🐇Year of the Rabbit

Time to enter the warren...

1.Reconnaisance

1.1 Nmap

Using nmap to scan and identify open ports and services

  • We find open port 21, 22, and 80 running ftp ,ssh and http server respectively

  • Webpage is a default Apache landing page

2. Scanning

2.1 Gobuster

  • Directory brute forcing using gobuster on port 80

  • Going over to /assets, we find

  • Viewing style.css, we get another endpoint /sup3r_s3cr3t_fl4g.php

  • Going over, it pops up a warning to tun off the JavaScript and redirects us to a YouTube video of 'Rick Roll'

  • Capturing this request in burp,

  • We get an intermediary path /WExYY2Cv-qU

  • Going over to that path, while forwarding the request one at a time, we get an image Hot_Babe.png

  • Downlaoding the image

  • Using strings on the image, we get an FTP password list for the user ftpuser

  • Saving these to pass.txt

2.2 Hydra

  • Using hydra to brute force ftp password

  • We get the credentials

    ftpuser : 5iez1wGXKfPKQ

  • Login in via FTP, we get a text file Eli's_Creds.txt

  • In that file, we find some weird encoded text

  • Not your typical encoding. This is in fact a programming language called brainfuck and you can decode it here

  • It gives us the credentials

    eli : DSpDiM1wAEwid

3. Gaining access

  • SSHing as Eli, we find a message in the headers

  • It talks about a secret hiding place, with the secret spelled in leet code.

  • Searching for s3cr3t, we find a directory .usr/gamnes/s3cr3t

  • It has a hidden file .th1s_m3ss4ag3_15_f0r_gw3nd0l1n3_0nly!. Reading it

  • We get the credentials

    Gwendoline : MniVCQVhQHUNI

  • Switching user as gwendoline, we find user.txt in her home folder

4. Privilege Escalation

4.1 CVE-2019-14287

  • When using sudo -l, we get

  • There is a !root specified, which means gwendoline can run /usr/bin/vi as any user but the root user

  • Viewing the sudo version we find that it is 1.8.10

  • This version is vulnerable to CVE-2019-14287 and it can be exploited to run as root by prepending sudo -u#-1 to the path of the command that can be run by the user, i.e. sudo -u#-1 /usr/bin/vi /home/gwendoline/user.txt. Read more about it here

  • This opens vi as root, and we can spawn as bash shell by typing :!/bin/sh

  • Reading the root.txt flag

PreviousRootMeNextVulnhub

Last updated