All right.
Now, we saw from the previous lecture that we are able to bring the machine.
By the way, why I didn't know about the IP or how did I know about the IP?
Actually, from the console, from the ridiculously easy itself.
They provide the IP, but imagine they are not providing the IP.
How should I know about this machine?
I would use tool called net discover.
So knit this cover like that and press enter.
By the way, you need to be a root.
No problem.
Press enter.
All right, cool.
Now you can see that we are seeing a lot of machines, actually, including this one.
So let's see.
So you can see that we are seeing this machine.
This is our machine.
Now, you may ask me, how did I know?
Yeah, because the eBay is already provided there.
By the way, here you can see that the eBay is already here.
But how did I know about it?
I need to start guessing one machine, one by one.
Actually, this is the right way.
But because we don't care right now, we already know this is the machine.
So we will assume that this is the machine.
Actually, it is the machine.
It not just assumption.
All right.
Now, this is the first step.
Now we will start scanning this machine.
As we learned previously, we will use the end map utility.
So end map.
We would use the dash as as.
And Dash A and dash B, dash, which is the old boat, by the way, dash as aggressive, which is all
dash speed.
Dash for all boats.
Dash as as this is stealth or sin.
Attack and dash all.
And capital then.
And map underscore.
Scan.
This is to this script.
And provide the IP address of the machine.
Of course, we need to have root access here like this.
So it will start scanning.
Let's wait a little bit to see what it will show us.
All right, cool.
Now we are seeing more information.
Now, if you check here, actually.
So let me scroll a little bit.
Decrease the size of the window.
So here you can see that we are having FTB Anonymous.
FTB login is allowed.
Now this is something very problematic.
Actually, this is the first flat we are seeing here, as you can see.
And we have this folder.
All right.
So the first step is open FTB to this machine.
I?
No, Ms..
Without password.
You can see that we are logging successfully.
Cool.
If I type it, as you can see that here.
Here is our flag.
If I go to the pub.
Less, as you can see that we don't have anything here.
So let's return back.
You can see now let's get this flag.
The text file.
No.
We have it.
Relax.
You can see that we have it here.
So if I type get f x, you can see that flag.
Oh, this is unexpected.
Which is this is a thin point.
By the way, if I go to the browser here and if I type the IP address of the machine, which I will
get from here.
Yeah.
And if I go to the board 1990, by the way, this is I know about from here the admin console.
So press enter, advance, accept the risks and go so you can see that we have this flag.
Now, again, what did we find?
Again, from that end map, you can see that we found this, that we have unknown port, which is this
one.
And as you can see, it is giving us that flag, whatever they found, whatever, ten point.
Okay.
So this port, it seems it is a flag.
So I will use and see as we learned previously the IP address then one, three which is the port here
I think 337.
Okay.
Now you can see that when I tried to connect, we got another flag.
Alright.
Cool.
Now again, we have another boat which is the 60,000, which is this one OC and you can see that it
is fishy.
So again, let's connect to it and let's see what it will show us.
Yeah.
Welcome to Half Baked Reverse Shell.
So you can see that we are here.
So alas, you can see that if I type flag.
Yeah, we got another flag.
But when I try to go to somewhere else, the permission denied.
OC Cool.
So far so good.
Now again, remember when we saw that we have the port 1990 open?
As you can see.
Here it is.
So let's use the derby.
STB is the IP address and it shows the Dutch are.
To search recursively and let's see what we will find.
We didn't find anything.
So let's check this time with both.
90, 90.
We didn't find anything useful again.
Let's search this time with HTTP.
All right.
Like this.
Oh, now we are seeing another things.
As you can see, we are seeing robots here and we have buzzwords.
So let's go to the robots.
By the way, how did I click on this Click Control button and then click the mouse?
This will open the browser for you.
So they are robots, Morty.
It is okay to shoot them.
They are just robots.
As you can see this once again and we have passwords here and the password, we have another flag to
text.
Okay, cool.
Now you can see that it is an easy machine, but it get us to practice more what we learned from the
tools.
Okay, so this password is something else again.
Now, when I go here, if I click right click and to see bedsores, you can see that in the pitch itself.
We have the password and as it is, it is winter.
So this is the password, actually.
So far, so good.
Now, from here, from the robots, we have some tools, actually, or some stuff.
So you can see slash, CGI, bin tress tool, you can copy that and paste it.
So let's duplicate this step.
So let's put it here.
CGI Oh, now we are seeing another stuff.
Now here to enter an IP address.
So let's put whatever IP address we want and trace.
You can see that it is start tracing.
Okay, now let's try.
But let's here.
Now unless they didn't work.
Now let's try.
But semicolon less.
And let's see now.
Yeah, you can see that putting a semicolon.
We are seeing value.
Okay, now, if this did work.
Now let's try.
To use the NC reversion.
So NC here dash and v lp the board for four, four, four.
Now here.
What the semicolon and see.
That's e to open a bash k.
The iPad that is off my machine.
And let me get that.
I have config, which is this one.
Been the boat for four, four, four.
Note its click on press.
You can see that now we are connected.
Now if I type look here you can see that here we are inside it.
ID you can see that here we are using the UUID Apache.
Okay, now let's get some by etsy password, which is where our users on the Linux machine.
By the way, you can see when I tried to use the cash machine, it will show us a cat picture.
So let's try to, for example, tell slash Etsy slash password.
Yeah.
You can see that we have some values or some users and we have these users.
As you can see there, scans is a maltese sum or whatever.
All right.
So let's use the summer user for now.
Just keep that in your mind.
Now, if you scroll up to see what we got again from the scanning, you can see that the port 22 is
open.
All right.
So far, so good.
So now click from this console as a search to the IP address.
Och, actually, 107.
And now let's try the summer user at this IP and press enter.
I can see that it is not working.
Now let's put the capital this time again, it is not working.
Now let's scroll up here.
You can see that from the map.
We are having another command, which is or another port open, which is 222 to 2 22000 to 120 222.
Now let's try this port actually, instead of the such alone.
So here, dash B and one, two, three, four, five.
Press enter o.
Now we are seeing a connection.
Yes.
Now it will ask for password.
Now let's try to get this password that we get from here.
The winter.
Now we are connected.
Now, if I type less, you can see that we have a flag here.
Cat flag again.
It will show us this cat thing.
So it's still flag, whatever.
Yeah, you can see that we have another flag.
Now I am here inside the home somewhere.
So let's go to the home directory.
Now we have some values here, so let's go to Morty.
Yeah.
Oh, we all see we are able to access anything.
So if that's the case.
So actually, let's get all of these files into our local machine.
So let's make directory here.
It's name it lab.
Let's go to it now.
Let's use the step command for secure copy.
The port is five tools and then the user is somewhere at 168.
Eight 107 and then we want the home directory Morty and everything inside it and we want it to be here
on the lap file.
Now the password will be the same, the winter thing, and you can see that now we have all the files,
the save password and the journal text.
Okay, now we have to fight the safe password and we have the journal.
Now, if I open the best the safe password, by the way, we can use the log.
And safe password.
You can see that the command is not found, but we can install it here.
Let's install it.
This is on my local machine, by the way, on Kelly Linux machine.
Okay, now e0g again, safe password.
Whatever.
You can see that we have this picture.
All right, cool.
Now, if I unzip this file.
Journal.
You can see that it is password protected.
So you can see that maybe this image can give us some information.
I would use the string command.
This is to give us a string values.
You can see that the strings.
I mean, sorry, I made the mistake here.
Yeah, you can see that if I scroll up and see that this is the password, the password, file, more
text, whatever.
And this is the password.
All right, so again, unzip the file.
Put the password.
Now we have the text.
So if I open it or get it, actually, here we have another flag.
Now again, let's switch to the machine again.
And the best word this winter.
Okay.
Now we are inside it.
Now let's.
Go.
Pathetic.
This one right now.
Inside it, we have this doesn't contain a flag.
If I get it or let's state it, actually.
Not the flag.
You can see you are totally fine for it.
Whatever.
This is not a flag.
No problem.
Let's go to the another.
Directory.
We have cat safe.
Again.
Cat safe.
Yeah.
You can see that this is it seems that this is a binary file.
So if I type, if I put.
The final command.
You can see that.
Here it is.
Elf executable link format file.
No problem.
Let's try to run this file.
You can see that it will show us permission denied.
Maybe we can run pseudo less.
Winter.
You can see that the.
Sudo or the summer user is not in the suit was fine.
No problem.
Actually, let's get this file into our local machine so quick from here as ACB again.
And this time it will be let's go and get the directory.
And it is.
See if this one.
And then it is safe.
It is winter.
Yeah.
We have the CFA here.
So if I run the safe, you can see that error while loading.
You cannot open short no such file or directory.
By the way, if you got this error, no problem.
Just install the lib script.
So now let's run again.
You can see that whatever something it would tell us that it needs a command line argument.
Now let's get the same file or the same value we got from here as an argument, which is 1313330.
Now we are seeing a different values and actually we are seeing a flag.
By the way, we have here Rick's password hints this is in case I forget, I just hope I don't forget
how to write script to generate potential password.
Also sudo is a really good follow these clues in order.
As you can see one uppercase character one digit and one of the words in my old band's name.
So I need to go to Google and search for Rick Sanchez band's name.
You can see it is the flesh.
CORTINES No problem.
Okay.
Now we want to write a Python script to brute force or to generate a passwords with this value.
So from here.
Then.
As goodbye now from String.
In both.
As key.
Underscore.
Uppercase.
Now here, let's put the band name.
Equal.
Flesh.
And let's put the curtains.
Then F equal.
Open.
Now, let's put a file or open a file.
List the text.
And W as a right now let's make a for loop l in.
Now let's put here as.
Ask.
Underscore uppercase.
Or it's going to have as a shortcut.
We can just put a you and we from here as key uppercase as a Q and digits as the S now again D in the
S so this is four digits and then four and in band name.
Now I have to do it right.
And here in double quotation service as a format backslash and.
In this format and.
Slash D.
Slash N.
And now let's look up to the.
Like this.
So let's save that c mod plus x as to spy.
Now let's run.
Python three as good by.
Now we have lists the text.
Let's get it.
Now?
Yeah, we have all the values that we need.
Now let's use Hydra to brute force the machine.
So Hydra dash us for the both number which will be two to 2 to 2 as is edge because the bot will be
or the protocol is as such.
The IP address.
Then the shell for the username and the username will be.
Rick.
That's capital.
Sanchez.
There's P.
We will use the word list for the world list and it will be list and thus V for verbose and T for threat.
And we will choose four.
Now press enter.
Now let's see what we will find after I did the mistake.
It is Z not as this is the user.
So again, press enter.
Now after sometimes you can see that actually I skip it.
You can see that we have the password.
So now let's try to access this machine through a search using this user and password.
Right now, let's put this user.
And the buzzword will be b7 curtains.
Yeah.
Now we are here.
So if i type sudo su dash again.
Oh.
Now if I type id, you can see that I am inside the root.
Actually I have the root shell.
So if I type flag the text actually tail.
You can see that we have the final flag.
Hope you enjoyed it.
And thanks for.