Getting Started#

This machine is designed to help you practice web application exploitation and Linux privilege escalation. After deploying the machine, you’ll be provided with a vulnerable machine IP. This is a grey-box assessment; the only information provided is the company name and the server’s IP.

Start by pinging the deployed machine or use an Nmap host discovery scan to ensure it’s up.

Use the following Nmap scan to enumerate services:

Scan reveals 7 open ports:

Web Enumeration#

Visit port 80, and you’ll see:

Inspect the page source and find a comment:

Run directory busting on port 80 to find hidden files:

Discovered files: dev.txt and j.txt

dev.txt content:

j.txt gives a hint that J uses a weak password:

Q1: What is the name of the hidden directory on the web server (enter name without /)? Ans: development

SMB Enumeration#

List available shares using smbclient:

Connect to the anonymous share and download staff.txt:

staff.txt reveals J’s username: jan

Q2: What is the username? Ans: jan

Brute Forcing SSH Login#

Use Hydra to brute force Jan’s SSH password:

1
hydra -l jan -P rockyou.txt ssh://<MACHINE_IP> -I -F -V

Successful login found:

Q3: What is the password? Ans: armando

SSH into the machine as Jan, check /etc/passwd to find another user: kay

Q4: What service do you use to access the server? (abbreviation, all caps) Ans: SSH Q5: What is the name of the other user you found? (all lowercase) Ans: kay

Privilege Escalation#

In Kay’s home directory, there’s a file pass.bk, but no read permission:

List hidden files. We see .ssh, which may contain Kay’s private key:

id_rsa (Kay’s private key) is found:

Save the key, convert it for John:

Use John to brute-force the passphrase:

Login as Kay using the cracked private key and passphrase. You now have access to pass.bk:

Q6: What is the final password you obtain? Ans: heresareallystrongpasswordthatfollowsthepasswordpolicy$$

• Brute-forced private key passphrases
• Gained root through SSH and file analysis

Nice work reaching the end!

Let me know if you’d like this exported to Markdown or formatted for a specific platform (e.g., Medium, Dev.to, GitHub Pages).