five86: 1 Walkthrough

five86: 1 Walkthrough

Netdiscover-

Nmap-

Running OpenNetAdmin Service on Port 80-

Found Command Injection Exploit of Exploit-DB-

https://www.exploit-db.com/download/47772

Downloaded the file using wget and changed the file name to .rb file. Next copied to Metasploit exploits directory as-

cp 47772.rb /usr/share/metasploit-framework/modules/exploits/

Using msfconsole with the above module as-

Setting up LHOST and RHOST-

Running the Exploit-(Found Low Privilege shell)-

Enumerating the Directory-

Accessing .htpasswd file-

Found Douglas hash in the .htpasswd file-

So, I found that the password is a 10-character “aefhrt” string, so you’ll need to prepare a 10-character long password dictionary. Here we use crunch to create the dictionary and execute the following command to follow the pattern of the password as the author has said.

Used Crunch-

Usage: crunch <min> <max> [options]

Getting Hash File-

With the help of the above command, we generated a dictionary and used the john ripper to crack the hash value. Here I saved the hash value described above in a text file called “hash” and used dict.txt wordlist to crack the hash value and run the following command.

john --wordlist=/root/dict.txt hash

douglas:$apr1$9fgG/hiM$BtsL9qpNHUlylaLxk81qY1

douglas : fatherrrrr

Privilege Escalation-

Check with sudo -l

Then we can use jen's permissions to add our authorized_keys to ./ssh in his directory, and we can connect to his account.

Since the author has given sudo right on copy program which could be executed as jen hence we can copy the ssh public rsa_key of douglas inside /home/jen/.ssh so that we can be logged as jen. Thus, we executed the following commands as given below.

Now copy id_rsa in the /tmp directory and change the permission then try to access ssh shell on localhost as jen.

Hmmm! As we connected to the ssh shell as jen we found another hint “you have a new mail” on the ssh banner as shown in the given image.

Next-

So, we find a text file “jen” in / var/mails that shows a jen email. As per this message, jen knows the password for the Moss account, so we can use the Moss credential for a further move.

So, switched from Jen’s account to Moss and identified for SUID enabled directories, luckily here we found that the sticky bit is enabled for “upyourgame” as shown in the image.

find / -perm -u=s -type f 2>/dev/null

cd .game

./upyourgame

So we navigate to /home/Moss/.game/ and run the “upyourgame” program, the program launches questionnaires that are only answerable in the YES / NO format, and finally, we get the root shell and find the final flag in the /root directory as shown below.

Thanks!!!