SMB Shares & Cronjob to Initial Access (Proving Grounds: Dawn)
Source: YouTube · John Hammond · published Feb 16, 2024 · 16:17
The video demonstrates hacking an easy-level Proving Grounds machine by exploiting a writable SMB share and a scheduled cron job to achieve initial access 12:53-13:10.
Key Takeaways:
• Nmap scanning reveals open ports for HTTP, SMB, and MySQL services 0:28-1:05.
• Anonymous SMB access is found on the "IT Department" share, allowing file uploads without authentication 1:35-1:55.
• Web enumeration with dirsearch uncovers a management.log file exposing a cron job that executes scripts 6:24-7:06.
• The logs indicate the cron job runs as user "don" and executes scripts located in the writable SMB directory 7:00-7:56.
• A malicious bash reverse shell is written to the share as product control, granting a shell when the cron job executes it 12:53-13:10.
The attacker successfully compromises the target by leveraging the combination of anonymous write access and automated script execution.
Sources:
- 0:28-1:05 Nmap scanning process
- 1:35-1:55 SMB share enumeration
- 6:24-7:06 Finding the management.log file
- 7:00-7:56 Analyzing the cron job logs
- 12:53-13:10 Uploading the reverse shell via SMB
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Penetration Testing. Commonly maps to: Security Assessment and Testing, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
so look I maybe got an hour left on my lifeline timeline here don't hold me to it don't hold me accountable don't get mad at me the thing is like we we got the proof. text for shabra but I'm pretty sure they rotate Flags I'll do it later off stream I try to respect everyone's attention what day is it today it's January 2nd 2024 don't forget that four at the end there it's really important now if you if you're wrong then you're very wrong we need to make a directory for n map so we just have a folder to put our stuff in I like to use Tac P because that will force the directory creation or not error if it already exists we'll use end map Tac V for verose because I like to see what's coming as it comes Tac is c for safe default default scripts I think IPC would be very mad at me tag as video …