Vulnhub: INFOSEC PREP: OSCP [by dollarboysushil]

Link to Vulnhub: https://www.vulnhub.com/entry/infosec-prep-oscp,508/

This is very easy vulnhub machine if you have solved couple of easy levels before.

Difficulty:

Beginner/Intermediate

Goal:

Read flag from /

Victim IP: 192.168.1.132
Attacker IP (Kali Linux): 192.168.1.128

Reconnaissance

nmap -sC -sV 192.168.1.132
-sC for default scripts,-sV for version enumeration and -p- to scan all ports.

Visiting the ip we can see wordpress site, the key thing to notice from the wordpress site is: The only user on this box is “oscp”

The first thing whenever I see a website running is to check the page source and let gobuster run.

I didn’t found anything on page source. While the gobuster was running I usually check for /robots.txt

Enumeration

Under /robots.txt we have /secret.txt disallowed

Visiting the /secret.txt we have some kind of encrypted text, looking at the == at list, I can assume this is base64 encoded

CyberChef

Using cyberchef we can decode this string.
The decoded string is rsa key for ssh login.

Save this rsa file.

the command chmod 600 makes a file readable and writable only by its owner, with no permissions for the group or others, this permission is required for rsa file.

Previously we saw there was only 1 user which is oscp and we have rsa key. So lets try to login.

And we are successfully logged in as user oscp.

Privilege Escalation

For privilege escalation I usually choose linpeas script.
Before using script I usually check for suid permission set files , cron jobs etc.

Then I ran
find / -type f -perm /4000 2>/dev/null to list all suid set files

• find: The command used to search for files and directories.
• /: The starting directory for the search (root directory).
• -type f: Specifies that the search is for regular files only.
• -perm /4000: Specifies that the files should have the SUID bit set (permission 4000).
• 2>/dev/null: Redirects standard error (file descriptor 2) to /dev/null, suppressing error messages.

Looking at the result we can see we can see bash has suid permission, which is unusual.

GTFOBins

Using GTFOBins we can elevate privelege

/usr/bin/bash -p

Running /usr/bin/bash -p will start an interactive Bash shell in privileged (restricted) mode. The -p option stands for "privileged”.

Now we can read the flag present in root directory.

d73b04b0e696b0945283defa3eee4538

For any correction / query /suggestion contact on
Instagram dollarboysushil
Twitter (X) dollarboysushil
Youtube dollarboysushil