Cyborg
January 04, 2024
Task 1 - Deploy the machine
Deploy the machine
No answer needed
Task 2 - Compromise the system
Scan the machine, how many ports are open?
2
What service is running on port 22?
ssh
What service is running on port 80?
http
What is the user.txt flag?
THM
What is the root.txt flag?
THM
nmap -sC -sV -oN nmap 10.10.47.92 -Pn -vv
# Nmap 7.93 scan initiated Thu Jan 4 15:16:12 2024 as: nmap -sC -sV -oN nmap -Pn -vv 10.10.43.109
Increasing send delay for 10.10.43.109 from 0 to 5 due to 58 out of 192 dropped probes since last increase.
Nmap scan report for 10.10.43.109
Host is up, received user-set (0.31s latency).
Scanned at 2024-01-04 15:16:12 PST for 44s
Not shown: 998 closed tcp ports (conn-refused)
PORT STATE SERVICE REASON VERSION
22/tcp open ssh syn-ack OpenSSH 7.2p2 Ubuntu 4ubuntu2.10 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 2048 dbb270f307ac32003f81b8d03a89f365 (RSA)
| ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCtLmojJ45opVBHg89gyhjnTTwgEf8lVKKbUfVwmfqYP9gU3fWZD05rB/4p/qSoPbsGWvDUlSTUYMDcxNqaADH/nk58URDIiFMEM6dTiMa0grcKC5u4NRxOCtZGHTrZfiYLQKQkBsbmjbb5qpcuhYo/tzhVXsrr592Uph4iiUx8zhgfYhqgtehMG+UhzQRjnOBQ6GZmI4NyLQtHq7jSeu7ykqS9KEdkgwbBlGnDrC7ke1I9352lBb7jlsL/amXt2uiRrBgsmz2AuF+ylGha97t6JkueMYHih4Pgn4X0WnwrcUOrY7q9bxB1jQx6laHrExPbz+7/Na9huvDkLFkr5Soh
| 256 68e6852f69655be7c6312c8e4167d7ba (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBB5OB3VYSlOPJbOwXHV/je/alwaaJ8qljr3iLnKKGkwC4+PtH7IhMCAC3vim719GDimVEEGdQPbxUF6eH2QZb20=
| 256 562c7992ca23c3914935fadd697ccaab (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKlr5id6IfMeWb2ZC+LelPmOMm9S8ugHG2TtZ5HpFuZQ
80/tcp open http syn-ack Apache httpd 2.4.18 ((Ubuntu))
| http-methods:
|_ Supported Methods: GET HEAD POST OPTIONS
|_http-title: Apache2 Ubuntu Default Page: It works
|_http-server-header: Apache/2.4.18 (Ubuntu)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
Read data files from: /usr/bin/../share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Thu Jan 4 15:16:56 2024 -- 1 IP address (1 host up) scanned in 43.88 seconds
After that we can browse the admin section which we can see there is a file in the archive section which we can download.
After download extract the tar file into your directory
After that we can navigate to /etc sub directory in the browser
We can see here we have a MD5 hash that we can crack
We will use john the ripper for hash cracking
After john crack the md5 hash we now have a passphrase key which is squidward
As we navigate to the admin shoutbox we can see some keywords like "music_archive"
Then we can extract the backup using borg command and use "squidward" for key
After that we can now see we have a new user in the home directory
After that we can sudo -l see if there is any commands that we can run using sudo
Then use this command to view the root.txt
Or we can use this other way
Go to the file folder of that sudo file
Then include write permission to that command
just add "/bin/bash" at the end and it will move your privilege to root
Last updated