HTB - Funnel

OS: Linux
Difficulty: Very Easy

After doing nmap enumeration:

PORT   STATE SERVICE VERSION
21/tcp open  ftp     vsftpd 3.0.3
| ftp-syst: 
|   STAT: 
| FTP server status:
|      Connected to ::ffff:10.10.14.243
|      Logged in as ftp
|      TYPE: ASCII
|      No session bandwidth limit
|      Session timeout in seconds was 300
|      Control connection is plain text
|      Data connections will be plain text
|      At session startup, client count was 4
|      vsFTPd 3.0.3 - secure, fast, stable
|_End of status
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
|_drwxr-xr-x    2 ftp      ftp          4096 Nov 28  2022 mail_backup
22/tcp open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.5 (Ubuntu Linux; protocol 2.0)

Obtained 2 open ports for ftp and ssh

Anonymous FTP login allowed (FTP code 230) -> This indicates that the FTP server on the target machine allows anonymous FTP login, so I thought I could try connecting to it as the anonymous user.

For anonymous login credentials:
Username: anonymous
Password: anonymous

After connecting via FTP, I found two files: 1 PDF containing the password policy and 1 welcome text file -> Downloaded both of them using the get command.

Within the passwordpolicy.pdf:

I found that the default password for new accounts is funnel123#!#.

I figured that the welcome text message would contain the names of people who had recently joined the company, and I was right:

Since I knew:

1. the default password
2. the names of the newly joined people
3. the SSH port was open

Maybe there could be a user who had not changed their default password, so I tried to SSH into the target machine using the names and the default password. I ultimately found out that Christine had not changed her default password and was able to get an SSH connection.

I used the hint from HTB to use the command ss -tl, which means "Show me all TCP ports on this machine that are listening for incoming connections."

From here, I found that there was a PostgreSQL service running locally on the target machine (127.0.0.1:5432).

Since I was connected as Christine, I immediately ran the command psql -h 127.0.0.1 -p 5432, but it failed because psql was not installed. I couldn't install it manually either since it required sudo access, and I didn't know the root password.

I got stuck and had to rely on the hint, where I learned about SSH tunneling and port forwarding.

I learned about Local Port Forwarding, and if I were to phrase it in my own words -> If I talk to port 5555 on my Kali machine while connected to the target machine, forward that traffic to port 5432 running on the target machine.

The vice versa would be Remote Port Forwarding, and we use it when the target remote machine sends traffic to its local port and we want that traffic to reach our local machine instead.

ssh -L 5555:127.0.0.1 christine@10.129.160.250
So what this command is doing, the mental model would be: "Open a port on MY machine and forward anything arriving there through SSH to a port on the remote machine."

To put it simply, the SSH connection is giving us a pathway for network traffic generated within our Kali machine to reach the target machine.

So now we can run the following command on our Kali machine: psql -h 127.0.0.1 -U christine -p 5555 -> "i want to connect to postgresql database running in my kali machine on port 5555" but this connection network traffic actually gets forwarded to the 127.0.0.1:5432 on funnel machine instead due to pre-configured ssh tunnel"

Once we get connected to the PostgreSQL database as Christine, we can navigate through the database and get the flag.