search

🎮Gaming Server

hashtag
Scanning and Enumeration

hashtag
Nmap

First, lets run nmap to find open ports:

┌──(kali㉿kali)-[~/tryhackme/gamingserver]
└─$ nmap -sC -sV 10.10.224.125
Starting Nmap 7.95 ( https://nmap.org ) at 2025-03-30 17:26 EEST
Nmap scan report for 10.10.224.125
Host is up (0.14s latency).
Not shown: 998 closed tcp ports (reset)
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 34:0e:fe:06:12:67:3e:a4:eb:ab:7a:c4:81:6d:fe:a9 (RSA)
|   256 49:61:1e:f4:52:6e:7b:29:98:db:30:2d:16:ed:f4:8b (ECDSA)
|_  256 b8:60:c4:5b:b7:b2:d0:23:a0:c7:56:59:5c:63:1e:c4 (ED25519)
80/tcp open  http    Apache httpd 2.4.29 ((Ubuntu))
|_http-server-header: Apache/2.4.29 (Ubuntu)
|_http-title: House of danak
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 39.87 seconds

2 ports are open; 80 (HTTP) and 22 (SSH).

hashtag
Nikto

Nikto gave told us there is robots.txt

hashtag
Gobuster

Lets check what gobuster gave us:

There are some important directories:

  • robots.txt

  • secret

  • uploads

hashtag
HTTP

Now, lets check port 80 (HTTP).

hashtag
Page Source

If we click on view page source, and go to the buttom, there is a hint:

<!-- john, please add some actual content to the site! lorem ipsum is horrible to look at. -->

This tell us there is a user named john.

hashtag
/robots.txt

It tell us there is a directory named /uploads, which we already found with gobuster.

hashtag
/uploads

In /uploads directory, there are some important files:

Lets copy dic.lst to our kali machine.

For now, lets leave meme.jpg and manifesto.txt. They dont contain important information.

hashtag
/secret

Lets check out this directory:

It contains important information:

This is a secret key for ssh.

Lets copy it to our kali machine.

So, concluding what we need from port 80:

  • username named john

  • ssh key

  • dictionary list (list of passwords)

hashtag
SSH

hashtag
SSH Key

Lets now crack the ssh key using john

First, lets use a change the key to a format john can crack:

Now, lets crack using john, with this command:

john --wordlist=/home/kali/tryhackme/gamingserver/dic.txt id_rsa.txt

Passphrase found:

passphrase is 'letmein'

Now, lets login with ssh using this passphrase:

Before we login, lets change the mode for id_rsa:

Now, lets login:

Lets find the user.txt:

hashtag
Privilege Escalation

If we run id:

We can see that we are in the lxd group. This is golden!

Lets use this link to exploit it: https://www.hackingarticles.in/lxd-privilege-escalation/

first, lets download alpine using the GitHub repose on our machine:

It contains this file: alpine-v3.13-x86_64-20210218_0139.tar.gz

Now, we should move this file to the vulnerable machine:

Lets open an http server on our kali machine:

On the vulnerable machine:

Now, lets add an image using this command:

Lets list our images:

Now, paste these commands (from the link provided above):

Lets check who we are now:

So now, we can access the root flag from /mnt/root/root/rootflag.txt

Root flag:2e337b8xxxxxxxxxxxxxxxxxx

PreviousCat PicturesNextMustacchio

Last updated