# Traceback


## Enumeration
### Port Scan

root@kali:~/traceback# nmap -p1-10000 -sV -Pn 10.10.10.181 >> nmap.result && echo $'\07' && echo $'\07'

root@kali:~/traceback# nmap -Pn -A -O 10.10.10.181 >> nmap.result && echo $'\07' && echo $'\07'


nothing special in the header and the body, even no cookies.




### Web Content Scan
as it was web service, i scanned this web and got nothing.

### Google
Finally, i searched the clues from `index.html` - "Xh4H" and "backdoor"/"webshell".



and i got the way.





## Foothold
Fortunately, there recorded the user name and the password.




it looks like we can login ssh with this account, so i inject my public key to `/home/webadmin/.ssh/authorized_keys` to make a foothold.




### Lateral Movement
i used three tools to get information for lateral moving, and found the point to switch to another account, and fortunately there was the user flag.
* sudo(linux builtin)
* [Linenum.sh](https://github.com/rebootuser/LinEnum)
* [Pspy](https://github.com/DominicBreuker/pspy)




### User Flag


## Privilege Escalation
i tried to find some files i can write and was a SUID file, but nothing useful.

i turned to target the process which was created by root, and i found some scheculed task runned by root.


(i forgoted to take a screenshot first time, and i got into and redo it again.)
there were two information useful, the first was "it will copy everythings from `/var/backups/.update-motd.d/` to `/etc/update-motd.d/` every 30 seconds", and the second was "root(UID=0) will execute everythings in `/etc/update-motd.d/` when a user login ssh".
actually it seemed like that we can escalate privilege during this 30 seconds via login ssh, and only one thing we need to check whether `/var/backups/.update-motd.d/` or `/etc/update-motd.d/` is writable for sysadmin or webadmin.
1. 
2. 


as i first time tried to inject the public key to `/root/.ssh/authorized_keys`, i failed. it didn't work and i couldn't login as root, and i found the script in `/etc/update-motd.d` was cleaned.
so i did it looply to make sure after i login as other account once the sshd service will inject my key to `/root/.ssh/authorized_keys`.

### Root it