Vegeta1 - Proving Grounds Play
Enumeration
Nmap
Initial nmap scan revealed HTTP and SSH ports were open.
Web Enumeration
The website was just showing a header and an image.
Then applied directory brute force and found some endpoints.
Non of the endpoints were useful (rabbit holes). Then checked robots.txt and found find_me endpoint.
It included double base64 encoded comment.
I double decoded it. It showed qr code. Then using ‘zbarimg’ tool I decoded the qr code. It showed a password.
The password was useless, I tried different usernames with this password against SSH and it did not work. Then I applied directory brute forcing with larger list. And found ‘bulma’ enpoint.
Exploitation
The endpoint included a wav file.
The audio was spreading a message in morse. So I found an online morse decoder and ran it. It showed the message which included username and password.
So using this information I got the SSH shell.
Privilege Escalation
I ran linpeas.sh on the target machine. It showed /etc/passwd file was writeable by the current user.
So I can either update root entry or add another entry and assign its id to 0 to make it root.
I did the second one and ran the below command:
pw=$(openssl passwd password); echo "r00t:${pw}:0:0:root:/root:/bin/bash" >> /etc/passwd
Later, I simply got the root.