nitesh@gupta
Proving Grounds Linux

Plum

Full walkthrough — enumeration, foothold and privilege escalation.

Nmap output

Nmap scan report for 192.168.239.28
Host is up (0.061s latency).
Not shown: 65533 closed tcp ports (conn-refused)
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.4p1 Debian 5+deb11u1 (protocol 2.0)
| ssh-hostkey: 
|   3072 c9:c3:da:15:28:3b:f1:f8:9a:36:df:4d:36:6b:a7:44 (RSA)
|   256 26:03:2b:f6:da:90:1d:1b:ec:8d:8f:8d:1e:7e:3d:6b (ECDSA)
|_  256 fb:43:b2:b0:19:2f:d3:f6:bc:aa:60:67:ab:c1:af:37 (ED25519)
80/tcp open  http    Apache httpd 2.4.56 ((Debian))
|_http-server-header: Apache/2.4.56 (Debian)
|_http-favicon: Unknown favicon MD5: 2D58FC0104110AF4C9BE979DFD8FD83C
|_http-title: PluXml - Blog or CMS, XML powered !
| http-methods: 
|_  Supported Methods: GET HEAD POST OPTIONS
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

We have PluXml on port 80

Plum walkthrough, Got the reverse shell, screenshot 1
Plum, step 1

Trying admin : admin on admin page

Plum walkthrough, Got the reverse shell, screenshot 2
Plum, step 2

Creds worked and we login as admin

Plum walkthrough, Got the reverse shell, screenshot 3
Plum, step 3

Going to Static Pages

Plum walkthrough, Got the reverse shell, screenshot 4
Plum, step 4

Editing and adding php reverse shell in the page

Plum walkthrough, Got the reverse shell, screenshot 5
Plum, step 5

Opened the page

Plum walkthrough, Got the reverse shell, screenshot 6
Plum, step 6

Got the reverse shell

Plum walkthrough, Got the reverse shell, screenshot 7
Plum, step 7

Got local.txt (d543110567f6801f3bb1de3b9016d68e)

Plum walkthrough, Got the reverse shell, screenshot 8
Plum, step 8

We have port 25 running internally

Plum walkthrough, Got the reverse shell, screenshot 9
Plum, step 9

Checked /var/mail/ and got a mail and inside it we have root password

Plum walkthrough, Got the reverse shell, screenshot 10
Plum, step 10

Used the password and got root

Plum walkthrough, Got the reverse shell, screenshot 11
Plum, step 11

Got proof.txt (96f4058f523566fb9579febdc6123da0)

Plum walkthrough, Got the reverse shell, screenshot 12
Plum, step 12

More walkthroughs

BitForgeLinux

Full walkthrough of the BitForge box on Offensive Security Proving Grounds (Linux). Enumeration across 22/ssh, 80/http, 3306/mysql. Foothold to root using evil-winrm, kerberoasting, linpeas.

CLUELinux

Full walkthrough of the CLUE box on Offensive Security Proving Grounds (Linux). Enumeration across 22/ssh, 80/http, 139/netbios-ssn, 445/netbios-ssn, 3000/http. Foothold to root using evil-winrm, kerberoasting, linpeas.

CockpitLinux

Full walkthrough of the Cockpit box on Offensive Security Proving Grounds (Linux). Enumeration across 22/ssh, 80/http, 9090/http. Foothold to root using evil-winrm, kerberoasting, linpeas.

AccessAD

Full walkthrough of the Access box on Offensive Security Proving Grounds (Active Directory). Enumeration across 53/domain, 80/http, 88/kerberos-sec, 135/msrpc, 139/netbios-ssn. Foothold to root using evil-winrm, kerberoasting, linpeas.

HeistAD

Full walkthrough of the Heist box on Offensive Security Proving Grounds (Active Directory). Enumeration across 53/domain, 135/msrpc, 139/netbios-ssn, 389/ldap, 445/microsoft-ds?. Foothold to root using evil-winrm, kerberoasting, linpeas.

HokkaidoAD

Full walkthrough of the Hokkaido box on Offensive Security Proving Grounds (Active Directory). Enumeration across 53/domain, 80/http, 88/kerberos-sec, 135/msrpc, 139/netbios-ssn. Foothold to root using evil-winrm, kerberoasting, linpeas.