Last updated
Was this helpful?
Last updated
Was this helpful?
Let's begin by performing an nmap scan against the target.
There are two open ports:
Let's visit the website through the browser.
Using CTRL+U we can view the source page.
So there is a user called john.
We can use gobuster to find other web pages that might be useful.
The /secret page seems interesting, let's go there.
Let's get the secretKey.
It seems to be the private key of the john user we saw before.
We can use ssh2john to create a hash file.
Now we can use john to crack the hashes.
Let's change the permissions of the secretKey.
Now we are all set to login through SSH as the john user.
We can now read the user flag.
Let's check what groups john is a part of.
On searching for a while we can find the following article that explains how to escalate the root privilege by exploiting the features of LXD.
We can now locate the root.txt file using the find command.
Let's get the root flag.
https://tryhackme.com/room/gamingserver
22
ssh
80
http
