Pistas

  1. A vulnerable service maybe running on target1.ine.local. If exploitable, retrieve the flag from the root directory.
  2. Further, a quick interaction with a local network service on target1.ine.local may reveal this flag. Use the hint given in the previous flag.
  3. A misconfigured service running on target2.ine.local may help you gain access to the machine. Can you retrieve the flag from the root directory?
  4. Can you escalate to root on target2.ine.local and read the flag from the restricted /root directory?

Empezamos tirando nmap al target 1:

nmap -A target1.ine.local

image.png

Descubrimos que tiene corriendo un servicio ProFTPD 1.3.5 a si que lo buscamos en searchsploit

searchsploit ProFTPD 1.3.5

image.png

Vamos que tiene módulo metasploit lo usaremos para simplificar el exploit.

service postgresql start && msfconsole

Bucamos el exploit

search ProFTPD 1.3.5

use 0

Vamos a ver que hay que configurar con show options

image.png