Unix User\DSwanger (Local User)
S-1-22-1-1004 Unix User\AParnell (Local User)
S-1-22-1-1005 Unix User\SHayslett (Local User)
S-1-22-1-1006 Unix User\MBassin (Local User)
S-1-22-1-1007 Unix User\JBare (Local User)
S-1-22-1-1008 Unix User\LSolum (Local User)
S-1-22-1-1009 Unix User\IChadwick (Local User)
S-1-22-1-1010 Unix User\MFrei (Local User)
S-1-22-1-1011 Unix User\SStroud (Local User)
S-1-22-1-1012 Unix User\CCeaser (Local User)
S-1-22-1-1013 Unix User\JKanode (Local User)
S-1-22-1-1014 Unix User\CJoo (Local User)
S-1-22-1-1015 Unix User\Eeth (Local User)
S-1-22-1-1016 Unix User\LSolum2 (Local User)
S-1-22-1-1017 Unix User\JLipps (Local User)
S-1-22-1-1018 Unix User\jamie (Local User)
S-1-22-1-1020 Unix User\Drew (Local User)
S-1-22-1-1022 Unix User\SHAY (Local User)
S-1-22-1-1023 Unix User\Taylor (Local User)
S-1-22-1-1024 Unix User\mel (Local User)
S-1-22-1-1025 Unix User\kai (Local User)
S-1-22-1-1027 Unix User\NATHAN (Local User)
S-1-22-1-1028 Unix User\www (Local User)
S-1-22-1-1029 Unix User\elly (Local User)
</pre>
<p><font size="3.5" color="black">Shares and users are discovered. I added those users to the list:</font></p>
<pre style="background-color:black;color:white;">
[GandoPC 192.168.43.10]# cat users.txt | cut -d '\' -f2 | cut -d ' ' -f1 >> potential_users
Elly
John
Tim
zoe
Fred
kathy
peter
RNunemaker
ETollefson
DSwanger
AParnell
SHayslett
MBassin
JBare
LSolum
IChadwick
MFrei
SStroud
CCeaser
JKanode
CJoo
Eeth
LSolum2
JLipps
jamie
Drew
SHAY
Taylor
mel
kai
NATHAN
www
elly
</pre>
<p><font size="3.5" color="black">Next, I tried to dig for some info:</font></p>
<pre style="background-color:black;color:white;">
[GandoPC 192.168.43.10]# smbclient //192.168.43.10/kathy -U "" -N
Try "help" to get a list of possible commands.
smb: \> ls
. D 0 Fri Jun 3 19:52:52 2016
.. D 0 Tue Jun 7 00:39:56 2016
kathy_stuff D 0 Sun Jun 5 18:02:27 2016
backup D 0 Sun Jun 5 18:04:14 2016
19478204 blocks of size 1024. 16395204 blocks available
smb: \> cd kathy_stuff\
smb: \kathy_stuff\> ls
. D 0 Sun Jun 5 18:02:27 2016
.. D 0 Fri Jun 3 19:52:52 2016
todo-list.txt N 64 Sun Jun 5 18:02:27 2016
19478204 blocks of size 1024. 16395200 blocks available
smb: \kathy_stuff\> get todo-list.txt
getting file \kathy_stuff\todo-list.txt of size 64 as todo-list.txt (2.2 KiloBytes/sec) (average 2.2 KiloBytes/sec)
smb: \kathy_stuff\> cd ../backup\
smb: \backup\> ls
. D 0 Sun Jun 5 18:04:14 2016
.. D 0 Fri Jun 3 19:52:52 2016
vsftpd.conf N 5961 Sun Jun 5 18:03:45 2016
wordpress-4.tar.gz N 6321767 Mon Apr 27 20:14:46 2015
19478204 blocks of size 1024. 16395200 blocks available
smb: \backup\> get vsftpd.conf
getting file \backup\vsftpd.conf of size 5961 as vsftpd.conf (166.3 KiloBytes/sec) (average 117.1 KiloBytes/sec)
smb: \backup\> get wordpress-4.tar.gz
getting file \backup\wordpress-4.tar.gz of size 6321767 as wordpress-4.tar.gz (778.7 KiloBytes/sec) (average 770.5 KiloBytes/sec)
smb: \backup\> quit
</pre>
<p><font size="3.5" color="black">Nothing interesting in "vsftpd.conf" and "wordpress-4.tar.gz".</font></p>
<hr>
<br>
<br>
<p><h3>Port 666 check:</h3></p>
<hr>
<p><font size="3.5" color="black">Attempt to communicate with port 666 using ncat:</font></p>
<pre style="background-color:black;color:white;">
[GandoPC 192.168.43.10]# ncat 192.168.43.10 666
PKdýýHpýýý,2
message2.jpgUT +ýQWJýQWux
ýýz
TýýýPýýýA@ý ýUTýTý2>ýýRDKýJjý"DL[Eý
0<4ý®nýýýVýWýH ýýýý
_ýdrýýý9ýýuýYý3oXýYý2ýeýýýýý=2ýýýy}ýaýýýý>`ý ý:ýyýýýýý^ýýsCýý
ýýnc$Iýý+jý[ýýýýý=,ýýýýsý½ýýýýisýM?ýý ýýeYýýýýýýýý]sSýbQýýýýýAoAýý9Âýýý xýOY4ýýýý1ýNý ýý3wýýý&&qýý'iýfLýý\ýýýýý:ýiýrýýýý{ýýý:iýkýýTýý/ý-W÷&ýNý<ý\.ýýý$ýýý^ýýýgý.¼ý|W ýýýýýýjýf~ýýx'ý|ùOýýýý`a"ýKVýý
ouýýýý7ý|ýýÄOýnK>#)ýýý{ýýýg 8ýu([rýH~AýqYQqýwýý?}ýý?ýýTyýýjkýýSWýýýýýýfýFýkýýýýyýýýýýýY_?n2ýýýÆ^
ýýýýým ýýf".ýý?Býýýý,ýý[ý&ýNbMýýýVýý 3&M~{ýýýý-ý]_ýý[qtýýýo/¶ýýýýýýýÏýýýý_@Nýýýýý{ý ý Eý ýýýýýýiý.Lý\gDýýpýýýYm
SWbýNý&ýýývOý3A#ý,ýý^ýýýýýý4ýCHý}ýý~ýRý`wTýýKT amÙfýý'ýýST%ý5ýý
ýýL}AJýHý2ý(OkiýýýýdNýýý.npy.9ý ýRr9ý®ý#ýOgýýý~ý]VýBGuýý=ýýýHU ýýýIýýGTQýýýý
Lýýýý ý*P?ýýýýDfvý`ýýkýSýP0ýýý
ýýýqý2ýýýtýwýýýý;ýýýýGýýýýý?P]ýVýýý4ýh(}]LEýHiýýý2~ý@ÝýxnaýýUýýý'4ýzýý%jow^Moý~:ý ýýyÍo½nýýýý=faýýýrýpýýýUýtýyýýB~q^7ý,ýýý:ýý©;ýý ýý{ýýýO 1MýÁýýýýTýýYýýýýO°7ý:ý/ý7;ýý"3\ýýlt6"9:ý?ý,ýýýýMyýT1ýýý2ýx5
ýýzýýzýý(hoýýýcGBn]ý3ý ý7ýýJAý"¹
ýýrýej.ý~ý\G Býýýuýýýýýýý!ýBaBýVý'9ý2ýýTý|ý,ýýýý=ý)pýýwýýýýý]T4ýbýýýýý&ýký]7ýýciY"I4ýP
nýýýýýýaýtýýýýýý7ýýeý'Qnqýýýlýýýý0ý#Uýbý7?ýýýýýý_ýýS7ý#ý:ýW]ýýýoý4ýýýýýýýUyýJUýý~ýý+wýýýý*lý)7c_ý\rz>0m
v^ Effu|LX+/Sýýdýýyýý# ývÃFýq=ýýuýýýýýýýý:ýýc$Gýg}}ýý liiýýýýpý8.ýý$9c5ýxýzýýPýýý uýýýi Wýý%ýtU:ýýýpBSKýýýýývýýaý ý>ýýýU@ýýý ý:!u8ýô=ýgýýaý
1ý_ýýýdý_ýýýýýýýýý~Wýýýýcý.>ý1GýýeýbýýAýýýýýýý_ýýAý'¾ýLýýfhiýýý4ýy{ýýý%ý0kývqýýýjkjýFýýhýýýuýUGjýý'ýý2ýýýT`(]Iývýýýýý9Aýýý¬ýýG*ýýH8 ýý5ý>]ý2ý
ýýýý0ý}ý$rýsf*Pb8ý(ý[ý)ý ýOeýý1ýýý}
ý6ýýMGnýý.ýý
ýý6ýý.Rý.,ýUýýiýz+4ýýý,LwBýb*sýý.2"nkýb/\Mý<r1býýOi6ýý^~ýýý= Sýý*ýýwýhYdýSý:ýzdýZSiýý]ýAýLHý3)ýxý~c(^yýK"zmý[Mýýý%ýýýýðýýýMýG@ýjUýtýTýý3>výq¡0ýý
TlOýýXýýaý<ýýýový)ýZýfý?ýý ýýý:ý0>ýýý<ýý,ýýý%*Dý
ý9$Fýýý$+ ?aýKýhN
TLkyýý%ýý_ý|PýýýýýdýY&oýý<ýýB8úýýý!ýýýR/\_vi%rýýýKNýMý"ýý1ýSýýQ0ýýýýl
9ý`PýI<ýýýýýýýýýý-ý$UýzýýýýýUt}ýýý5Q2ýýýýSý'Jýý8ý@%ýý[
ýaý;ýký2ýýPrýýýKýýýýýaýý9ý|ýýd ýý¾Tý TýýMý;ýxLýýýMýýýNýýSZA4ýJýýýý|ýýýýýNýýý
7Výýmtý#j->P: gýýVý
*ýýýýiý²ýýýjýcRMýýý(ý^ýýýý4ý}kF<$Bj$ýýý~ýýCýý">ýý(ý7ý}2<ýi_1ýý*ý
ýý(ýý jSýýýv:ýýzXýwýý=ýýý!ýýýýýJEýýý^iýýj?;2ýýiqB'ýýýýmýX:o4)ýýý~ým?ý)CýFýýý ýýsBýý$ýedý]ý4ýL3ýýaýý
aIg
%ýýsýý|:ýý>³ýyR(ý*U\ý\Rû2jýký2ýýýýý&R{ ýDbý9hsBý(ý,/| |@ýJýýýý¾1ýýÙý
ýxý|ýý^@ýýýzýý|dpcývý0ýýk@ýÃýý
týý p)ýýýKQAýýýýnBýý!ýI$ý$\ýc*ýýýýýMrýýýýHZ|ýyýým®ze0ýýSýý>ýBL5s}eýz'ýýý$F2ýýýýc*ýýýýýýýfýýýýýZýdýOý
ýýý ]FýýIýbbz #ýýz.iýýS?gXýýýýýqýý(ýýýýM-!M$ýý8eýk Qýeýy}ý&Eýýýýýýý%\ýj|9ýýýVý2EqýýýýýsýH6pVnYpý<ýýfýýýýýýýýýýýýyýýK}ý:gýJ0ÂCYý{ ý ýo*%ý4ýýývý výýýaýýýývWýi~ýýýtýý ýý2ýýýýjýS%j{ýýýýýýýLý#=ýý3ýýýý
mýýýýý eýýý;ýIýe·\Kýýý£ý-Kr
ýý%Eýýýaýýý-3ýýýý.ý`T0ýýý4ýýýýý:ýJXDýýýýxýýýHPý` ýýýoýQBýý1ý~ýýný ýýýýgýý=ýýFýyýiý
ý_výL&e:UýýLý
ý
ýýýM"x`ýý^x+o*ý \ýH9
WýýJT~ý;"?ýqýý=ýxýýýý&ýýýýAý2ýýýEduS.xýýý×ýýfýXý`?ýýý%ýýýý5ZýýýBdýR5ýýý{k#2 ýý
jýaýýýýeýýýbXlýý=ýýýZý&Ký}ýDýýý4ýNrLýdFý ýýý]%Wý}1ýt%o
~ý5ýý
Ðý'ýýý*ý`cýý?7]ýýýý
ýDE|7ý{ýýAýý_ýl5cýýý 3ýý 1ý8ýIýwyý(fýUAýý(Dý\ýýZýBýTýýýdýWStý#Yýýý!ývtýýQýGý:R5ýeTv+ýLÊýýU)KýýýJýýýýkfýryXýýýý4m$ýjýýDoý?ýýýýýýý=ýTýsýýwýýSLý ýýýYýMýa"km_ý-jUýý6?hhýýj'92t-ýýUýý{d7%ý:ý'
ý(cý ýý5)ýýxý^ýlýýýuGîý2ýýýýýýýýýýýý-lýo)ý(mMýýý ýýK}ýJýi:ý6ýapý\%ýp ýý}ý V9ýw<ýýýýýýýý
ýýýaeLýýyý9ýýQ6ý¹
ýýoýýBýý
2_ý.x2 ýýýH7ýýý8ý/ýLeý ýýý0ýýýý$ýUý\[ýývýE?WVý~ýÑýýýýýzýýýP5ýiýaýýý"dýýýýEýýýýýe4ýýýýVK} ýýýý*ýýýýS"ý4ýý[ýý=Cýýt??ýq}{Cýgwýý2Sýuýüýý#4ýýýýýý? ýýqO;ýýýC1ýýý7ý:VýoýýýgýS]uý#ýk"ý;ýýMrQRx1y] ýC$ýýýwýýUýnR5ýý ýýGýý ýmWAýý ~ýý_^0RkfýýýWSýÛý0ýý^uýIý?=ýC{ ýý1ýým yýýý"ýýMý7ý§ýV0ýýo j)>ýýý<:ý$ýý&9yý#ýkbýO']B2bý#ýhYýAýýý\ýý)Yoý ýýtixyeýý
A2;{eýýzýý
ýýýPýsýýý@ýýKýýCýýFJývýgýýýýwTJý6;.,ýý)fýýýýjÛý*ý.8ýQýSýdyLwý4ýý#2ý[ýý{ý>ýnýNý%ýzýýUjýýýýýXAýDëh7ýý)'ýýVýpýLýýlýýý1ýýý0uýý6ýýýqBýý_ýPI9ý'$Wý@Rýý %ýýý4v[0ý«ýý2DýýtýpGwv/ýDr:NýZýSýý|ý ýwýÄ%ýýýe7ýLý±BýCb2ýcýiýdýMýý
ýýýýýpn+pýýýýý@3ýPýýým6ýkýý Z1 bdýXG*4ýDýqBÞ3ýVGþgcýýx6ýýiýoýýýZ%fCýýwýýqkýSýCý&ýQJýýýýýc
3ýýýýýý]`ý¾8ý1*pýZýýý7ý
výýý7ýýýýfýýý9ýýýlRopGýýý?Jýýý <ýýýXKý[fm4~01ý ý]:?Oý
ýýYýý_#ý¬ý>cý>8ý)ýÝ HuBýkýýý. uq}|ýýýýqý9~fMýýýý<ýýýýý%ýPQýýUýýýlý%ý:ýgb J8ý8xýýý!ýlýýóýA_]ý#ýýKý9býn}ýk~?<ýa_ýý
ýý
ýý8ýP ý
ý
ý>R=Zýý%ýX5ý3]ýSýVýý `Eý¿Uýýý45ýýSý4ýDýýýLýýýd)=;Ms_ýýý]HýNQ,ý$j
ýý"ý~[ýe
{ý.ýe.ýý=l býýý:ýýýýý7ý=
4ý1]Mýý.:XýýýýZý*ýýJ
ýzWýýýDýSýý
%ýýýýýyý,Aý ýýý=L<ýý0IýýGGýýÞ
ýýQ"& {Týýý}u4ý{ý2cýýýýýýýýýýý+~ýýýýaçýýýIýcýýýLýýýýmLýýý|Sýý/ýi-
ýfýJýPýý{4ýýýeýýWýýý>8ý\ýý1ýý^ýý@*ý,ýBýýýýUý[qý&ýý %ýý~ýýZýEýf
ýQ±ýýýkýý(1\k-J
ý+ýýýýýfqýýc"\ýý ýýýzM$ýoýýCýýý ý ý *Gýýýýý/Rýýýý>.ýtýýzý
ýýFýýIýýýýýý"ý
> Jvýýýýýý9ýR
5`Rýýýtýýý^ý[ý>ý ýýdýýQxý4GRýiý%ýýýýhxný&j^`ýýýRýýGýNRýý%jý]ýi^LýýeLýtBýýýýKTýýDýzý 7ýýW wBn
ý3o#ý9ýgzý)wýý výPi HQTO5ýýýKýAýýPýýýý;[nýxKtýýxUýýÕýýýýýLýýýýEt@l.jýýýHýýýý"ýýV+fýýý4Q Oýý)tBýýýý ý=}ýq#ýýrý%t!c\Oý7XýýBrýýdy"ýýýýsýsýTýpýDýý5ýLk)IYýýýýýý`t 0ýýý/Zýýý ýýdeý&ýýý&ý->ýý$klÁXýýý¤×rýwýýýTýÜtýMýý ýý9ýlxKo;8$ýýQa}Lý\ cký
ýBi
i`o#ýý$>V1_\ýýý'ý2ýýýCý\ýýýýýcêrýT.'l d½+ýý@nýýý_\1U8ýýýýýý6ýýýýý6¶WUý
ý8nýIýýSýcr&,zý-ýà kýýIýýSgTSaýSGNýýý)j4
Lýý!ýý|ýRaOmKý&ýýýq;Fý
ý ýý@lG>-5ýmý
ý>ný%}<8 ýýýaýdýýcýýýýýýfýJ]ZIýýAýýýkýýýýýg}]výt#ýý"ý&ýý]ýZýý$ýgý'býPý
/ý]R*ýýdx;\ýý)=ýýýEýýý ý,ýýQ_ý]Cý&ýý7ýýýýý~ýdýýý ýW+ý2ýýv.hý2;ýýhYeý3JýPýýýýýX]M[ýýyýýýLýUýýV}ý8ýýfý, ýgeýýý|Ï-ýý
Zý!oý
a ýlýýýý($ý ý$ýLýMóýýý=ýý7ýZýg'DMý½oýIývýýý.HJýnbýý7ýýýßK4ýýbSýýýHýý+ýcý ý
Yý9ý\ý($ýýýý
ýýý%ý _ýý6ýiýRFýýSýIG{ýýýCOyý(ýHýýýýý,ýýýgýýrýWCýýðzýýeaýxjýýýýZýýB]ZýdS[ýuXýýýh}ýP{fQýý_ý,ýNhýý{ý;}_41ýd"ýýý"ýý"
UýNýý:ýý)}ýýýýekýýýatýAýý{ý"ùý ýýýVýýGOý+
ýýÖýýýýýdý&~ýO ýýrýý<ý/ýý2ýýpýýýDý{gýýýýC0zý]ýe
ýýýýýýýA\^uls%ýýýý
ýýu|ý6ýýýýýýýgýwiýT ýý;ý Uý,i?]ýX ýýýýý
ýýýýýzPý(/Bfuýý9Xý@ý|S"2(ý'ýý`ýýýSýý`]Kýý% ý ý'Zý"pýAý)ýýýýýTýYmýý8s
ýý^aQýýdýýýýý$ý^ýýý?b2cýýNýýýýýRýýýýEFýýýý-ýýý4ýIýVKýýý]ýýýýýýý#ýýDvYýý1d2ýý'ý
`ý _ýtý#Ùýsýýý;uqýmý
ýEý8Kýýý^ý
ýý5Nhz cccý
ý\Sý
ýOXý3ýýlG(ýýý~ýýýýr0*uý85_ýýMýýý:
2ýýý% \ýýýýTý>ýrý\fýey~;ýýýýcýFyQýjGýýq>ýgKkýý/ýG4ýýýý|@ýsýB
ý
ýýýý}ý_ý)Iýý=Âý=ýýýý7ýýýý~ýý9U7ýkýýýýýýýýWýýýýýC3ý
ýýýzýkýýýdýFýNa73Rý%9'ýýýý[ýl&Z*ýKýýrýPýýýTýýý:ý~Uýý !&ýýý
Tý
|ýýIIýýPqw ýý,ýa
ýTýL6ýýEýFýýn$ý'Jýýýcýýý`ýDý+TVM_ýý{ý
h$ýý-[12Fý:ý ýýWý9cýýýrý)ýýý9ýybýý%ýýýýýýlRýý ýãýN=ýfýý_ýý9ý;*ýTwFýOýb
"ýOýcýýFýýuUýlgý3ýÃeQX4ýý:ýýnY° ýqý@%ýýý ýýýFýV. }~s? gý:ýSkýd(_Lýýý>8ýýýýýýTIýý~ýýNýýrNAý7ýýý6ý
ý ýsU>Sýbýj"ýýý gýýýký ýýUMýOEýý8ýýýeýý%#/ÙEýýývý?ýýKh ýýýHýý$ý=ýýb;!(ý(ýýe1ýýý3ýý
ýýýs@ýiýPýÖý~ýý|ýýýýýsýý ýuýLSýeýýpýmýfýFcý ý5jd?ýýRsg ?ýLýýyBýýdSýi[$ýýýýý4\<ýrRýý0ýý_YxýA|ý^ýýýd<ýHýý8#ýýý
*G*|ýý@U^ý?ýýiýý1ýý)ýý?Rý=ýý
Vý =ý;ýýýDbý2ýý>ýýa'ýý*ýýý
ýý$$ýýIxý}ýý$[ýýýýýýý8xý/0ý|ýýpojeýný"}ýý3ýýA6ýB ]ýý#ýý{6ýAýLrM,{2XýýK·µB-ý*Kýiýýý'pýý^ý+uýýOýJýDu5Gsý\ýýýD\ýýýFýý´ýfýýW3ýý.ýýVýýn4ý_rý,ýoAýý
ýfOlýqRýýýýýýýýýýHKý]ýd=ý ý&RÛýN,{}ý=ýýRýMýýtýIý/Lýý-}ýý.ý-ýýn"%¹ýaý ý^ýý}ý2ý!0ýjB#ý}#ý gýywýý/ýýý ýýý$ýJ.wýyý[eý
9<@ý=ýýFýviýý!e:$p738ýZý ýGýxýý~ýýOýyfýýQýý;ýýi ý 6FKýhýxýýýTýý mýýý
2ýýjýýýiýýý4*ýývýPý' |ýý+8 výhýýoB7ýý2e1ýnaý;ýHýýOM8Gý/ý^ýý*Iýý'ýý<ý\B#ýý¾ýýý7Rýýýýý"~N1ýogýýaýýp]Kýý£#hý:ýpýýýM$ýýa\5yo
BVQý29fk>ýýýý/l0ý^ýlýý
9Dýý4ý9qýBaýXVt÷ýý`ýKýe%9Nýrýýýýýýýqýýýý_PK dýýHpýýý,2
ýýmessage2.jpgUT+ýQWux
ýPKRý,^C
[GandoPC 192.168.43.10]# ncat 192.168.43.10 666 > pic.jpeg
[GandoPC 192.168.43.10]# file pic.jpeg
pic.jpeg: Zip archive data, at least v2.0 to extract
[GandoPC 192.168.43.10]# unzip pic.jpeg
Archive: pic.jpeg
inflating: message2.jpg
[GandoPC 192.168.43.10]# strings message2.jpg
JFIF
vPhotoshop 3.0
8BIM
1If you are reading this, you should get a cookie!
8BIM
$3br
%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz
#3R
&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz