Pistas

  1. Check the root ('/') directory for a file that might hold the key to the first flag on target1.ine.local.
  2. In the server's root directory, there might be something hidden. Explore '/opt/apache/htdocs/' carefully to find the next flag on target1.ine.local.
  3. Investigate the user's home directory and consider using 'libssh_auth_bypass' to uncover the flag on target2.ine.local.
  4. The most restricted areas often hold the most valuable secrets. Look into the '/root' directory to find the hidden flag on target2.ine.local.

Empezamos como siempre con un nmap a todos los puertos

nmap -sV -sC -p- target1.ine.local

image.png

Solo tiene el puerto 80 abierto a si que vamos a ver que web hay.

image.png

La web principal nos redirige a un .cgi vamos a comprobar si es vulnerable con nmap

nmap --script http-shellshock --script-args "http-shellshock.uri=/browser.cgi" target1.ine.local

image.png

State: VULNERABLE (Exploitable) a si que vamos a buscar en Metasploit el módulo shellshock

Usaremos multi/http/apache_mod_cgi_bash_env_exec

Ponemos RHOSTS , LHOST y TARGETURI apuntando a /browser.cgi y lanzamos con run

image.png

Ahora abrimos una shell con shell y /bin/bash -i para hacerla interactiva, para buscar todas las flag, usamos este comando find