> For the complete documentation index, see [llms.txt](https://writeups.adityadindi.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://writeups.adityadindi.com/tryhackme/untitled/anonforce.md).

# Anonforce

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-McLAihGr3LBhmfH8Xj4%2F-McLBVxul_LUX1yyhDFI%2Fimage.png?alt=media\&token=d872ab83-aae9-4cc9-99fc-8c22784c2cba)

## Reconnaissance

Initial nmap scan to find open ports , using the flag "treat all hosts as alive" (**-Pn**)

```
nmap -Pn 10.10.151.85
```

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-McLC23XV_YSPU-1itiF%2F-McLCUND6zLC2jnrjx6f%2Fimage.png?alt=media\&token=15e02e52-ed6f-437e-8f6c-b8e126035ea4)

Detailed Nmap Scan : 

Command Breakdown: 

* (**-sV):** Service version
* (**-sC**): Default nmap scripts
* (**-p):** Specifying ports 21,22
* (**-oN nmap**): Saving it into a file called nmap

```
nmap -sV -sC -p 21,22 -oN nmap 10.10.151.85
```

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-McLC23XV_YSPU-1itiF%2F-McLCe5lVnNehRbUXv22%2Fimage.png?alt=media\&token=4f80e895-3f49-4970-9b90-0e076319d29b)

## Enumeration

Lets login through FTP as anonymous login is allowed

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-McLCnQ0vAFSS9-X-Qpk%2F-McLCwZB2NZQvHLCOEff%2Fimage.png?alt=media\&token=f9e64c08-69ae-43c8-9db8-4c315dafb3ee)

Looking through we can transfer the user.txt file to our machine, its is located in the home directory of user `melodias`. 

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-McLCnQ0vAFSS9-X-Qpk%2F-McLDTeID3qDSPjZMqyr%2Fimage.png?alt=media\&token=5a106547-3939-412f-bdf0-87d55683b821)

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-McLCnQ0vAFSS9-X-Qpk%2F-McLD_9wrvGUc2-yGGC_%2Fimage.png?alt=media\&token=6dec945c-0dea-4974-8d65-644336ec9e68)

## Exploitation

Looking through the directories there is one directory that is interesting, and there are 2 files that are interesting.

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-McLCnQ0vAFSS9-X-Qpk%2F-McLE7Dq_QNctTykmYK7%2Fimage.png?alt=media\&token=9dae0acd-6f85-4af8-9999-1eb3b2640208)

Now lets transfer these files to our machines

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-McLCnQ0vAFSS9-X-Qpk%2F-McLE_yHd5IoDqycyfZG%2Fimage.png?alt=media\&token=0169962f-9dfe-47e1-8931-a208ef379f48)

We need to crack these files using john the ripper to find a password that we can use to read the `backup.pgp` file as we are not allowed to access it without a password.  Lets do this.

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-McLCnQ0vAFSS9-X-Qpk%2F-McLEwe-YeMQ9w-R_Tvy%2Fimage.png?alt=media\&token=5eab30ef-a2b6-4492-9fa0-d0267335969d)

Now lets crack it

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-McLCnQ0vAFSS9-X-Qpk%2F-McLF3bjrOjUbJJpZdK_%2Fimage.png?alt=media\&token=8478aeda-4ccf-4a30-9b62-b0517bbcc1f9)

Now we have the password, lets first import the `private.asc` file and then decrypt the backup file. 

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-McLCnQ0vAFSS9-X-Qpk%2F-McLFzaKNigDGD50UbBz%2Fimage.png?alt=media\&token=4bf0fdbd-a949-4476-aba2-b5ed75a93c03)

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-McLCnQ0vAFSS9-X-Qpk%2F-McLFx8S4x4ME5tT_ioN%2Fimage.png?alt=media\&token=99166609-75ee-4db1-bfd0-6eed3dbfcf0c)

Lets put in the password we found

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-McLCnQ0vAFSS9-X-Qpk%2F-McLG5-VlPwWZR6RQ_HN%2Fimage.png?alt=media\&token=c495d4cf-5f26-4c92-a9fd-fc119d98b8c2)

We have the root users hash, lets save it into a file called `shadow`.

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-McLCnQ0vAFSS9-X-Qpk%2F-McLGLd97-ejtmFmtc0p%2Fimage.png?alt=media\&token=ccbc691c-8a68-43c2-a372-a5c02bfdc5fb)

Now we have to get the `/etc/passwd` file from the FTP server.

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-McLCnQ0vAFSS9-X-Qpk%2F-McLHJ52AAfqP5rNAwD2%2Fimage.png?alt=media\&token=12bba049-888e-4b11-b8ee-e4090866edc2)

Now lets `unshadow` the file and save it into a file called `output`.

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-McLCnQ0vAFSS9-X-Qpk%2F-McLHZBfqtLe91h6hHl-%2Fimage.png?alt=media\&token=d901236c-743a-4267-9668-0eb755d40d84)

Now lets crack the password

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-McLCnQ0vAFSS9-X-Qpk%2F-McLHbNDx8BcYCXBtEB6%2Fimage.png?alt=media\&token=b136c1fa-3cae-4be4-8d71-0dd910780185)

Now that we have the password, we can login through ssh as root

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-McLCnQ0vAFSS9-X-Qpk%2F-McLHmrGOXaTCWCIW3bv%2Fimage.png?alt=media\&token=382f334b-5aeb-4f0a-9de7-e840be86b849)

We can read the root flag

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-McLCnQ0vAFSS9-X-Qpk%2F-McLHu6GngMDdskvGW4w%2Fimage.png?alt=media\&token=27ece805-3d9b-4bcc-8b8f-360183e34573)