HackMyVm : Translator Writeup

July 14, 2022

Hackmyvm: Translator

OS: Debian
Web-Technology:

IP: 192.168.1.83

Flag:
⇒ user flag : REDUCTED
⇒ root flag : REDUCTED

USERS:
⇒ india
⇒ ocean

CREDENTIALS (ANY):
⇒ ocean : ayurv3d4

=========================================================================
NMAP RESULTS:
   22/tcp open ssh OpenSSH 8.4p1 Debian 5 (protocol 2.0)
   | ssh-hostkey:
   | 3072 08:cf:50:b2:4f:41:43:c4:66:56:ce:96:b9:04:8c:77 (RSA)
   | 256 40:b7:11:24:76:59:cd:e0:79:db:71:d1:39:29:d5:45 (ECDSA)
   |_ 256 44:64:ba:b8:52:4f:ca:00:dd:3e:c3:28:71:6f:77:76 (ED25519)
   80/tcp open http nginx 1.18.0
   |_http-server-header: nginx/1.18.0
   |_http-title: Site doesn't have a title (text/html).
   Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

=========================================================================
Web Enumeration:
⇒ Found that page is translating the text in atbash.
⇒

⇒ Output
⇒

⇒ Getting the shell using
⇒

⇒ Inputting that encoded string in input box and hit submit.
⇒

⇒

FILES: /www/data/
⇒ hvxivg
⇒

⇒ Atbash decoded
⇒

→ Password : ayurv3d4

=========================================================================
SSH: | ocean : ayurv3d4 |
→ Enumeration
⇒ sudo -l
⇒

⇒ Getting access to user India
⇒ Reference : https://gtfobins.github.io/gtfobins/choom/#sudo
⇒

=========================================================================
Enumeration: India
→ sudo -l
⇒

=========================================================================
PRIV-ESC:
⇒ Make a copy of /etc/passwd
⇒ Adding custome user in the duplicate /etc/passwd
⇒ Make password for custome user
⇒