MoneyBox (Vulnhub WalkThrough)

MoneyBox (Vulnhub WalkThrough)

Vrijanandan Kumar Vrijanandan Kumar

Vrijanandan Kumar

Cyber Security Enthusiast || CTF Player || Security Researchers || Passionate about Securing the Digital World || CEH

发布日期: 2024年5月28日
+ 关注

MoneyBox (Vulnhub WalkThrough)

Today I’m going to solve challenge MoneyBox Vulnhub WalkThrough.

Offensive Security Edit descriptionportal.offsec.com


01.)

Nothing is here


I foynd directory a blogs

Here found directory in source code?

Instresting is a secrete key?

2.) Port Scanning and Service Detection

3.) Here FTP Enumeration


I found a trytofind.jpg file, and downloaded this through get commandcommand?: get <filename >?

Then extract file

command to extract?: steghide extract -sf trytofind.jpg

I found credential username renu then?

04. ssh bruteforce?

I used hydra to crack the password of ‘renu’ user and got the password within 30 seconds. The password for the user ‘renu’ is ‘987654321’.

05. To ssh connected?


Here first Flag!

After that I came to know that another user ‘lily’ also exist in the server, so I moved to lily’s home directory and saw a?.ssh directory over there.

While enumerating the directory I got a ‘authorized_keys’ file in which ‘renu’ was mentioned, which means that renu can connect to ssh with lily without password.

That’s great?!!!.

5.) Privilege Escalation

The first thing that we check after getting the user shell is sudo and user lily has a sudo right in which lily can run perl command as root without password.

Here is last flag!

?Thanks for visiting?




要查看或添加评论，请登录

Vrijanandan Kumar的更多文章

  • Red - TryHackMe Walkthrough
    2024年7月16日

    Red - TryHackMe Walkthrough

    https://tryhackme.com/room/redisl33t Initial Information Gathering We begin our reconnaissance phase with a Nmap scan.

  • Vulnversity — Walkthrough Tryhackme
    2024年7月4日

    Vulnversity — Walkthrough Tryhackme

    Introduction "Vulnversity" is an introductory level room on TryHackMe that covers various penetration testing…

    1 条评论
  • Library Tryhackme
    2024年7月3日

    Library Tryhackme

    Start the VPN you have downloaded and deploy the TryHackMe machine first. Then, ping and check the machine's…

    1 条评论
  • Seppuku | OffSec Writeup
    2024年6月28日

    Seppuku | OffSec Writeup

    Network scanning We used Nmap for port scanning. We used Nmap for port enumeration and discovered the following open…

    1 条评论
  • TryHackMe: Mr. Robot CTF
    2024年6月27日

    TryHackMe: Mr. Robot CTF

    Difficulty: Medium Room URL: https://tryhackme.com/room/mrrobot Scanning It was known that port 80, 443 and 22 were…

  • Tryhackme-GmingServer Walkthrough
    2024年6月3日

    Tryhackme-GmingServer Walkthrough

    Network Enumeration I started the network enumeration by running a port scan using rustscan looking for open ports and…

  • Lazy Admin TryhackMe
    2024年6月2日

    Lazy Admin TryhackMe

    Easy Linux machine to practice your skills Enumeration I started a Rustscan scan and found both an SSH service and a…

  • SQLMAP -TryhackMe Writeup
    2024年5月30日

    SQLMAP -TryhackMe Writeup

    Task 1: Introduction What is Sqlmap ? Sqlmap is an open-source penetration testing tool designed to automate the…

    1 条评论
  • Katana Walkthrough (offsec_lab)
    2024年5月29日

    Katana Walkthrough (offsec_lab)

    https://portal.offsec.

  • Gaara Vulnhub(walkthrough)
    2024年5月28日

    Gaara Vulnhub(walkthrough)

    Gaara Vulnhub(walkthrough) 01.) Target Discovery with Nmap 02.

社区洞察

其他会员也浏览了