Startup
🔗 Startup
Task 1 - Deploy the machine
🎯 Target IP: 10.10.196.181
Create a directory for machine on the Desktop and a directory containing the scans with nmap.
Task 2 - Reconnaissance
I prefer to start recon by pinging the target, this allows us to check connectivity and get OS info.
Sending these three ICMP packets, we see that the Time To Live (TTL) is ~64 secs. this indicates that the target is a *nix, while Windows systems usually have a TTL of 128 secs.
2.1 - What is the secret spicy soup recipe?
Of course, start to check information scanning open ports:
sudo
run as root
sC
run default scripts
sV
enumerate versions
A
aggressive mode
T4
run a bit faster
oN
output to file with nmap formatting
It looks like there are 2 open ports on the machine: 21, 22, 80.
Now, we need to search which services are running on open ports:
We see that port 21 has anonymous login allowed with accessible files, jump in and get files!
Whoever is leaving these damn Among Us memes in this share, it IS NOT FUNNY. People downloading documents from our website will think we are a joke! Now I dont know who it is, but Maya is looking pretty sus.
That's a pretty info, Maya can be an username!
Using gobuster we try to find hidden path
The best solution is to create a .php reverse shell and put in ftp folder via FTP
We copy php-reverse-shell.php just ready from php webshells folder
and custom it using our IP and Port:
Rename it:
and put in ftp folder via FTP:
and start netcat on the same reverse shell port (444):
Now, we're in! Check flags here..
We see an interesting file "recipe.txt", and we find information that we need!
Someone asked what our main ingredient to our spice soup is today. I figured I can't keep it a secret forever and told him it was love.
Task 3 - What are the contents of user.txt?
We quickly try to find user.txt flag using find command:
but we don't find anything! Then we need to explore files or escalate privileges
We notes an interesting dir called: incidents, with suspicious.pcapng (wireshark ext), we try to get it, but permission is denied!
Then, we can use netcat to open a new connection and transfer it:
We can analyze susp.pcap file using wireshark or strings:
We see this psw: c4ntg3t3n0ughsp1c3 we can try to use it!
Task 4 - What are the contents of root.txt?
We can continue to explore files:
We see that planner.sh will be run as root (with a cron job), and use /etc/print.sh with lennie permission, we can modify it inserting a reverse shell as payload:
Then, we run on our kali machine netcat on the same port (666):
and wait root that will run the planner.sh script once a minute.
Well done! We find root flag:
Last updated