Vincent's Shrek KOTH writeup

Recon

nmap

PORT     STATE SERVICE VERSION
21/tcp   open  ftp     vsftpd 3.0.2
22/tcp   open  ssh     OpenSSH 7.4 (protocol 2.0)
80/tcp   open  http    Apache httpd 2.4.6 ((CentOS) PHP/7.1.33)
3306/tcp open  mysql   MySQL (unauthorized)
8009/tcp open  ajp13   Apache Jserv (Protocol v1.3)
8080/tcp open  http    Apache Tomcat/Coyote JSP engine 1.1
9999/tcp open  abyss?

gobuster

/upload (Status: 301)
/cms (Status: 301)
/api (Status: 301)
/robots.txt (Status: 200)

Web Enumeration

shrek.thm/robots.txt

/Cpxtpt2hWCee9VFa.txt

ssh2john.py

Here we can see that there is no password for the ssh key.

SSH

Took a random guess because it's called Shrek.

ls

LinPEAS

From here I downloaded linPEAS from github to find any vulnerabilities.

scp

I needed to get this file onto here

Afterwards it looked like this:

linPEAS.sh

You can't see it here, but the most interesting part was gdb.

After looking on GTFObins, you can find this gdb privilege escalation:

Here's the result:

From here we can find all the flags and defend the title.

Last updated

Was this helpful?