Nibbles

Nmap Scan

Foothold

First I tried anonymous login on FTP with no results so I moved to web service next, unfortunately multiple ffuf scan did not return much, Nikto found a default apache /icons/README that I also scanned with ffuf for .gif files but that is all that was there, so next I moved to postrgesql.

Postgres required authentication so I went for default creds postgres:postgres and that worked

All databases that I was able to connect to were empty and the one left was not accepting connection

So it seems the only path forward is some way to execute cmmands or read file with postgresql, I search for postgres command execution and find this post https://medium.com/r3d-buck3t/command-execution-with-postgresql-copy-command-a79aef9c2767

Get dj4m’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

I follow the steps explained and read /etc/passwd

Initial Access

with that in hand I move the shell execute

and I get a reverse shell and local.txt flag

Privilege escalation

this was pretty straight forward, I looked for SUID executables and found the command “find” in the list so a quick look at GTFObins gave me this suid exploit command

find . -exec /bin/sh -p \; -quit

And with that I was able to get root access and the proof.txt flag