https://www.vulnhub.com/entry/funbox-rookie,520/
Review
- FTP server allows anonymous login
- Use John to crack each zipfile
- Able to crack 2 users with private keys.
- Only one of the user can be accessed
- Search hidden history files to find for clues
Enumeration
Run nmap scan to find for open ports.
Port 80
Run a gobuster scan to find for hidden directories.
/logs/ gives us not found.
FTP login
Found some clues.
Let’s use john to crack the zip files.
The zip files contain the private keys.
Foothold
We are able to gain access via the rsa key to the tom user.
We have a restricted shell , let’s use a python shell.
Look through the folder and search the history files.
We are able to find a password in the mysql_history
Check sudo permisiions.
Privilege escalation
Since we can run all sudo commands we can just switch to the root user.
Flag is found.
Persecure : my learning archive 