Gaming Server
Una maquina Boot2root facil para principiantes.
Recon
We start with a port scan using nmap
To begin with, let's take a look at the source code of the page where we find a comment from the devs
With this it can be deduced that there is a user john.
Investigating a little more we see that it has a directory /uploads which contains a dict.lst which appears to be a dictionary with passwords.
Using Gobuster we see another directory /secrets which has an RSA key
We copy the key to our machine and give it permissions with: chmod 600 id_rsa.
With this key we can try to login via ssh with ssh -i id_rsa john@10.10.192.142 but it asks for the password.
Taking into account that we have a dictionary with possible passwords we can use ssh2john
And then using john and the dictionary, we can crack the key that was used with the RSA key.
Privilege Escalation
Now we can log in via ssh and start with the privilege escalation.
With the id command we can see that we are part of the lxd group and doing some research on the internet we can see that we are able to escalate privileges thanks to this group.
In our machine
Then, we upload the files lxd.tar.xz and rootfs.squashfs to the vulnerable machine.
We add the images
We create a container and add the root path
We run the container:
And that's it, we should now have root privileges.
If any part of the privilege escalation doesn't work for you, here is the repository so you can investigate for yourselves Hacktricks Github.
Last updated