# Nmap done at Fri Jul 9 02:11:54 2021 - 1 IP address (1 host up) scanned in 13.16 seconds Service Info: OS: Linux CPE: cpe:/o:linux:linux_kernel |_http-title: Apache2 Ubuntu Default Page: It works |_http-server-header: Apache/2.4.29 (Ubuntu) |_ Supported Methods: HEAD GET POST OPTIONS PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. Not shown: 938 closed ports, 60 filtered ports. An attacker could possibly use this issue to cause a denial of service. # Nmap 7.91 scan initiated Fri Jul 9 02:11:41 2021 as: nmap -v -sC -sV -p 80,22 -oN detailed_scan openadmin.htbĢ2/tcp open ssh OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux protocol 2.0) openssh - secure shell (SSH) for secure access to remote machines Details Robert Swiecki discovered that OpenSSH incorrectly handled certain messages. Then a detailed scan against the 2 found services $ nmap -v -sC -sV -p 80,22 -oN detailed_scan openadmin.htb # Nmap done at Fri Jul 9 02:08:00 2021 - 1 IP address (1 host up) scanned in 20.27 seconds Read data files from: /usr/bin/./share/nmap Nmap scan report for openadmin.htb (10.10.10.171) Increasing send delay for 10.10.10.171 from 5 to 10 due to 213 out of 709 dropped probes since last increase. Increasing send delay for 10.10.10.171 from 0 to 5 due to 42 out of 140 dropped probes since last increase. A remote attacker able to connect to the agent could use this issue to cause it to crash, resulting in a denial of service, or possibly execute arbitrary code. # Nmap 7.91 scan initiated Fri Jul 9 02:07:40 2021 as: nmap -v -oN ports openadmin.htb openssh - secure shell (SSH) for secure access to remote machines Details It was discovered that the OpenSSH ssh-agent incorrectly handled memory. I first added the machine in my hosts file as openadmin.htb then ran a regular nmap scan to get the open ports $ sudo nmap openadmin.htb -v -oN ports Recently, hackthebox started an event called take it easy, where it made a bunch of retired easy machine accessible to everyone, so here’s my write up for the first box I’ve rooted in the event Reconnaissance
0 kommentar(er)
