> For the complete documentation index, see [llms.txt](https://writeups.adityadindi.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://writeups.adityadindi.com/tryhackme/untitled/poster.md).

# Poster

![](/files/-McWPpEdFrjT3HOP3ayk)

![](/files/-McWPlv1X6SOiPqdaI2Q)

## Reconnaissance

Initial nmap scan to find open ports , using the flag "treat all hosts as alive" (**-Pn**)

```
nmap -Pn 10.10.65.15
```

![](/files/-McWQKpylUvP49f1levY)

Detailed Nmap Scan : 

Command Breakdown: 

* (**-sV):** Service version
* (**-sC**): Default nmap scripts
* (**-p):** Specifying ports 22,80,5432
* (**-oN nmap**): Saving it into a file called nmap

```
nmap -sV -sC -p 22,80,5432 -oN nmap 10.10.65.15
```

![](/files/-McWQxuFt0YTOPXOI7Ny)

![](/files/-McWR4aafXlwP7ELQMkb)

## Enumeration

We are told to go to Metasploit and look for a auxiliary module that allows us to enumerate user credentials, so lets do that.

Lets start `Metasploit`

```
msfconsole
```

![](/files/-McWRRG2egZ9ELa82ftQ)

Now lets look for the module

![](/files/-McWSXT5nfvKtxZsP5RD)

Its the 4th one, so lets select it and set the options

![](/files/-McWSmRRTUzCtPdfSyuQ)

Lets now run the enumeration tool

![](/files/-McWSuSeCaSb1e72p6bw)

We have the username and password.

Lets answer the next 2 questions as we have the answers

![](/files/-McWTMh54j9yV0bOlUB6)

Now we have to find the module that will allow us to execute command with the credentials we just found.

![](/files/-McWUIt_TdcUXZyaE0K7)

It is number 6, lets select it and set the options

![](/files/-McWVeB0y_LQnlfGqCj0)

Lets run it.

![](/files/-McWVk1FF5IyjWzLl6k6)

We have the Version, we can answer the next two questions

![](/files/-McWW-ZfI0oJ-GEpxTE5)

Next we have to find the module that will dump user hashes

![](/files/-McWWBL8kQdyXHaxwoo0)

This time it is number 8, so lets select it and set the options

![](/files/-McWUYo95NKvX4l_LjWK)

Lets run it.

![](/files/-McWUdpUt2Y6JhQcI_GD)

We have 6 usernames and their passwords which have been hashed. We can answer the next two questions

![](/files/-McWWXASTEA8dVPeeURL)

Next we have to find the module that will allow an authenticated user to view files of their choosing.

![](/files/-McWWcUmLAlsadEeu9uS)

This time it is number 5, lets select it, set the options and run it.

![](/files/-McWXG2bdPlda_v9sRE4)

![](/files/-McWXKibqhxz18_bk4hV)

![](/files/-McWXOHEGeprAB6UeIMc)

Now , we have to look for the module that allows arbitrary command execution. 

![](/files/-McWXo2BeeUQa10YEZTu)

It is number 2, lets select it and set the options, we can also answer the next two questions

![](/files/-McWZjkwkEdzufYz8YS9)

![](/files/-McWY9WRexZdVfhYgjMn)

Lets run it

![](/files/-McWYHezIpCEW2o7C4Sy)

Looking back at the usernames and credentials we found, we can try to cd into one of the users directory and list the files

![](/files/-McW_7R2SAYRHUYi4qb4)

This file looks interesting, lets read it.

![](/files/-McW_ElRUM4KZGF-v8jf)

We have the password, lets ssh into the machine.

![](/files/-McW_Un7ngTpL2RUu1fD)

## Privilege Escalation

We cannot read the user flag and did not have sudo permissions, so lets run `LinEnum.sh` on the machine to look for interesting files.  First we have to start a http server and download the file on the victim machine.

![](/files/-McWcN-W2ysqQhrHMhOI)

You can stabilize the shell with this command

```
python3 -c 'import pty; pty.spawn("/bin/bash")'
```

Now lets download the file, make sure you are in the tmp folder as other folders do not give permissions to download files.

![](/files/-McWctLySLCkAScSEdgR)

Lets make the script an executable

![](/files/-McWd-aeakfBgoDN80-J)

Now lets run it. 

```
./LinEnum.sh
```

Long story short, I found nothing and I even tried Linpeas but found nothing interesting, maybe I am not looking at the right thing lol, anyways so I remembered there was a web server running on the machine, so I went to `/var/www/html` to look for clues and found this interesting file.

![](/files/-McWecf9MicydqheKQzm)

Lets read it.

![](/files/-McWejDLcKKJBK8hBWnY)

We have the password for the user `Alison`, lets switch users.

![](/files/-McWetIh-l137XoDglFB)

We have `sudo` permission on this user, so lets see what we can run

![](/files/-McWf2ViXofA8wMkD_sY)

Looks like we can run all commands, so lets switch users to root

![](/files/-McWfFV-u_1vV4l8QpBq)

We can now read the user flag and the root flag.

![](/files/-McWfPng8INIK1k4VoAD)