# Super-Spam

## User Flag

We start with an nmap scan.&#x20;

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-Mgp_1UMUOsKLK38giz4%2F-MgpbaUF1gPPAHLR5Csa%2Fimage.png?alt=media\&token=83e6de8b-cc14-4c32-b2cb-2bd045adc3a9)

We see there are a few open ports. Let's head to port 80 and see if wappalyzer can tell us what cms they're using for the website.

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-Mgp_1UMUOsKLK38giz4%2F-MgpdbcTaXSmLbTuqRE0%2Fimage.png?alt=media\&token=21901497-e004-429c-9aaf-11c9df678dbf)

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-Mgp_1UMUOsKLK38giz4%2F-MgpdeJ5R0DNe48rH12X%2Fimage.png?alt=media\&token=2f1b25e6-3840-46ee-b18d-90f3eef6ba43)

We got the CMS and the version. Next step is login to the ftp service and see if we find something interesting.

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-Mgp_1UMUOsKLK38giz4%2F-MgphNvxfREJ_3aHafJa%2Fimage.png?alt=media\&token=e565619c-702b-43e5-b2da-ffcc80e2020c)

We see there are two folders (one of them hidden) and a note. Let's dowload everything to our machine so we can take a better look.

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-Mgp_1UMUOsKLK38giz4%2F-Mgpkf47PJV95oRjZWrK%2Fimage.png?alt=media\&token=8056d37e-9761-467d-adc7-567f97c3523f)

Let's read the notes we found.

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-Mgp_1UMUOsKLK38giz4%2F-MgpdF7TNFGr8wEWXLPX%2Fimage.png?alt=media\&token=07e3c44e-cdfe-4929-afec-c7102b80f756)

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-Mgp_1UMUOsKLK38giz4%2F-MgpklQUQPPA00aEBMkL%2Fimage.png?alt=media\&token=7bcf8a69-20af-4960-b656-5c7e705c7aa6)

Well, apparently the website has been hacked by super-spam and they let us a clue on how they did it. Let's open the **SamsNetwork.cap** file to find out how Super-spam got in.

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-Mgp_1UMUOsKLK38giz4%2F-Mgpov40wdFrs8u855by%2Fimage.png?alt=media\&token=1bab2bcc-9aa4-44c3-aee5-9a1df6826cf2)

The file looks like the one generated when we get a handshake in Wifi hacking. So we can try to crack the password with aircrack.

```
aircrack-ng -w /usr/share/wordlists/rockyou.txt -b d2:f8:8c:31:9f:17 SamsNetwork.cap
```

After a few minutes we get the password

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-Mgp_1UMUOsKLK38giz4%2F-MgpplAB4fErFxgB5yge%2Fimage.png?alt=media\&token=4294edd6-3d3c-4e4c-8eb8-77fe559cd00d)

We got a password but we need a username. Let's take a look around the website and see if we find any username we can use.

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-Mgp_1UMUOsKLK38giz4%2F-MgpqEmnfDWAkV41A_MP%2Fimage.png?alt=media\&token=310ae652-e5d6-42ed-be5a-e32c9be3a830)

Blog posts show us different users. We can write down the users and fuzz the login page.&#x20;

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-Mgp_1UMUOsKLK38giz4%2F-MgprS4Z3YM-GRADsPVN%2Fimage.png?alt=media\&token=e693c78c-e66c-4445-a231-6985f6dd16e3)

We took a wild guess and found Donald Dump is the user to go. But we could've just used hydra or burp suite to fuzz the username.&#x20;

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-MgqUnmlpWYfub6fD4Xk%2F-MgqWhUSuY3JxuIkfk-s%2Fimage.png?alt=media\&token=a15ddd05-178e-449f-a430-307c65e2ed15)

We got it and apparently there's a problem since it show us a TimeoutException.&#x20;

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-MgqUnmlpWYfub6fD4Xk%2F-MgqWp9wMM9I3P0HKmF7%2Fimage.png?alt=media\&token=708d02e7-dbcd-4a1f-9e67-d12712f8ceec)

It doesn't matter. Go to the **<http://IP://concrete5/index.php>** and you'll see you have admin rights on the website.

We can try to get a rev shell editing one of the pages and adding our malicious php file.

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-MgqUnmlpWYfub6fD4Xk%2F-MgqXZH3NXcnvzYNQGGi%2Fimage.png?alt=media\&token=10acd5b1-5091-4ffd-9685-318b7a142eef)

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-MgqUnmlpWYfub6fD4Xk%2F-MgqXdQplQPqslF_mMS_%2Fimage.png?alt=media\&token=ee188b47-42c6-4a82-a49e-1cefbccdb034)

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-MgqUnmlpWYfub6fD4Xk%2F-MgqYAj5dM1zWjkDkE63%2Fimage.png?alt=media\&token=c80b4a4c-8177-4265-b5c9-260d8f91c94d)

We got an error saying the extension is not valid. After a quick search on google I found the following blog post explaining us how we can change the allowed file types:

{% embed url="<https://www.edgescan.com/vulnerabilities-discovered-concrete-5/>" %}

Go to System & Settings > Allowed File types and add the php extension.&#x20;

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-MgqUnmlpWYfub6fD4Xk%2F-MgqY_mejGqg5Y2unHZ6%2Fimage.png?alt=media\&token=1f2632c3-6e16-4dad-8f22-6249d9607d6b)

Let's try to upload again the shell.

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-MgqUnmlpWYfub6fD4Xk%2F-MgqYnHALAtFoRtzx_lm%2Fimage.png?alt=media\&token=a805bd7b-4a24-45cf-8731-001a687a78a3)

Nice. It worked. The website give us a link, now we just have to start a listener and click on the lick to get inside.

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-MgqUnmlpWYfub6fD4Xk%2F-MgqYvbOTTl3bz4tKC7v%2Fimage.png?alt=media\&token=082edc8d-cbe8-4c8e-b511-b851cccaf451)

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-MgqUnmlpWYfub6fD4Xk%2F-MgqZ5K2TK9Oe7LddwpU%2Fimage.png?alt=media\&token=574ef9d3-9de4-4414-a473-6ecde4d1b7e4)

We are in. Taking a look around the machine we find a flag inside the /personal/work folder.&#x20;

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-MgqUnmlpWYfub6fD4Xk%2F-MgqZWLec0MFRCtxJ1cm%2Fimage.png?alt=media\&token=9b2d4d21-db93-4b98-9bcd-4bcb1b9cba67)

## Root Flag

To get root access we have to keep enumerating the machine. We found a note containing the next evil plan but it doesn't look like it has anything useful inside so we have to move on.

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-MgqUnmlpWYfub6fD4Xk%2F-MgqZmvNuY1l-HClpdTY%2Fimage.png?alt=media\&token=30d84008-d232-4a6d-b960-3c55b4aab847)

Inside the Lucy Loser folder we found a hidden folder containing encrypted messages, a script and a note.&#x20;

Let's read the note.&#x20;

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-MgqUnmlpWYfub6fD4Xk%2F-Mgq_KTdeg7nUcq_7LMp%2Fimage.png?alt=media\&token=da4faf86-91a1-449f-aa86-0b8f55c45814)

Let's take a look at the script.

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-MgqUnmlpWYfub6fD4Xk%2F-Mgq_putMJd5WZsl682M%2Fimage.png?alt=media\&token=0c756f13-e9f3-4173-8907-a12a1eb48cfe)

We can download everything to our machine.

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-MgqUnmlpWYfub6fD4Xk%2F-Mgqb77NKnAD5yXLOO1w%2Fimage.png?alt=media\&token=92b02988-69fb-42b1-99e2-22243a3dd36b)

Let's take a look at the pictures.

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-MgqUnmlpWYfub6fD4Xk%2F-MgqbM6XwOJpU3p3ju88%2Fimage.png?alt=media\&token=83180b01-ce7d-4408-abd0-273c118d07fe)

The **d.png** is the clearest one. We can see a password.

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-MgqUnmlpWYfub6fD4Xk%2F-MgqcYr-QFfaY4dd2n8u%2Fimage.png?alt=media\&token=14f5e182-b892-4631-82c4-5006460769bb)

Now we can use the password to login as Donald Dump.

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-MgqUnmlpWYfub6fD4Xk%2F-MgqeSWPYMha_zFACNnB%2Fimage.png?alt=media\&token=699b5f29-72c3-4305-96f8-864a990d789f)

We find the user flag again inside the home folder (We had to change the perms on the folder to get inside).&#x20;

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-MgqUnmlpWYfub6fD4Xk%2F-Mgqevg-YN_9sZsbA2Y9%2Fimage.png?alt=media\&token=0fa25674-dc18-4a0f-bee2-8ed61d53bbb1)

There's an interesting file called **passwd**

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-MgqUnmlpWYfub6fD4Xk%2F-MgqfN2v5rQiXQcHCD5p%2Fimage.png?alt=media\&token=36cf0d42-f441-4157-9173-add39e0d12ac)

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-MgqUnmlpWYfub6fD4Xk%2F-Mgqfp91qCHp1B9DH8QW%2Fimage.png?alt=media\&token=66190f23-ffc6-4aaf-b1ac-562bb73c902a)

After a while trying to decrypt/decode the password with no luck and trying to use the password to login as root or other users we remembered we had another open port with the VNC service.

{% embed url="<https://book.hacktricks.xyz/pentesting/pentesting-vnc>" %}

Let's download the passwd file to our machine.&#x20;

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-MgqUnmlpWYfub6fD4Xk%2F-MgqjcEi9EPFTfjhl-z4%2Fimage.png?alt=media\&token=c7d9dfb4-4ed4-43b0-858a-b00dcaedabfc)

Now let's see if we can login to the service.&#x20;

```
vncviewer -passwd passwd 10.10.58.158::5901
```

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-MgqUnmlpWYfub6fD4Xk%2F-MgqjjCw-GhQmT1hvEnD%2Fimage.png?alt=media\&token=45cebcd4-d9fe-462f-841f-3fba4073d9e8)

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-MgqUnmlpWYfub6fD4Xk%2F-MgqjzKTVxe6efBgcNBM%2Fimage.png?alt=media\&token=8b25c371-c804-4154-b74d-2e8d695772f1)

It worked. Let's grab the flag.

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-MgqUnmlpWYfub6fD4Xk%2F-MgqkIMZpaWgi-kpkZc1%2Fimage.png?alt=media\&token=8e3f4909-f788-47c2-964a-dbee9baf8e56)

Sadly, the flag is encoded and we can't copy and paste it from this shell. We saw there's a .ssh in the root folder so we can generate a ssh key, add it to the authorized\_keys folder and download the private key to our machine to log in as root using ssh.

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-MgqUnmlpWYfub6fD4Xk%2F-Mgqldk-CDu3nAxWqxi7%2Fimage.png?alt=media\&token=d1209c44-14e5-48ad-9086-cbdc29c8ae4c)

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-MgqUnmlpWYfub6fD4Xk%2F-MgqmkKEQuQAd9MaFC6H%2Fimage.png?alt=media\&token=f91d1614-7e32-40fa-bdde-8d1357350f04)

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-MgqUnmlpWYfub6fD4Xk%2F-MgqlnfYTdSoBJsvIRe_%2Fimage.png?alt=media\&token=0cc3094f-ee93-48ce-91fa-4e94f0966a33)

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-MgqUnmlpWYfub6fD4Xk%2F-Mgqm66t5JjCGuVK_klr%2Fimage.png?alt=media\&token=cac8b9db-6a4d-49bb-9696-94f6ba876a61)

Let's see if it works.

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-MgqUnmlpWYfub6fD4Xk%2F-Mgqmpgcb6OaZ2xj51Ts%2Fimage.png?alt=media\&token=200ed8cc-996e-4cb1-8685-a2b572dc7c84)

We're in as root. Grab the encoded flag and decode it using cyberchef.&#x20;

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-MgqUnmlpWYfub6fD4Xk%2F-MgqnAke7Fxs3_kYHnqf%2Fimage.png?alt=media\&token=4ba6c80c-2cd9-4ea6-b082-9c83b8f034da)

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-MgqUnmlpWYfub6fD4Xk%2F-Mgqn7DKKHvUsrZrtH-p%2Fimage.png?alt=media\&token=547221de-f965-4f90-b873-9ac1a4ac6214)
