https://www.vulnhub.com/entry/funbox-easyenum,565/
Review
- Run directory enumeration tools to find for clues
- Upload reverse shells to gain access
- Bruteforce users
- Check binary exploits
Enumeration
Run nmap scan to find for open ports.
Port 80
Run a gobuster scan to find for hidden directories.
robots.txt
secret/
mini.php/
In this mini shell we are able to upload files. Let’s upload a php reverse shell and execute it.
Foothold
Access gained.
In the home directory there are the following users.
Use hydra to bruteforce the goat user.
Now we have a user access with a better shell.
Checking sudo permissons.
Privilege escalation
root access gained.
Final flag found.
Persecure : my learning archive 