Cyborg Room
https://tryhackme.com/room/cybort8
We start with nmap scan
The notes shows us Port 22 / 80 open
For now we use gobuster
We fin that it has revealed /admin and /etc directory
The website look like this
Click on button download to put archive.tar file
shoutbox 'button Admin " where we get some details
Lets visit the /etc directory on the web server
Interesting password and squid.conf files
We use hashcat to crack this password like this (google hashcat format MD5 for help)
hashcat -m 1600 -a 0 hash.txt /home/user/rockyou.txt
We have credentials
$apr1$BpZ.Q.1m$F0qqPwHSOG50URuOVQTTn.:squidward
For now back to our archive
tar -xvf archive.tar
we can list the repository to verify our findings with
borg list path_to_repo
Browsing into home/alex/Documents we can see a note.txt # alex ssh password
connect to ssh [email protected]
We have done user flag!
Next step Privilege Escalation
Run alex@ubuntu:~$ sudo -l
This allow us to run buckup.sh file as sudo.
Done
Finaly a quick
bash -p
will prompt us a nice shell with root permissions.
Enjoy hacking ----------------------------