LazyAdmin
Task 1 - Deploy the machine
🎯 Target IP: 10.10.129.248
Create a directory for machine on the Desktop and a directory containing the scans with nmap.
Task 2 - Reconnaissance
I prefer to start recon by pinging the target, this allows us to check connectivity and get OS info.
Sending these three ICMP packets, we see that the Time To Live (TTL) is ~64 secs. this indicates that the target is a *nix system (probably Linux), while Windows systems usually have a TTL of 128 secs.
2.1 - Find open ports on the machine
sudo
run as root
sC
run default scripts
sV
enumerate versions
A
aggressive mode
T4
run a bit faster
oN
output to file with nmap formatting
It looks like there are only two open ports on the machine: SSH and HTTP.
Task 3 - What is the user flag?
We can strat to explore http://lazyadmin.thm (port 80)
In the page source code we don't found nothing of interisting, the good route is to explore website hidden pathes using gobuster:
We found an administrator login page:
We try default user and password but it doesn't work, then, we see that website uses SweetRice how CMS. We can use searchsploit to find and eventually exploit:
Task 4 - What is the root flag?
Now, we're root!
Last updated