nitesh@gupta
Proving Grounds Linux

Jordak

Full walkthrough — enumeration, foothold and privilege escalation.

Nmap output

We have ubuntu default page on port 80

Jordak walkthrough, Got reverse shell using busybox nc, screenshot 1
Jordak, step 1

After fuzzing we found thta Jorani v1.0.0 is installed

Jordak walkthrough, Got reverse shell using busybox nc, screenshot 2
Jordak, step 2

Found https://github.com/Orange-Cyberdefense/CVE-repository/blob/master/PoCs/CVE_Jorani.py this unauthenticated RCE & ran the exploit

Got command execution

Jordak walkthrough, Got reverse shell using busybox nc, screenshot 3
Jordak, step 3

Got reverse shell using busybox nc

Jordak walkthrough, Got reverse shell using busybox nc, screenshot 4
Jordak, step 4

Got local.txt (86154fd72458f7180fee669a6d178ab6)

Jordak walkthrough, Got reverse shell using busybox nc, screenshot 5
Jordak, step 5

We have sudo privilege on env

Jordak walkthrough, Got reverse shell using busybox nc, screenshot 6
Jordak, step 6

Ran sudo env /bin/bash & got root

Jordak walkthrough, Got reverse shell using busybox nc, screenshot 7
Jordak, step 7

Got proof.txt (9ee1703c6446b8245fa8e78416602fe8)

Jordak walkthrough, Got reverse shell using busybox nc, screenshot 8
Jordak, step 8

More walkthroughs

BitForgeLinux

Full walkthrough of the BitForge box on Offensive Security Proving Grounds (Linux). Enumeration across 22/ssh, 80/http, 3306/mysql. Foothold to root using evil-winrm, kerberoasting, linpeas.

CLUELinux

Full walkthrough of the CLUE box on Offensive Security Proving Grounds (Linux). Enumeration across 22/ssh, 80/http, 139/netbios-ssn, 445/netbios-ssn, 3000/http. Foothold to root using evil-winrm, kerberoasting, linpeas.

CockpitLinux

Full walkthrough of the Cockpit box on Offensive Security Proving Grounds (Linux). Enumeration across 22/ssh, 80/http, 9090/http. Foothold to root using evil-winrm, kerberoasting, linpeas.

AccessAD

Full walkthrough of the Access box on Offensive Security Proving Grounds (Active Directory). Enumeration across 53/domain, 80/http, 88/kerberos-sec, 135/msrpc, 139/netbios-ssn. Foothold to root using evil-winrm, kerberoasting, linpeas.

HeistAD

Full walkthrough of the Heist box on Offensive Security Proving Grounds (Active Directory). Enumeration across 53/domain, 135/msrpc, 139/netbios-ssn, 389/ldap, 445/microsoft-ds?. Foothold to root using evil-winrm, kerberoasting, linpeas.

HokkaidoAD

Full walkthrough of the Hokkaido box on Offensive Security Proving Grounds (Active Directory). Enumeration across 53/domain, 80/http, 88/kerberos-sec, 135/msrpc, 139/netbios-ssn. Foothold to root using evil-winrm, kerberoasting, linpeas.