HTB - Funnel
HTB - Funnel
OS: Linux | Difficulty: Very Easy
After doing nmap enumeration:
PORT STATE SERVICE VERSION
21/tcp open ftp vsftpd 3.0.3
| ftp-syst:
| STAT:
| FTP server status:
| Connected to ::ffff:10.10.14.243
| Logged in as ftp
| TYPE: ASCII
| No session bandwidth limit
| Session timeout in seconds was 300
| Control connection is plain text
| Data connections will be plain text
| At session startup, client count was 4
| vsFTPd 3.0.3 - secure, fast, stable
|_End of status
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
|_drwxr-xr-x 2 ftp ftp 4096 Nov 28 2022 mail_backup
22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.5 (Ubuntu Linux; protocol 2.0)操作系统：Linux | 难度：非常简单
在进行 nmap 枚举后： （此处省略 nmap 输出代码块）
Obtained 2 open ports for ftp and ssh. Anonymous FTP login allowed (FTP code 230) -> This indicates that the FTP server on the target machine allows anonymous FTP login, so I thought I could try connecting to it as the anonymous user. For anonymous login credentials: Username: anonymous, Password: anonymous.
获取到了两个开放端口：ftp 和 ssh。匿名 FTP 登录被允许（FTP 代码 230）——这表明目标机器上的 FTP 服务器允许匿名登录，所以我尝试以匿名用户身份连接。匿名登录凭据为：用户名：anonymous，密码：anonymous。
After connecting via FTP, I found two files: 1 PDF containing the password policy and 1 welcome text file -> Downloaded both of them using the get command. Within the passwordpolicy.pdf: I found that the default password for new accounts is funnel123#!#. I figured that the welcome text message would contain the names of people who had recently joined the company, and I was right.
通过 FTP 连接后，我发现了两个文件：一份包含密码策略的 PDF 和一份欢迎文本文件——我使用 get 命令下载了它们。在 passwordpolicy.pdf 中，我发现新账户的默认密码是 funnel123#!#。我推测欢迎文本中会包含最近加入公司的人员名单，事实证明确实如此。
Since I knew: the default password, the names of the newly joined people, and that the SSH port was open, maybe there could be a user who had not changed their default password. So I tried to SSH into the target machine using the names and the default password. I ultimately found out that Christine had not changed her default password and was able to get an SSH connection.
既然我已经知道了默认密码、新入职人员名单，并且 SSH 端口是开放的，我想到可能存在尚未修改默认密码的用户。于是，我尝试使用这些名字和默认密码通过 SSH 连接到目标机器。最终我发现 Christine 没有修改过她的默认密码，并成功建立了 SSH 连接。
I used the hint from HTB to use the command ss -tl, which means “Show me all TCP ports on this machine that are listening for incoming connections.” From here, I found that there was a PostgreSQL service running locally on the target machine (127.0.0.1:5432). Since I was connected as Christine, I immediately ran the command psql -h 127.0.0.1 -p 5432, but it failed because psql was not installed. I couldn’t install it manually either since it required sudo access, and I didn’t know the root password.
我根据 HTB 的提示使用了 ss -tl 命令，该命令的意思是“显示本机上所有正在监听传入连接的 TCP 端口”。由此，我发现目标机器上本地运行着一个 PostgreSQL 服务（127.0.0.1:5432）。由于我以 Christine 的身份登录，我立即运行了 psql -h 127.0.0.1 -p 5432 命令，但由于未安装 psql 而失败。我也无法手动安装，因为它需要 sudo 权限，而我不知道 root 密码。
I got stuck and had to rely on the hint, where I learned about SSH tunneling and port forwarding. I learned about Local Port Forwarding, and if I were to phrase it in my own words -> If I talk to port 5555 on my Kali machine while connected to the target machine, forward that traffic to port 5432 running on the target machine. The vice versa would be Remote Port Forwarding, and we use it when the target remote machine sends traffic to its local port and we want that traffic to reach our local machine instead.
我陷入了困境，不得不依赖提示，从中我了解了 SSH 隧道和端口转发。我学习了本地端口转发，如果用我自己的话来解释——当我连接到目标机器时，如果我访问 Kali 机器上的 5555 端口，它会将流量转发到目标机器上运行的 5432 端口。反之则是远程端口转发，当我们希望目标远程机器将其本地端口的流量发送到我们的本地机器时，就会使用它。
ssh -L 5555:127.0.0.1:5432 christine@10.129.160.250
So what this command is doing, the mental model would be: “Open a port on MY machine and forward anything arriving there through SSH to a port on the remote machine.” To put it simply, the SSH connection is giving us a pathway for network traffic generated within our Kali machine to reach the target machine.
这个命令的逻辑模型是：“在我自己的机器上打开一个端口，并将到达那里的任何流量通过 SSH 转发到远程机器上的某个端口。” 简单来说，SSH 连接为我们提供了一条通道，使我们在 Kali 机器上生成的网络流量能够到达目标机器。
So now we can run the following command on our Kali machine: psql -h 127.0.0.1 -U christine -p 5555 -> “I want to connect to the PostgreSQL database running on my Kali machine on port 5555”, but this connection network traffic actually gets forwarded to the 127.0.0.1:5432 on the funnel machine instead due to the pre-configured SSH tunnel. Once we get connected to the PostgreSQL database as Christine, we can navigate through the database and get the flag.
现在我们可以在 Kali 机器上运行以下命令：psql -h 127.0.0.1 -U christine -p 5555 ——意思是“我想连接到我 Kali 机器上 5555 端口运行的 PostgreSQL 数据库”，但由于预先配置的 SSH 隧道，该连接的网络流量实际上被转发到了 Funnel 机器上的 127.0.0.1:5432。一旦我们以 Christine 的身份连接到 PostgreSQL 数据库，就可以浏览数据库并获取 flag。