Bounty Hacker
Task 1 - Deploy the machine
🎯 Target IP: 10.10.218.233
Create a directory for machine on the Desktop and a directory containing the scans with nmap.
Task 2 - Reconnaissance
I prefer to start recon by pinging the target, this allows us to check connectivity and get OS info.
Sending these three ICMP packets, we see that the Time To Live (TTL) is ~64 secs. this indicates that the target is a *nix system (probably Linux), while Windows systems usually have a TTL of 128 secs.
2.1 - Find open ports on the machine
sudo
run as root
sC
run default scripts
sV
enumerate versions
A
aggressive mode
T4
run a bit faster
oN
output to file with nmap formatting
It looks like there are only three open ports on the machine.
We just see a good info: tp-anon: Anonymous FTP login allowed (FTP code 230), then, we can try to log with ftp.
2.2 - Who wrote the task list?
We try to access with ftp
We use anonymous login (without psw)
We get two .txt files to read them.
locks.txt
task.txt
Reading task.txt file we can say that the owner of task list is Lin.
2.2 - What service can you bruteforce with the text file found?
The locks.txt file maybe cointains a password list, we know that "lin" is a user and lounch a brute force attack on port 22 (SSH).
2.3 - What is the users flag?
We can use the credentials obtained for ssh access:
2.4 - What is the root flag?
Now, we need to get root permissions to explore the root folder.
We can use sudo -l command to find process with root priviledge:
In this case only: /bin/tar, we find this script on gtfobins website to became a root: https://gtfobins.github.io/gtfobins/tar/
Now, we're root!
Last updated