1. We do the usual scan for the IP address. Then, we do the service scan.
2. I went to do a nikto scan while I was using burp suite to investigate the page presented on port 80.
3. Also, I went to dirb to get a directory scan to find anything weird in the folder structure. I found the
assets folder and it only had a few folders in it.
4. Inside of the IMG folder, there was an image that pointed me in the direction to use another port.
“FOLLOW the WHITE RABBIT”.
2. I went to do a nikto scan while I was using burp suite to investigate the page presented on port 80.
3. Also, I went to dirb to get a directory scan to find anything weird in the folder structure. I found the
assets folder and it only had a few folders in it.
4. Inside of the IMG folder, there was an image that pointed me in the direction to use another port.
“FOLLOW the WHITE RABBIT”.
5. We see the different web page. Let’s check out the page source. Looks like there is hash to decode.
6. Once we decode the hash, we have a Matrix quote. I remember seeing that in the theater. Anyway, it looks like it is telling us there may be a file of some kind created from the “>” symbol.
9. Well we have the message:
You can enter into matrix as guest, with password k1ll0rXX
Note: Actually, I forget last two characters so I have replaced with XX try your luck and find correct string
of password.
of password.
10. Ok. So we have a clue to the password for guest. We just need to hit the correct combination of the last two characters. Enter crunch and hydra. You can use the man pages for the commands but the short of it is, you can give it characters to start with and it will keep add combinations of characters that you give it. It will output to a file. With that file, you can use hydra to test ssh for a successful login.
11. We have a successful login but it looks like it is to a restricted shell. We do not have access to a lot of the
usual commands.
usual commands.
https://speakerdeck.com/knaps/escape-from-shellcatraz-breaking-out-of-restricted-unix-shells?slide=9
13. We are out of the restricted shells. Let’s run some commands. We should look at version, folder structure,
files, etc.
14. We have found a few things. There is a weird python executable. Also, I checked the “guest” bash history.
It seems like the account was creating ssh keys to login?
15. I didn’t get anywhere trying to figure out what they were doing for SSH. I moved on to linux priv
checker script to gather more info. It reminded me to check out “sudo –l”. See if there is any commands that
guest can run.
16. Looks like guest can run any command as root. Let’s give it a try. That worked and there’s the flag.
13. We are out of the restricted shells. Let’s run some commands. We should look at version, folder structure,
files, etc.
14. We have found a few things. There is a weird python executable. Also, I checked the “guest” bash history.
It seems like the account was creating ssh keys to login?
15. I didn’t get anywhere trying to figure out what they were doing for SSH. I moved on to linux priv
checker script to gather more info. It reminded me to check out “sudo –l”. See if there is any commands that
guest can run.
16. Looks like guest can run any command as root. Let’s give it a try. That worked and there’s the flag.
and what login and pass for the system?
ReplyDelete