https://wearethebug.dev/tags/nfs/Recent content on WE ARE THE BUGTradecraften-usThu, 26 Sep 2024 00:00:00 +0000https://wearethebug.dev/posts/vl-cicada/Thu, 26 Sep 2024 00:00:00 +0000https://wearethebug.dev/posts/vl-cicada/Cicada is a Medium-rated Windows Active Directory machine hosted on the VulnLab platform, that involves discovering a password inside an image on a public share. With that password an attacker is able to discover that the machine is vulnerable to ESC8 and can use Kerberos relaying to bypass self-relay restrictions in order to get a certificate as the machine account itself. With this new certificate, we are able to dump the hashes of the Administrator user and thus compromise the whole domain.https://wearethebug.dev/posts/vl-slonik/Fri, 27 Oct 2023 00:00:00 +0000https://wearethebug.dev/posts/vl-slonik/Slonik is a Medium-difficulty Linux machine that focuses on NFS, PostgreSQL abuse, and privilege escalation through insecure backup automation. Initial access is obtained by enumerating exposed NFS shares and leveraging UID/GID trust relationships to access a home directory. History files within the share reveal database credentials and reference a locally bound PostgreSQL socket. Although direct SSH access is restricted, the socket is tunneled over SSH to interact with the database, where built-in PostgreSQL functionality is leveraged to achieve remote code execution. Privilege escalation is accomplished by monitoring system processes and identifying a root-executed backup script, ultimately leveraging pg_basebackup behavior and SUID permissions to obtain a root shell.https://wearethebug.dev/posts/vl-hybrid/Thu, 22 Jun 2023 00:00:00 +0000https://wearethebug.dev/posts/vl-hybrid/Hybrid is an Easy-rated, simplified Active Directory chain with 2 servers MAIL01 (Roundcube webmail) and DC01. Exploited a vulnerable Roundcube plugin via a crafted email, escalated privileges via NFS, and abused AD CS with certipy to achieve Domain Admin.https://wearethebug.dev/posts/vl-unchained/Fri, 04 Mar 2022 00:00:00 +0000https://wearethebug.dev/posts/vl-unchained/Unchained is a Medium-rated Linux machine available on Vulnlab platform. Starting with NFS share enumeration then a source code analysis allows a JSONPICKLE deserialization to obtain a reverse shell as user. For the privilege escalation, CVE-2021-44730 (Dirty snap-confine LPE) or CVE-2022-0847 (DirtyPipe) can be exploited.