2.8 - Which command did the attacker manually execute after getting a reverse shell?
whoami
2.9 - What is the computer's hostname?
wir3
2.10 - Which command did the attacker execute to spawn a new TTY shell?
python3 -c 'import pty; pty.spawn("/bin/bash")'
2.11 - Which command was executed to gain a root shell?
sudo su
2.12 - The attacker downloaded something from GitHub. What is the name of the GitHub project?
Reptile
2.13 - The project can be used to install a stealthy backdoor on the system. It can be very hard to detect. What is this type of backdoor called?
rootkit
Task 3 - Hack your way back into the machine
Deploy the machine.
The attacker has changed the user's password! Can you replicate the attacker's steps and read the flag.txt? The flag is located in the /root/Reptile directory. Remember, you can always look back at the .pcap file if necessary. Good luck!
🎯 Target IP: 10.10.123.131
3.1 - Run Hydra (or any similar tool) on the FTP service. The attacker might not have chosen a complex password. You might get lucky if you use a common word list.
We can use hydra with wordlist to find psw for 'jenny' user:
3.3 - Create a listener on the designated port on your attacker machine. Execute the web shell by visiting the .php file on the targeted web server.
Now, we need to listen on the port setted on reverse shell, and access to machine.
As you can see, this shell is not stable. So, we can use the traditional Python script to make it more stable.
python3-c'import pty;pty.spawn("/bin/bash")'
3.4 - Become root!
We know that www-data user haven't root privileges. But we also know that Jenny has root privileges on the machine. So, let us change the user to Jenny and become root.
whoamiwww-datawww-data@wir3:/$sujennysujennyPassword:987654321jenny@wir3:/$sudo-lsudo-l[sudo] password for jenny: 987654321MatchingDefaultsentriesforjennyonwir3:env_reset,mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/binUserjennymayrunthefollowingcommandsonwir3: (ALL:ALL) ALLjenny@wir3:/$sudosusudosuroot@wir3:/
3.5 - Read the flag.txt file inside the Reptile directory
We just say that flag is in path /root/Reptile, then we quickly go them.
