BOUNTY HACKER CTF

Let’s start from scanning.

nmap -sS <10.129.149.77>

open ports > FTP,SSH,HTTP

start from FTP there is anonymous login allowed

File Enumeration & Data Retrieval

While exploring the system, I located two interesting files: locks.txt and tasks.txt. I proceeded to download them using the get command for further analysis.

Next, I examined the contents of both files using the cat command to check for any useful information, credentials, or clues.

Password Cracking & Initial Access via SSH

• Brute-Forcing Credentials:
• Using the user lin and the wordlist locks.txt obtained earlier, I performed a brute-force attack against the SSH service using Hydra:
• Bash

hydra -l lin -P locks.txt ssh://10.129.149.77

Discovered Credentials:

• Hydra successfully found the valid SSH password:
• Username: lin
• Password: RedDr4gonSynd1cat3
• Gaining Shell Access:
• With these credentials in hand, I authenticated to the target machine via SSH to obtain an initial interactive shell access.

Privilege Escalation

After establishing a successful session on the target machine, the next phase was privilege escalation to achieve root access. I started by running enumeration commands such as sudo -l to check the current user's allowed sudo privileges and ls to inspect the directory contents.

Executing GTFOBins & Spawning Root Shell

• Exploit Command Executed:
• To exploit the sudo permissions assigned to /bin/tar, I executed the standard GTFOBins bypass payload:

Answer the questions below

Get 0xNOVA71’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

Q1: Who wrote the task list?

A: lin

Q2: What service can you bruteforce with the text file found?

A: SSH

Q3: What is the users password?

A: RedDr4gonSynd1cat3

Q4: user.txt

A: THM{CR1M3_SyNd1C4T3}

Q5: root.txt

A: THM{80UN7Y_h4cK3r}

Written by 0xNOVA71