# PrivEsc

At this point, We have done quite a lot and have been able to somewhat establish a foothold on our target. We however have not achieved our objective as we haven't pwned the box yet.

To do this, we need to elevate our privileges.

With the much ground we have covered, it is easy to forget that we have only investigated port 80/443.&#x20;

Let's try investigating the next service: FTP.\
\
First I begun with trying the low hanging fruits: anonymous login. I however hit a dead-end since anonymous login was disabled.

Now since we have a username and a password list, let's try a brute force attack using Hydra

```
hydra -l ragnar -P secrets.txt ftp://10.0.2.15
```

<figure><img src="https://2471180453-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FxWmqA1uQQQT74rm6j9M2%2Fuploads%2FxvU22ZPJArhEicCmPQgg%2Fimage.png?alt=media&#x26;token=58ad6276-f28a-4042-9e4d-00692f46ce07" alt=""><figcaption></figcaption></figure>

Hydra found a valid password. Nice. Now our quest can continue.

Let's switch to user Ragnar and try the found FTP password for authentication

It worked!

<figure><img src="https://2471180453-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FxWmqA1uQQQT74rm6j9M2%2Fuploads%2FMvIXnd8v9Qp5KjlYCGp6%2Fimage.png?alt=media&#x26;token=9fbb7852-5c2d-4d70-984a-fff670fd6434" alt=""><figcaption></figcaption></figure>

I continued combing through the directories to see if I could find anything useful. At Ragnar's home directory, I found an interesting file.

<figure><img src="https://2471180453-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FxWmqA1uQQQT74rm6j9M2%2Fuploads%2FqfyRitzr0dMtvHFEtzWg%2Fimage.png?alt=media&#x26;token=4a9dc206-970e-4925-9aa0-6426a81bbbfa" alt=""><figcaption></figcaption></figure>

I tried reading the file to see what it contained.

<figure><img src="https://2471180453-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FxWmqA1uQQQT74rm6j9M2%2Fuploads%2FmnSsSCLOObHtPAWpt19j%2Fimage.png?alt=media&#x26;token=53266dd6-af52-4831-84c9-9a776a632a9e" alt=""><figcaption></figcaption></figure>

Cat seems not to be working correctly. Let's execute it from its binary location.&#x20;

<figure><img src="https://2471180453-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FxWmqA1uQQQT74rm6j9M2%2Fuploads%2Fea3m0wXexz9jhv4R05tG%2Fimage.png?alt=media&#x26;token=b44d78b0-379a-4320-a255-20ce69916665" alt=""><figcaption></figcaption></figure>

We get root's hash.

I tried cracking it using Johntheripper but was not successful.

Next, I decided to investigate the hidden files in ragnar's dome directory

<figure><img src="https://2471180453-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FxWmqA1uQQQT74rm6j9M2%2Fuploads%2FaRRKT2zu1puhAIcxlEZz%2Fimage.png?alt=media&#x26;token=4e0147d3-2722-45b0-8744-459744064b7c" alt=""><figcaption></figcaption></figure>

On reading the file, I discovered that there may be another bashrc file in the system-wide /etc directory

<figure><img src="https://2471180453-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FxWmqA1uQQQT74rm6j9M2%2Fuploads%2Fk3lM5kw92J8MtKOOUUoJ%2Fimage.png?alt=media&#x26;token=2e83d6be-cc61-4abe-b3b3-53f12cbff907" alt=""><figcaption></figcaption></figure>

I decided to investigate this file as well.

On reading the file's contents, I found base64 encoded string

<figure><img src="https://2471180453-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FxWmqA1uQQQT74rm6j9M2%2Fuploads%2F6dsIZdvOkMqymtwAFLIA%2Fimage.png?alt=media&#x26;token=d405252c-962d-4466-92fe-95654876e9b4" alt=""><figcaption></figcaption></figure>

Decoding the string gives a link to a wikipedia page on Kevin Mitnick

<figure><img src="https://2471180453-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FxWmqA1uQQQT74rm6j9M2%2Fuploads%2FvK8fEmdaCeutBnNiPRim%2Fimage.png?alt=media&#x26;token=4e8fc48d-2b46-42ab-ae0d-2db564965981" alt=""><figcaption></figcaption></figure>

This could be a hint for root's password.&#x20;

I tried switching to root using kevinmitnick as the password.

<figure><img src="https://2471180453-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FxWmqA1uQQQT74rm6j9M2%2Fuploads%2FNP2A8yKqrtL2Q27OSaSM%2Fimage.png?alt=media&#x26;token=9cb4c5fe-bc07-4b7e-9298-8fa323adcd2c" alt=""><figcaption></figcaption></figure>

### It worked! And with that we have successfully gained root access/ pwned the box.&#x20;

## To get the flag, I navigated to root's home directory and found the flag in the file named 'hello'

<figure><img src="https://2471180453-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FxWmqA1uQQQT74rm6j9M2%2Fuploads%2Ff3n5W4EVajAU0rSGMGwM%2Fimage.png?alt=media&#x26;token=c3048310-637f-4534-a57b-373bf5e81e25" alt=""><figcaption></figcaption></figure>

