Vincent's Shrek KOTH writeup
Recon
nmap
PORT STATE SERVICE VERSION
21/tcp open ftp vsftpd 3.0.2
22/tcp open ssh OpenSSH 7.4 (protocol 2.0)
80/tcp open http Apache httpd 2.4.6 ((CentOS) PHP/7.1.33)
3306/tcp open mysql MySQL (unauthorized)
8009/tcp open ajp13 Apache Jserv (Protocol v1.3)
8080/tcp open http Apache Tomcat/Coyote JSP engine 1.1
9999/tcp open abyss?gobuster
/upload (Status: 301)
/cms (Status: 301)
/api (Status: 301)
/robots.txt (Status: 200)Web Enumeration
shrek.thm/robots.txt
/Cpxtpt2hWCee9VFa.txt
ssh2john.py
Here we can see that there is no password for the ssh key.
SSH
Took a random guess because it's called Shrek.
ls
LinPEAS
From here I downloaded linPEAS from github to find any vulnerabilities.
scp
I needed to get this file onto here
Afterwards it looked like this:
linPEAS.sh
You can't see it here, but the most interesting part was gdb.
After looking on GTFObins, you can find this gdb privilege escalation:
Here's the result:
From here we can find all the flags and defend the title.
Last updated
Was this helpful?