You are currently viewing ClamAV Walkthrough – Offsec Proving Grounds Practice Machine
offsec

ClamAV Walkthrough – Offsec Proving Grounds Practice Machine

This is one of the shortest boxes I came across on PGP. After running a quick NMAP scan, I inspected the open ports as follows:

MSB Port 139

print$ # No access
IPC$ # No access
ADMIN$ # No access

Port 199

Not sure what this is even after using telnet/netcat

SMTP Port 25

Sendmail 8.13.4

Did some research and came across ClamAV Sendmail exploit https://gist.github.com/0xjbb/fdf1678addf0c957bf2b284b29e4dff4#file-cve-2007-4560-go

The exploit can either open a specific port for a bind shell, or can be set to run your own cmd.

Ran the exploit and connect to the newly opened port to get root: