# Smag Grotto

## User Flag

As usually let's start with an nmap scan.

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-MfqbIHmwiIOjZvknIk-%2F-Mfqdl6P7ODZKdDaVo68%2Fimage.png?alt=media\&token=f9e45adb-a4ca-488f-bf83-302963543d8b)

We see there are just two open ports. Let's head to port 80.

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-MfqbIHmwiIOjZvknIk-%2F-MfqeYVFM5eZnmPB8JEq%2Fimage.png?alt=media\&token=af27d187-49f7-44bf-8eaf-d7523ca65e30)

Nothing interesting at sight. Let's try dirsearch.&#x20;

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-MfqbIHmwiIOjZvknIk-%2F-Mfqf-Lhw1AHNGS5nOJw%2Fimage.png?alt=media\&token=1f9cd135-a908-4e30-8e6a-9d58701cb067)

A /mail/ directory. That could be something. Let's check it.&#x20;

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-MfqbIHmwiIOjZvknIk-%2F-Mfqf6HlbKNkCEcPrlQU%2Fimage.png?alt=media\&token=642c51a5-0ccf-4c9c-adf8-801563e0923c)

We see there's a pcap file attached to one of the mails. We can download and see if there's anything useful there.

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-MfqbIHmwiIOjZvknIk-%2F-MfqfHXCnAUYuJ_mxj_h%2Fimage.png?alt=media\&token=1a90e764-c454-47f9-a293-64aedb3294c3)

Using wget:

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-MfqbIHmwiIOjZvknIk-%2F-Mfqg2NJ24jMImDzFtDc%2Fimage.png?alt=media\&token=63d28d7e-6849-41ae-a5fb-b734a6bd44f5)

Fire up wireshark and let's see what we find.&#x20;

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-MfqbIHmwiIOjZvknIk-%2F-MfqgplD-KVQ8yEa4y-K%2Fimage.png?alt=media\&token=6e3285e6-0150-4f69-ba6c-8b671b96cccd)

Now, that's something. We found a domain and credentials. Add **development.smag.thm** to your hosts file.

Let's check the domain.

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-MfqbIHmwiIOjZvknIk-%2F-MfqhGPNH8HHir7wulGi%2Fimage.png?alt=media\&token=c985f5da-3a73-47e8-b63e-9aa85a5f75b8)

We can go to the login and try to access with the credentials we found before.&#x20;

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-MfqbIHmwiIOjZvknIk-%2F-MfqhQLjUg59UMlkE6-X%2Fimage.png?alt=media\&token=bc971331-9ce1-4fa3-a8c3-73d63cb63e42)

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-MfqbIHmwiIOjZvknIk-%2F-MfqhT65mUlFhEO7Eem3%2Fimage.png?alt=media\&token=17575c73-602c-40c5-9119-e1cc0263fd54)

Nice. Now we can try to get a rev shell using a basic command.&#x20;

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-MfqbIHmwiIOjZvknIk-%2F-MfqhxpI1jfH4owrQmFb%2Fimage.png?alt=media\&token=c4650ee6-8a04-40ba-bed1-619de1fd2e0f)

That was easy, no filtering and no need to bypass.&#x20;

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-MfqbIHmwiIOjZvknIk-%2F-Mfqi2r2QL-SRgui6yDO%2Fimage.png?alt=media\&token=f8c2f9b8-647c-45a5-b561-eada8d75c000)

The user flag is in Jake's home folder and we don't have access so we have to find a way to get inside.

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-MfqbIHmwiIOjZvknIk-%2F-MfqiXRO-8rbEdjDjfK5%2Fimage.png?alt=media\&token=cfefe363-07e6-4541-8508-de8121a6bb07)

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-MfqbIHmwiIOjZvknIk-%2F-MfqkKIjRVCepqhMdTiu%2Fimage.png?alt=media\&token=6e8ae538-e6d7-4218-82ab-c34ebe306ba6)

The cronjob is copying the ssh backup to the .ssh folder in Jake's home directory. So now we have to generate a ssh key and try to replace it.&#x20;

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-MfqbIHmwiIOjZvknIk-%2F-Mfqk_hqOPi9YIcgIzIy%2Fimage.png?alt=media\&token=c8db8367-ffb5-4cac-b1d5-83e1de61b524)

We have writing permissions on the jake*id*rsa.pub.backup file. Let's edit it with our own ssh key.

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-MfqbIHmwiIOjZvknIk-%2F-MfqnONATwRCfA8IEL8t%2Fimage.png?alt=media\&token=c5880c62-c569-49b9-8c8a-ef6c9c5edc86)

Once we save the file with the new ssh we have to wait a minute to be able to ssh into the machine.

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-MfqbIHmwiIOjZvknIk-%2F-Mfqnibn0_5xGlfBwZA4%2Fimage.png?alt=media\&token=9d020e4f-1714-4c9c-90f8-bf78fab0d921)

Grab the flag.

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-MfqbIHmwiIOjZvknIk-%2F-MfqnrEHp3HpLymRW8vG%2Fimage.png?alt=media\&token=80c311b0-8671-4fd6-8461-8121ad13a264)

## Root Flag

Using the **sudo -l** command we can use the apt-get command using sudo.

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-MfqbIHmwiIOjZvknIk-%2F-MfqnzT2xI5zb2qQuuKJ%2Fimage.png?alt=media\&token=42322519-6ddc-47ed-9abd-f209eaec06d6)

If we check GTFObins we can see there's a pretty easy way to privesc.&#x20;

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-MfqbIHmwiIOjZvknIk-%2F-Mfqo4rrggaVex__YgCd%2Fimage.png?alt=media\&token=c1ebf81c-ff02-4f61-959c-475c5a9a6458)

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-MfqbIHmwiIOjZvknIk-%2F-MfqoQdUC-hYXJeYQ2jR%2Fimage.png?alt=media\&token=45fac32d-f9b6-413f-986f-ace106f82748)
