Now after you go the next machine.
And you are on the same network, the bridge network.
Put up your Kleenex.
Now, let's start with sweetness.
Net discovered.
To search for that machine.
Now I can stop the search.
You can see that.
Here it is.
So we start with a map that's for aggressive and with the IP address.
Notice we get a little bit.
Okay.
Now, after we have done the search, you can see that there are a lot of boards open like a such a
SMTP, SMB mail transfer protocol.
And this is something we will use right away because we, as you can see, we can use the verify to
check the username.
Don't worry, we have it next.
Right away.
We have the finger.
We have Bob three.
We have some boards, as you can see.
And finally we have that and us.
Okay.
All right.
Now the first thing, let's use Telnet, the IP address and then let's put the port 25, which is the
SMTP.
Yeah, you can see that we are able to connect.
Now, if I type verify.
I will actually.
Let's see how it is.
Now, this is, by the way.
This is from the standard or autopsy for the XDR-TB.
You can find it that as MTBE use a lot of commands, like verify it started as whatever.
So the verify we are at Y and would X, for example, for the user.
You can see that the reception address rejected user unknown.
So this can be used for getting or give some information from the system.
So if I type 1x0, you can see it returned successfully.
So which means that this user is exist in the system.
All right.
So far, so good.
Right now we will use another.
You can quit from it.
Controls it.
As you can see, it is not working.
Let's open a new tab.
No problem.
Now, as you can see from the previous search of map, that the underpass is opened.
So I will use Mt. Show Mt. the command dash.
E As you can see by the way, if I type man and show mt. you can see show mt. information for an server
and dash e here it will be for the export show the NFA server's export list.
So this is where that.
When you mount, this will be mounted.
So if I type, mount or show mounts actually show mount as a one word dash e the IP address press enter.
You can see that here.
Here is the export list for the IP address, slash home, slash rolodex and start for every type or
method.
Okay, so far so good.
Now, this means that if I type or try to mount it, the mount using the Mount Command dash for dash
for the type and it will be an F s and then with the IP address, colon backslash.
Home backslash.
One x.
And then with it inside a directory.
So actually let's open a new tab.
Let's make sudo mcdeere slash data.
Okay.
Yeah, I already created this directory slash data.
Then I will put it inside slash data like that.
By the way, we have a problem now because this needs a sudo permission.
Okay.
Yeah.
So if I type ls slash data.
Yeah.
Now we are able you can see cannot open the directory but we already have it.
So if I type ls l.
Slash.
And then let's grip the data.
You can see that here.
It has been mounted here.
But the username is nobody.
And.
The group.
Here is some number.
So if I search after I search about it, why it is showing this number when we mount specific and of
us directory or bus system and the reason for that.
Is to mount with virgin.
So let's and mount again.
And mount.
And slash data with pseudo permission.
I forget about it.
Okay.
Clear the screen by type.
Now the less data is empty, which is not mounted.
So this time I will mount.
Of course with sudo i almost forget.
Yeah dusty for the type and fs, but this time I will use the show as option and verge which is virgin
equal three OC.
This is this was the solution after I read some articles so but the IP address.
Home.
Next.
And let's put that inside the data.
So if I type this and if I type L as L, again, grip data.
Oh, you can see this time it is not unknown or whatever.
This time it is 2000, four, eight and 28 here.
Okay.
So which means that we have a user ID and group ID, which is as expected or as something normal.
Can I try to go to it?
So if I see the data or actually I need route permission.
So sudo su dash to go route permission.
See the data?
Yeah.
Still permission denied.
So what is the solution for this?
So if you saw from here from the less grip data.
You can see that?
Yeah.
Actually, I need to go to the list like this.
Yeah, you can see that only this user and this user can go to it.
So if you see, read, write, execute for the owner, which is this one, read, execute for the group
as you can see.
But the others, which is the root, any other user are not allowed.
So a quick solution for this is to create this user on inside our machine.
By the way, this is something mounted from the vulnerable machine or one X machine.
So we want to get to the data after we mount it.
But we are not able how to how to be enabled.
We need to create this user with this UID and this ID and it will consider it that it is correct.
Okay.
Let's start with the group.
So sudo.
Or actually we are so group at.
That's to see what is the options.
You can see we will put the G for g ID.
We don't need an arbitrary g ID or ID user ID.
We need those for the system to understand it is for those OC so group.
At Dash G 2008 and then its name.
It will next for example all all actually next G as a group.
Yeah.
Now let's put user add this time.
That's you again for the user ID 2008.
That's G for the group, which is next g.
And the user would be bottlenecks like this.
So yeah.
So this time after we created the user, let's check if it is created by swift.
Yeah.
Here it is.
The user here x 2000 and the group is this one.
I think I forget about.
I made a mistake here, right?
Grove ad no, I didn't.
Let's check the group ATC.
Groups.
Or a group, actually.
Yeah, the next group it is 2008.
Yeah, but the group for this one is 2000 for the next user.
I mean, it's 2009 because by default after creating a user it will be a default group will be created
for it with a different.
Did whatever.
Okay.
Now, if I type, I'll ask grip data again.
Oh, this time it is not showing for anything.
It is showing for not for 2008.
It is for two for for next and for next group.
So if I try to go sue.
If I actually if I try to go to the data still, I cannot access it.
So let's go to the bottlenecks.
Bottlenecks?
Yeah, right now I am, as you can see.
Who am I?
I am the next user.
So if I try to go to the data.
So this time I am able to access it.
As you can see if I meet w d yeah.
I am inside the data, so which means I am able to access it.
Okay.
Now this is for what user?
For the linux user.
Okay.
Now we want to have as much access as we saw from the map we are able to connect to.
As such, the board is open.
So we need to create, you know that as such how it works.
We have a directory called as such inside the home directory of the user we are enabling.
We are going to connect to or to access it.
So we have it here.
Let's create it inside.
And as naturally as you can see inside the mounted device.
Go to it.
Yeah.
We are inside it.
Now let's make this file.
Authorized underscore.
Keys.
Now let's limit.
Actually, I prefer to have it here.
Here.
Inside it, we would put the public key that will be used to connect to this machine with using the
next user.
So I will go to my machine, local machine, by the way.
This is on my local machine still.
We are still on our local machine on the Linux machine, not the next machine, but we mounted the Linux
and US network file system here and you are editing it here because after all, it is a mounted device
through the network.
Okay.
Now let's go to our SS arch here.
You can see that we don't have any public private key here.
So as s edge dash key gen two g key generation.
Enter, enter, enter.
And as you can see that we have the key.
Now.
Now, let's get the public key.
And here you can see this public key provided here.
Okay.
Where?
Inside the authorized keys.
Okay.
So now if I type ls you can see authorized key is here.
Let's copy paste it.
See here?
Yeah, actually we are here.
Okay, cool.
So far so good.
Now, if I try to go as edge.
What next?
The name of the user.
We are trying to connect to the IP address of the ATM machine and actually it is.
I think it is here.
Sorry.
I forget about the numbers.
Here.
Dash II, which is the private key we are using, which is ID, RSA Press enter.
Yes.
Yeah, we are able to connect, but still it asks for.
Bass so presenter It is not working so well next to see.
No.
It is not working.
No problem.
Let me try delete the dash I option like that.
Yeah.
Again, it's remove this.
It's not.
It's still not working.
Yeah, because you know why?
Because actually, I provided the wrong username here.
I made a mistake.
Here it is.
Well, Nick's not one Lex, so.
Well, Nick's right now.
Yeah, it is working 100% now.
We are, as I searched through the network to the machine.
Now, this is not on my local machine.
This is on the next machine.
So sudo su dash.
Let's try.
Yeah, it will not work because it asks for a password and the password actually we don't have it.
How did we manage to connect?
Because through the search, through the key.
So we as you can see here, it is the authorized keys.
Yeah.
So because we provided the public key here, it worked.
So this is a key public key based authentication.
Not key.
Not password authentication.
Okay.
So what should we do now?
Let's try looking into the machine.
The first thing we do actually is the sudo dash l this is to list what are the commands are.
Allowed for this user to run.
As you can see, user bottlenecks may run the following command in this host.
The sudo edit as you can see this is runs as.
Root and we can able to edit the Etsy export.
And the route, no bus route.
And so to edit this file, by the way, this file is responsible for the export list for the NFS.
Remember when we type the show Mount?
Does she then provide the IP address this and we show remember here let's show it again no problem show
amount that she the IP address actually it's 111 yeah it showed us the slash home well next stop.
So when we mounted this we mounted it the home next directory.
So when we mounted here actually.
And we modified the public key or authorized key.
This was mounted for the home vault.
So this is the export list.
So which is where it will be mounted?
Now, here, the bottlenecks.
As you can see, we are able to using it and editing it using a route.
Because, by the way, if I try to go slash Etsy.
Exports.
You can see that I am yeah I able to read it, but I am not able, as you can see, read only here.
So.
So if I try to go to put something like slash like for the root user, which is for the whole system,
you can see that it is for read only if I type this.
No, it is not working.
And if we try to sudo then.
Etsy export, it will ask for a password and that is not found.
So for that we will use sudo edit atc export press enter.
Yeah.
Now we are able to access it.
So here actually I don't want to mount this home vault next because it is useless.
We are what we want to mount.
Is that the slash like that.
For the root user.
And here you can see root squash.
We can use no root squash, no underscore root squash.
Save it?
Yes.
Now, if I open it again.
Yeah, you can see that it is for the root this time.
Okay, so let me quit from this machine, actually.
From here, from the Knicks.
Now, if I type LSB Al K, you can see that we are or actually the edge.
You can see that we are mounting this on to the data, but you can see that home.
So now I'm mounted.
By the way.
Yeah.
At least for now.
Which, of course.
Now the f dash edge.
Yeah, it is not here anymore.
Now let's mount it again using the same user.
So here, actually, the.
Yeah.
Here it is.
So mount sudo mount and FS Version three this IP address of the machine.
Now this time it will not be home.
One next.
This time we want it to be slash.
Slash data.
Now, you may ask me why we didn't try it from the in the first place.
No, it will not work because you saw how the export list it was slash form bottlenecks.
Otherwise it will not work.
So you can see that.
Yeah.
You can see access denied by server.
Now let me try.
Show Mount again.
Show Mount Dash E the IP address.
You can see that it is still slash home bottlenecks.
So that's why it didn't work.
So the reason for that, actually, we need to restart the machine.
The bottlenecks here, you can see we can just from here and reset it.
As you can see from here.
Yeah.
Now again, if I try this command, the show mounts.
Mount Dash e the IP address.
Here.
You can see this time it is Slash.
All right, cool.
Now let's mount it.
So, by the way, if I have the edge mounted, you can see it is not found.
Mounted mount.
Again.
The same command we used previously.
Dash.
T.
NF us dash or virgin equal three.
The IP address.
By the way, I restarted the machine.
So the IP address has been changed.
Now this time it will be slash and let's put it onto data.
So unless the script data.
OC MC diet data again.
Yeah.
Now let's mount again.
All right, so let's dash and grab data.
Sydney Delta.
Or see this ledge that I'm in.
And as you can see that this time we are able to connect.
So if I go to the Root LLC catch trophy.
Yeah.
We are able to get this, by the way, to have such connection here.
From here, I'll just make a directory like we did previously as such, and just touch the authorized
key, provide the public key, and we are able to connect.
So let's do this actually real quick.
No problem.
So City did as such, by the way, we are still on the local machine here, but this is mounted, but
this time on another directory at home for next it is slash as we did previously.
But because we did change it by the way.
So from here.
Such authorized.
He's.
Limit.
And let's provide the public key.
Our machine.
And with did hear.
Yeah.
Cool.
So far, so good.
Now this time, I will use this the same command.
But this time I will not use the next user.
I will use the root user.
So root like that.
Sorry, I made the mistake.
Typo here.
Root like that.
Yeah.
You can see we are able to connect through the system this time.
Get.
Sophie.
And, yeah, here is the flag.
So as you can see, the machine is not hard.
And the same thing.
It's not easy.
It has a lot of technology, it has a lot of tools, methods, some technologies like SM, TB and the
NFS technology, of course, using some utilities.
All right.