HACKAISH

Hi Techies,

In this article we are going to crack the box of “Hackaish”. It is a very basic & simple beginner-level challenge box

Deploy the machine

Deploy

Connect to vpn & check for connectivity

Checking connectivity

Reconnaissance

To gather the information of the vulnerabilities of the mchine, we will start with nmap scan

#nmap -sS -sV -O 10.10.245.11

We can see port 22/ssh & port 80/http is open

Without wasting time we will check with the web server

Enumeration

In web-server there is no information, So we will check with the page-source

web-server

Here,we can see the username as “ram”, which is listed

page-source

We will brute-force the user ram using hydra to find the password

#hydra -l ram — P /usr/share/wordlists/rockyou.txt ssh://10.10.245.11 -t4

By brute-forcing we got the password for the user “ram”

Brute-force

Since, ssh port is open, we will login with ssh with the credentials we got

#ssh ram@10.10.245.11

We got the user shell

user -shell

By listing the files using “ls” command we got local.txt file

local.txt flag

In-order to gain root privileges we will do sudo -l

Escalating Privileges

We got /usr/bin/less

We will check with gtfo bins

Here, they listed command

GTFO-Bins

Use those commands to get root user

root flag

We validated both the flags

Validated flags

We completed the box!!!

Hope you enjoyed cracking this box.