EMPIRE
RECON & NETWORK SCANNING
1> SCANNED THE NETWORK AND GOT EMPIRE IP LISTED THERE ENDING WITH 133
I.E 192.168.20.137
2> nmap scanning
3> analysing the nmap scan i get the following things for lead .........
present leads to >> web reconnaissance
4> this is how website looks like
5> nothing is the source code ..........
below as we can see i got some disallowed dir's
i.e /~myfiles
got some 404 ...., but the catch is why then myfiles , means we can try brute maybe .....? less try it .....
bruteforcing to ~myfiles
sucessfully getted the endpoint there ....... secret
the pharse i get means i have to brute soemthing more >..........???? maybe we can try as a pentester and i really was solivin hackthebox a lot , i can say , we can try more out there ...... as hidden means we can analyse the source code , anyway if we found that ssh key we can redirect to the ssh to gain privilges as root, after getting user .... lets seee .....
nothing above............... , i have to try something out there more .......
tried to do some ~ fuzz and all but didnt get anything................
AFTER SO MANY TRIES GOT MYSECRET.TXT BELOW
the following is the ssh private key ................
so basically i just putted this into a file to make sure i can use this ssh key to direct login into the user "icex64"
i got a error and imiidiatly started to analyze the key...........
after decoding into the base 64 i got error again .......
saved the file into the lupe_key.rsa , reanalysing the txt given on secrets i got something about that crack thing using fastrack or something hint to the cracking the hash private key .........
putting the rsa key into hash , learned on htb acadmey password attacks module (helpfull.....)
gaining access to ssh
got the flag .......................
as this is my first time on vulnhub i am guessing from here i have to go for root acess ......
trying to gain a root shell (priv esclation)
privilage esclation
as this is a linmux offocurse we will use lipeas and for that i used the following method to upload
analysing the linpeas results ........
after seeing the above result i was like surprise wowww this one is easy not that but yeah i got it in 3rd attempt of analysing , analyzing the linpeas is pretty confusing though..........
we can do python hijacking here .........
webbrowser.py is writable!
arsene (another user )
i was literally misleading the path .... but after seeing the file again i go again and tried to analyse the code and found that my previous command te /bin/bash shell hasnt maded changes to the file............
after that i used the command
as we seen earlier that this is another user there is root also we haev to get our privilages to go there ...........
ROOT
we will be using (GTFOBins - PIP Privilege Escalation:)
i guess there was one more way there out like dirtypipe but this worked for me ...... as dirtypipe has a cve too so yeah !!!!!!!!!!!
dirtypipe
Last updated
Was this helpful?