Find The panda Machine Write up
Find The Panda
Enumeration
We start by scanning the machine with nmap.
Discover all open ports:
Check what is exactly running on these ports:
Foothold
Port 1337
Port 1337 is running vsftpd 2.3.4, login as anonymous is allowed and apperantely the root direectory of the services is the root dierctory of the machine!!
Either we login thru ftp as anonymous and download user panda ssh private key or we exploit the vulnerbility on this version of vsftpd.
Using search sploit we find a CVE for this version of vsftpd.
Get the poc to our working directory.
Reading the code to see if we need to do some changes.
We should change the port because ftp is not running on the default port.
After running the code now we have RCE on the target and run id command.
Get user panda ssh key.
Copy it to our attakcing machine.
Set up the needed permissions to the file.
1
chmod 600 id_rsa
Login using the key.
1
ssh -i id_rsa [email protected]
Now we can find the user.txt flag in /home/panda.
Privilege Escalation
Running sudo -l to check what the user panda can run using sudo.
Searching for binaries that have SUID bit set.
1
find / -perm -04000 2>/dev/null
We find base64.
We can use it to read files.
1
base64 <file> | base64 -d
https://gtfobins.github.io/gtfobins/base64/#suid
Let us try to read /etc/shadow file.
We can directly read the root flag since we know what its name.
