---
description: January 14, 2024
---

# Startup

Maya - user

```
# Nmap 7.94 scan initiated Sun Jan 14 15:41:50 2024 as: nmap -sC -sV -oN nmap -vv -Pn 10.10.247.210
Increasing send delay for 10.10.247.210 from 0 to 5 due to 50 out of 165 dropped probes since last increase.
Increasing send delay for 10.10.247.210 from 5 to 10 due to 11 out of 14 dropped probes since last increase.
Nmap scan report for 10.10.247.210
Host is up, received user-set (0.30s latency).
Scanned at 2024-01-14 15:41:51 PST for 60s
Not shown: 997 closed tcp ports (conn-refused)
PORT   STATE SERVICE REASON  VERSION
21/tcp open  ftp     syn-ack vsftpd 3.0.3
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
| drwxrwxrwx    2 65534    65534        4096 Nov 12  2020 ftp [NSE: writeable]
| -rw-r--r--    1 0        0          251631 Nov 12  2020 important.jpg
|_-rw-r--r--    1 0        0             208 Nov 12  2020 notice.txt
| ftp-syst: 
|   STAT: 
| FTP server status:
|      Connected to 10.9.135.209
|      Logged in as ftp
|      TYPE: ASCII
|      No session bandwidth limit
|      Session timeout in seconds is 300
|      Control connection is plain text
|      Data connections will be plain text
|      At session startup, client count was 4
|      vsFTPd 3.0.3 - secure, fast, stable
|_End of status
22/tcp open  ssh     syn-ack OpenSSH 7.2p2 Ubuntu 4ubuntu2.10 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 b9:a6:0b:84:1d:22:01:a4:01:30:48:43:61:2b:ab:94 (RSA)
| ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDAzds8QxN5Q2TsERsJ98huSiuasmToUDi9JYWVegfTMV4Fn7t6/2ENm/9uYblUv+pLBnYeGo3XQGV23foZIIVMlLaC6ulYwuDOxy6KtHauVMlPRvYQd77xSCUqcM1ov9d00Y2y5eb7S6E7zIQCGFhm/jj5ui6bcr6wAIYtfpJ8UXnlHg5f/mJgwwAteQoUtxVgQWPsmfcmWvhreJ0/BF0kZJqi6uJUfOZHoUm4woJ15UYioryT6ZIw/ORL6l/LXy2RlhySNWi6P9y8UXrgKdViIlNCun7Cz80Cfc16za/8cdlthD1czxm4m5hSVwYYQK3C7mDZ0/jung0/AJzl48X1
|   256 ec:13:25:8c:18:20:36:e6:ce:91:0e:16:26:eb:a2:be (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBOKJ0cuq3nTYxoHlMcS3xvNisI5sKawbZHhAamhgDZTM989wIUonhYU19Jty5+fUoJKbaPIEBeMmA32XhHy+Y+E=
|   256 a2:ff:2a:72:81:aa:a2:9f:55:a4:dc:92:23:e6:b4:3f (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPnFr/4W5WTyh9XBSykso6eSO6tE0Aio3gWM8Zdsckwo
80/tcp open  http    syn-ack Apache httpd 2.4.18 ((Ubuntu))
| http-methods: 
|_  Supported Methods: POST OPTIONS GET HEAD
|_http-server-header: Apache/2.4.18 (Ubuntu)
|_http-title: Maintenance
Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel

Read data files from: /usr/bin/../share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Sun Jan 14 15:42:51 2024 -- 1 IP address (1 host up) scanned in 61.09 seconds

```

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2F8N7sdx8QAgE2X43TU6vu%2Fimage.png?alt=media&#x26;token=859dbf5f-5bf7-421c-b7e2-725796e96b73" alt=""><figcaption></figcaption></figure>

```
ftp 10.10.247.210 21
```

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FaV3IH5oAPhpsGYxbIzmZ%2Fimage.png?alt=media&#x26;token=f6e953e1-28db-4d0f-8f65-cc6837f44849" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FkzrPe9AqJQXMDmcgyFck%2Fimage.png?alt=media&#x26;token=806b80f6-7444-4f53-b807-229e08c1d272" alt=""><figcaption></figcaption></figure>

As you can see we can write and read in the ftp directory therefore we can put reverse shell

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FFZ5Zt2cYR5HEKUPkYHn1%2Fimage.png?alt=media&#x26;token=03fc963f-2d5b-4b36-a6d6-6faae19adc5a" alt=""><figcaption></figcaption></figure>

Execute it via /files in the browser

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FZippuNdjvpBOrUx58Hgm%2Fimage.png?alt=media&#x26;token=f29600a8-f596-4d93-93f8-9abb86c7be88" alt=""><figcaption></figcaption></figure>

Then we can get a reverse shelll

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FDNtvO8jmYQUrJ7j6puBO%2Fimage.png?alt=media&#x26;token=90556f63-42a3-4d1e-8853-9d5a6b65c5f2" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FCNsSaTw8hrvGm1v9PBKk%2Fimage.png?alt=media&#x26;token=2f3ce960-2a69-4cdd-9da2-53bd24f7e04e" alt=""><figcaption></figcaption></figure>

After that we can copy the pcapng file in the /files/ftp since we can write and read in that directory then view that in the browser

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FdbuqR6zlSn7F0qWS6QTu%2Fimage.png?alt=media&#x26;token=e19660aa-dfc0-4a8b-a531-8997bbd9d30f" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2F0Rl34RKjCG7CcgnwJdYk%2Fimage.png?alt=media&#x26;token=5ae90d29-7e48-434b-8de1-dd81f860059a" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FZZ9xRfA2tBQctgGTuV08%2Fimage.png?alt=media&#x26;token=88bfa002-4dc1-4b1f-b379-668dcea9b83b" alt=""><figcaption></figcaption></figure>

Then we will open that wireshark file with wireshark

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FstgJS25wPCAuCBwyyDOP%2Fimage.png?alt=media&#x26;token=fa70d4bf-0c4d-4230-970a-89ed4e20aa25" alt=""><figcaption></figcaption></figure>

Then transfer that file into txt

File > Export Packet Dissections > As plain text

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FviPHDEoOw08ElEKnxTUC%2Fimage.png?alt=media&#x26;token=8aa51003-53cc-4735-a053-6df26a04ad97" alt=""><figcaption></figcaption></figure>

View it in the sublime&#x20;

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FouNz3B9tXLUZjbxk1hGM%2Fimage.png?alt=media&#x26;token=ad18f38e-95c2-449e-9b82-0990966f07a7" alt=""><figcaption></figcaption></figure>

c4ntg3t3n0ughsp1c3

We can see some password initial here

OORRRRRR

We can just follow through TCP stream



<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FxNKlqJDe604iPef2Nou3%2Fimage.png?alt=media&#x26;token=b2e16810-7ed5-4408-8c1c-41d18704d9a1" alt=""><figcaption></figcaption></figure>

c4ntg3t3n0ughsp1c3

Now sign in as lennie using ssh

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2Fu0U0ZSsEquJmaPdwlTgl%2Fimage.png?alt=media&#x26;token=d267ab6b-6fbb-4c14-82e1-8c04fb4eee63" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FHrV2s10QKjLAzlVzqMfq%2Fimage.png?alt=media&#x26;token=0b868716-aa6e-426a-9928-b1d548b9374d" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FNIIdy2d5VPXr2tpWaTB7%2Fimage.png?alt=media&#x26;token=c8296c00-c39e-4d47-83c7-8d12917eecf8" alt=""><figcaption></figcaption></figure>

```
vim planner.sh
```

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FMClfY9pJaTUpWnIYEXXN%2Fimage.png?alt=media&#x26;token=a2c9b28d-2ec2-4649-8753-7b9f668efa00" alt=""><figcaption></figcaption></figure>

As we can see we own the /etc/print.sh

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FGSaQT6fc8fYs9l2pgrpN%2Fimage.png?alt=media&#x26;token=8c2afc1f-1d72-48b0-995a-e10aa3b35e38" alt=""><figcaption></figcaption></figure>

We can write in the /etc/print.sh and copt the bin bash then put SUID so that we can execute it as normal user

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FbbYcZF2JcJfjAsewYZfn%2Fimage.png?alt=media&#x26;token=a1664158-32ee-487e-9097-4d1efbfc4b65" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FjyqHp0cWSoAKJFVxbgwh%2Fimage.png?alt=media&#x26;token=49af788e-2f1d-4a94-ac87-a26797712a47" alt=""><figcaption></figcaption></figure>

Now we own the room
