Smag Grotto
Task 1 - Deploy the machine
🎯 Target IP: 10.10.137.60
Create a directory for machine on the Desktop and a directory containing the scans with nmap.
Task 2 - Reconnaissance
I prefer to start recon by pinging the target, this allows us to check connectivity and get OS info.
Sending these three ICMP packets, we see that the Time To Live (TTL) is ~64 secs. this indicates that the target is a *nix, while Windows systems usually have a TTL of 128 secs.
2.1 - What is the secret spicy soup recipe?
Of course, start to check information scanning open ports:
sudo
run as root
sC
run default scripts
sV
enumerate versions
A
aggressive mode
T4
run a bit faster
oN
output to file with nmap formatting
It looks like there are 2 open ports on the machine: 22, 80.
Now, we need to search which services are running on open ports:
We can start to explore website (80):
we see that website is under development, it means that can be vulnerabilities, try to explore source code:
Nothing of interesting! We can try to use gobuster to search hidden paths:
We find 'only' this good path: http:\\smag.thm/mail
Give focus on this .pcap file (wireshark extension), how first paragraph suggests, we can download all attachments using wget command.
We can open file downloaded using wireshark or command strings:
There's a fantastic info: username=helpdesk&password=cH4nG3M3_n0w
We can use this credentials to try ssh access:
Task 3 - What is the user flag?
We quickly try to find user.txt flag using find command:
Task 4 - What is the root flag?
We can continue to explore files:
We see that planner.sh will be run as root (with a cron job), and use /etc/print.sh with lennie permission, we can modify it inserting a reverse shell as payload:
Then, we run on our kali machine netcat on the same port (666):
and wait root that will run the planner.sh script once a minute.
Well done! We find root flag:
Last updated