Bounty Hacker

You talked a big game about being the most elite hacker in the solar system. Prove it and claim your right to the status of Elite Bounty Hacker!

Hello my name is Molapo Manuel aka vantaroot.I am security researcher ,malware researcher and a bug bounty hunter.Enough about me .let hunt down some flags.

Methodology :

Enumeration — Initial access -Privilege Escalation

Enumeration

nmap -sCVS <IP>

Three ports are opened from the port scanned which are ftp , ssh and http.

Port 80 which is http was browsed:

Directory enumeration using dirsearch it revealed two directories images and javascript that are available.

On the image directory http://ip/image it shows a page hosting links.

we found nothing.

But remember that the ports where three one of them was ftp and according to the scan it allowed anonymous login.

i downloaded the files that are on ftp which are locks.txt and task.txt.

i opened the files and they revealed passwords and username which are lin and password we are not sure which one so we are going to use hydra to bruteforce ssh password.

Get vantaroot’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

Using the command:

hydra -l lin -P locks.txt ssh://TARGET_IP -t 4

it showed the password which is RedDr4gonSynd1cat3.

using the credentials i logged in the ssh session.

Got my first flag .

Privilege Escalation

Checked the permission and found out lin can run /bin/tar as root. This can potentially give us a root shell.Using the below command.

sudo tar -cf /dev/null /dev/null --checkpoint=1 --checkpoint-action=exec=/bin/sh

i got in root and i obtained the flag .