> For the complete documentation index, see [llms.txt](https://writeups.quincyntuli.co.za/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://writeups.quincyntuli.co.za/master.md).

# Masashi (Vulnhub)

A write-up on the Vulnhub VM by Donald @lorde\_zw

This is an excellent beginner box by Donald. The emphasis is on enumeration and how one can easily fall into a rabbit hole when you over zealously follow the initial enumeration like an automaton. Although it could be argued that following 100% like an automaton could land you on the correct path :-)

**/etc/hosts**

It is a good habit learned from HackTheBox to always make an entry on the `/etc/hosts` file. This can assist where a vhosts brute force is necessary. Since these notes are made after-the-fact, it is not necessary to go down the brute-force of vhosts route.

![/etc/hosts host entry](https://3400994567-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MIr_StCFsotkzyhODP7%2F-MU4ZFRCZBeYGit6pI8o%2F-MU4ex-66Cfg9jsNFFfw%2F01-hosts-file.png?alt=media\&token=35efa89e-d481-4c8d-af3e-89773253fc3f)

**nmap**

We run our nmap scan.

```
nmap -sC -sV -p- -v --min-rate=5000 -oA nmap/tcp-masashi.local masashi.local
```

TCP Ports **22** and **80** are open. There is not much one can do with the ssh port (22). There is a man-in-the-middle vulnerability associated with this version and you can read more about it [here](https://www.cybersecurity-help.cz/vdb/openssh/openssh/7.9p1/). That is not the vector pursued on this writeup as I believe it is not the intended route for exploitation.

![TCP port scan](https://3400994567-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MIr_StCFsotkzyhODP7%2F-MU4ZFRCZBeYGit6pI8o%2F-MU4jFgeJq3HInkQwrER%2F02-nmap-file.png?alt=media\&token=76f04f90-943e-47df-b6e5-bea6c6a4dcba)

A UDP scan was abandoned after 1 hour due to apparent rate limiting issues I could not resolve. The scan did find 1 open port however it was abandoned before the full report regarding the identity of the port scanned.

![UDP port scan](https://3400994567-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MIr_StCFsotkzyhODP7%2F-MU4ZFRCZBeYGit6pI8o%2F-MU4nY06ef2LUdb9UATH%2F03-udp-scan.png?alt=media\&token=782b0e04-0e39-4c7a-af02-ae76247e10a2)

Taking a look at that port 80 we arrive at the default Apache page. There is no menu to click through.

![Default Apache page](https://3400994567-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MIr_StCFsotkzyhODP7%2F-MU4o-FPLFaw_sE3KWGb%2F-MU4r2QLKtwYRAv-Or15%2F04-apache-default-page.png?alt=media\&token=7f99b3dc-9f8c-42aa-bf98-1068c886e3e0)

A common practice for the beginner CTF boxes is trying to browse /robots.txt. It is often a useful shortcut when you are in a hurry. A [gobuster ](https://redteamtutorials.com/2018/11/19/gobuster-cheatsheet/)scan is more effective to enumerate more files. 

```
gobuster dir -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -u http://masashi.local -x php,txt -t 80
```

Gobuster reveals two files we can follow ( /robots.txt, /security.txt )

![gobuster scan](https://3400994567-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MIr_StCFsotkzyhODP7%2F-MU4o-FPLFaw_sE3KWGb%2F-MU4uhK9qb6k9k6tpm32%2F05-go-buster-scan.png?alt=media\&token=86e5d82f-981a-4828-b391-20dcf77982ab)

We follow /robots.txt and that further reveals 3 files we can browse \
 ( */snmpwalk.txt* , *sshfolder.txt* and */security.txt*  ).

![robots.txt entries](https://3400994567-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MIr_StCFsotkzyhODP7%2F-MU4o-FPLFaw_sE3KWGb%2F-MU4vy3bNrvHBSy109kO%2F06-robots_txt.png?alt=media\&token=519b2f0a-8897-49fe-b2ff-5b0903f3c2b9)

We have a look at these files. First, we notice on /snmpwalk.txt what appears to be scan results from SNMP aware devices. The TFTP entry stands out here because on our UDP scan earlier; nmap did indicate at least one UDP port open. This suggests that UDP port 1337 may be open.

![possible port 1337](https://3400994567-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MIr_StCFsotkzyhODP7%2F-MU4o-FPLFaw_sE3KWGb%2F-MU51geFDR2nj4vhSgfN%2F07-tftp-snmp.png?alt=media\&token=1b2de087-ee41-40a7-b17a-598cfb82c6d1)

When we perform an **nmap** scan on that specific port, we get a confirmation that port is indeed open.

![nmap confirm port 1337 is open](https://3400994567-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MIr_StCFsotkzyhODP7%2F-MU51jEgIL4UClrALTwK%2F-MU52szOMP1C8DYUzYq1%2F08-nmap-confirms-1337.png?alt=media\&token=58ec1cf7-0450-4b63-bf19-22b72f7dbb76)

Let us return to the files listed on /robots.txt earlier. We have not looked at /sshfolder.txt yet but when we do, we find details about a possible username that can be used on SSH. We learn the username is possibly **sv5** and that on the root of the TFTP service we should find the world-readable file called **id\_rsa.pub**. That is a useful file for [passwordless ](https://gist.github.com/RaVbaker/2242349)login to SSH. We will pursue that in a moment.

![entries on /sshfodler.txt](https://3400994567-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MIr_StCFsotkzyhODP7%2F-MU54k57mr0psfaXrpp2%2F-MU55wjH83zbyQjdbF_P%2F09-ssh-folder.png?alt=media\&token=ef03ed03-1faa-4c87-b217-191c877753d5)

Let us visit the last entry on /robots.txt. It turns out to be the obligatory taunt which is common among CTF box creators :-). Hats off to you [@lorde\_zw](https://twitter.com/lorde_zw?lang=en)

![](https://3400994567-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MIr_StCFsotkzyhODP7%2F-MU56maSxxOGcTyGzRxb%2F-MU590_jzhCuaOnZbxS4%2F10-taunt.png?alt=media\&token=86f4353a-e533-4402-99f7-68d14726052d)

Now we return to that TFTP service in pursuit of that id\_rsa.pub file for a passwordless login. We find a hit to use a password list generating tool called **cewl** that sources words from a webpage.

![hint towards cewl for password list generation](https://3400994567-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MIr_StCFsotkzyhODP7%2F-MU59ODt5CeipLnvUBEn%2F-MU5AvFuaXzDJ5gvizSJ%2F10-taunt2.gif?alt=media\&token=e57b2b40-5934-43bd-961d-50cf196405f8)

So, we do that, we use cewl to create password list from the index page as suggested by the creator.

```
cewl -m 5 -w mycustom.txt http://masashi.local   
```

Then, we try hydra with our custom password list and immediately regret this decision because hydra is so slow for this task.

```
hydra -l sv5 -P mycustom.txt masashi.local ssh -t 4 
```

Instead, we try medusa

```
medusa -u sv5 -P mycustom.txt -h masashi.local -M ssh -t 8 
```

... and after a few seconds, we profit! username is **sv5** and password is **whoistheplug**.

![brute forcing with medusa](https://3400994567-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MIr_StCFsotkzyhODP7%2F-MU59ODt5CeipLnvUBEn%2F-MU5Gssgel0k5Ki5lQpW%2F11-we-have-user.png?alt=media\&token=e3d56eaf-4b10-4b7d-8ed9-38c6f2fe2f5f)

We try those details on SSH and we log in successfully.

![initial foothold achieved](https://3400994567-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MIr_StCFsotkzyhODP7%2F-MU59ODt5CeipLnvUBEn%2F-MU5HmQABErl8D4_gdPD%2F12-user.png?alt=media\&token=6d6e020f-fbae-4a71-be14-aa9957c8f7af)

as we cat **user.txt** we are greeted with a lovely message from the creator [@lorde\_zw](https://twitter.com/lorde_zw?lang=en) Donald Munengiwa

![a message from the creator](https://3400994567-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MIr_StCFsotkzyhODP7%2F-MU59ODt5CeipLnvUBEn%2F-MU5In697yZnD_FSlpqJ%2F13-user-message.png?alt=media\&token=7fe42905-179c-4ff9-a6e9-c249264d36cb)

Now onto Privilege escalation. A habit I have developed is to run `sudo -l` for any chance that we are part of sudoers. I do this first even before running the awesome Privilege Escalation Awesome Script ( [Thank you, IppSec](https://www.youtube.com/watch?v=6_C9ShH9v2w\&t=940) ). So let us do that.

![checking sudoers](https://3400994567-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MIr_StCFsotkzyhODP7%2F-MU59ODt5CeipLnvUBEn%2F-MU5KSTnSVf8sqBxhgtl%2F14-sudo_l.png?alt=media\&token=87bad3df-88c3-4880-9407-2757c4db0b34)

That tells us that we can run VIM ( vi )  with escalated privileges. VIM is one of the "Living-off-the-land" binaries listed on GTFOBINS that could be used to break into a privileged shell under these circumstances. So we try that. It is better shown on the .gif below

![](https://3400994567-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MIr_StCFsotkzyhODP7%2F-MU5LzZXGbfGkAeRoZbE%2F-MU5UAFtKlhhY93E6m01%2F15-root.gif?alt=media\&token=3d659d02-9684-4665-98f3-b8ad535184d6)