> For the complete documentation index, see [llms.txt](https://writeups.quincyntuli.co.za/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://writeups.quincyntuli.co.za/master.md).

# Masashi (Vulnhub)

This is an excellent beginner box by Donald. The emphasis is on enumeration and how one can easily fall into a rabbit hole when you over zealously follow the initial enumeration like an automaton. Although it could be argued that following 100% like an automaton could land you on the correct path :-)

**/etc/hosts**

It is a good habit learned from HackTheBox to always make an entry on the `/etc/hosts` file. This can assist where a vhosts brute force is necessary. Since these notes are made after-the-fact, it is not necessary to go down the brute-force of vhosts route.

![/etc/hosts host entry](/files/-MU4ex-66Cfg9jsNFFfw)

**nmap**

We run our nmap scan.

```
nmap -sC -sV -p- -v --min-rate=5000 -oA nmap/tcp-masashi.local masashi.local
```

TCP Ports **22** and **80** are open. There is not much one can do with the ssh port (22). There is a man-in-the-middle vulnerability associated with this version and you can read more about it [here](https://www.cybersecurity-help.cz/vdb/openssh/openssh/7.9p1/). That is not the vector pursued on this writeup as I believe it is not the intended route for exploitation.

![TCP port scan](/files/-MU4jFgeJq3HInkQwrER)

A UDP scan was abandoned after 1 hour due to apparent rate limiting issues I could not resolve. The scan did find 1 open port however it was abandoned before the full report regarding the identity of the port scanned.

![UDP port scan](/files/-MU4nY06ef2LUdb9UATH)

Taking a look at that port 80 we arrive at the default Apache page. There is no menu to click through.

![Default Apache page](/files/-MU4r2QLKtwYRAv-Or15)

A common practice for the beginner CTF boxes is trying to browse /robots.txt. It is often a useful shortcut when you are in a hurry. A [gobuster ](https://redteamtutorials.com/2018/11/19/gobuster-cheatsheet/)scan is more effective to enumerate more files. 

```
gobuster dir -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -u http://masashi.local -x php,txt -t 80
```

Gobuster reveals two files we can follow ( /robots.txt, /security.txt )

![gobuster scan](/files/-MU4uhK9qb6k9k6tpm32)

We follow /robots.txt and that further reveals 3 files we can browse \
 ( */snmpwalk.txt* , *sshfolder.txt* and */security.txt*  ).

![robots.txt entries](/files/-MU4vy3bNrvHBSy109kO)

We have a look at these files. First, we notice on /snmpwalk.txt what appears to be scan results from SNMP aware devices. The TFTP entry stands out here because on our UDP scan earlier; nmap did indicate at least one UDP port open. This suggests that UDP port 1337 may be open.

![possible port 1337](/files/-MU51geFDR2nj4vhSgfN)

When we perform an **nmap** scan on that specific port, we get a confirmation that port is indeed open.

![nmap confirm port 1337 is open](/files/-MU52szOMP1C8DYUzYq1)

Let us return to the files listed on /robots.txt earlier. We have not looked at /sshfolder.txt yet but when we do, we find details about a possible username that can be used on SSH. We learn the username is possibly **sv5** and that on the root of the TFTP service we should find the world-readable file called **id\_rsa.pub**. That is a useful file for [passwordless ](https://gist.github.com/RaVbaker/2242349)login to SSH. We will pursue that in a moment.

![entries on /sshfodler.txt](/files/-MU55wjH83zbyQjdbF_P)

Let us visit the last entry on /robots.txt. It turns out to be the obligatory taunt which is common among CTF box creators :-). Hats off to you [@lorde\_zw](https://twitter.com/lorde_zw?lang=en)

![](/files/-MU590_jzhCuaOnZbxS4)

Now we return to that TFTP service in pursuit of that id\_rsa.pub file for a passwordless login. We find a hit to use a password list generating tool called **cewl** that sources words from a webpage.

![hint towards cewl for password list generation](/files/-MU5AvFuaXzDJ5gvizSJ)

So, we do that, we use cewl to create password list from the index page as suggested by the creator.

```
cewl -m 5 -w mycustom.txt http://masashi.local   
```

Then, we try hydra with our custom password list and immediately regret this decision because hydra is so slow for this task.

```
hydra -l sv5 -P mycustom.txt masashi.local ssh -t 4 
```

Instead, we try medusa

```
medusa -u sv5 -P mycustom.txt -h masashi.local -M ssh -t 8 
```

... and after a few seconds, we profit! username is **sv5** and password is **whoistheplug**.

![brute forcing with medusa](/files/-MU5Gssgel0k5Ki5lQpW)

We try those details on SSH and we log in successfully.

![initial foothold achieved](/files/-MU5HmQABErl8D4_gdPD)

as we cat **user.txt** we are greeted with a lovely message from the creator [@lorde\_zw](https://twitter.com/lorde_zw?lang=en) Donald Munengiwa

![a message from the creator](/files/-MU5In697yZnD_FSlpqJ)

Now onto Privilege escalation. A habit I have developed is to run `sudo -l` for any chance that we are part of sudoers. I do this first even before running the awesome Privilege Escalation Awesome Script ( [Thank you, IppSec](https://www.youtube.com/watch?v=6_C9ShH9v2w\&t=940) ). So let us do that.

![checking sudoers](/files/-MU5KSTnSVf8sqBxhgtl)

That tells us that we can run VIM ( vi )  with escalated privileges. VIM is one of the "Living-off-the-land" binaries listed on GTFOBINS that could be used to break into a privileged shell under these circumstances. So we try that. It is better shown on the .gif below

![](/files/-MU5UAFtKlhhY93E6m01)