00

Here the starting with something very simple. You need to read the content of the key.txt file.

pentesterlab@c2eb00eb489d:~$ cat key.txt

01

In this challenge, the key is in the home directory of another user. To get to that directory, you can use the cd command. You can go up one directory using: cd ..

pentesterlab@1a5eb7918a5b:~$ cd ..
pentesterlab@1a5eb7918a5b:/home$ ls
pentesterlab  victim
pentesterlab@1a5eb7918a5b:/home$ cd victim/
pentesterlab@1a5eb7918a5b:/home/victim$ cat key.txt

02

This challenge is very similar to the previous exercise. The main difference is the permissions set on the victim directory. This time, you won't be able to list the content of the /home/victim directory. But you can still use cat to get the content of the key.txt file.

pentesterlab@a8930d23e530:~$ cat /home/victim/key.txt

03

When using a Unix system, it's pretty handy to remember what commands you ran. To do that most shells (where you type the command) keep a file with a list of the previous commands. Here the victim is using bash. The shell bash uses the file .bash_history in the home directory of the user running the commands. The fact that the filename starts with a dot . indicates that it's a hidden file.

Obviously, the list of previous commands ran by the victim can potentially contain interesting information. Here we can get access to this file by:

  • Going to the home directory of the victim.
  • Listing the content of this directory using ls -a (the option a will show the hidden files).
  • Reading the content of the file using cat and trying to find something that looks like a key.
pentesterlab@a575829651f8:/home/victim$ cat .bash_history

04

In the previous challenge, we checked the .bash_history of one user. On most systems, you will have a lot more users and you will need to work faster.

To do this, we can use the find command. We can tell find to search for all the files named .bash_history in the /home directory:

pentesterlab@2e8cfb42b8e1:~$ find /home -name .bash_history
/home/victim65/.bash_history
pentesterlab@2e8cfb42b8e1:~$ cat /home/victim65/.bash_history

05

In this challenge, you will learn about the .bashrc file. This file is loaded when a user start a new shell. It's often used to configure the shell or to load some information. For example, you can use it to define aliases for commands or to save some variables.

To find the .bashrc files we have access to, we can use the find command. We can tell find to search for all the files named .bashrc in the /home directory:

find /home -name .bashrc

From there, you should be able to retrieve the key like in the previous exercises by looking at all the files. Unfortunately, this is not efficient. The key is used in a command to define an alias that will allow the user to just type check instead of the full (fake) command check_ptlab_key .... Using the argument -exec of the find command you should be able to grep for the check keywords:

find /home -name .bashrc -exec grep [PATTERN] {} \;

Where [PATTERN] should be replaced by the pattern you're searching for.

During a review, it's also important to look at the .bash_profile that gets loaded when users log in via a console.

pentesterlab@5f383c4f6da4:~$ find /home -name .bashrc -exec grep check_ptlab_key {} \;

06

In the previous challenge, we checked the .bashrc and found an alias that contained the key. In this challenge, the key is defined in an environment variable using the export command. This will allow the user to type $PTLAB_KEY instead of the key every time they need to use the key.

find /home -name .bashrc -exec grep export {} \;

07

bash is not the only shell users can pick. They can use sh, zsh, ksh. In this example, you will need to find the user that uses zsh and review the content of its .zsh_history file.

pentesterlab@b29d0a9a20f6:~$ find /home -name .zsh_history
/home/victim56/.zsh_history

08

In the previous challenges, all users had their home directory in /home (which is very common). However, it's not always the case (especially for service accounts). In this challenge, the home directory of one of the users is not in /home. You can find the location of this home directory by inspecting /etc/passwd.

Once you find the user with the home directory outside of /home. You should be able to find the key by using one of the methods seen in the previous challenges.

cat /etc/passwd | grep -v /home

victim99:x:1082:1082::/srv/victim99:/bin/bash

09

In the previous challenges, we checked the .bash_history of users. One quick way to find passwords is to search for the following mistake: people typing their password in their shell instead of the password prompt. By doing that, their password will be available in the history files.

Here, to make things simple, the password is the key.

What we want to find are all the lines with a call to the command passwd:

$ grep passwd .bash_history

However, this only give us the call to passwd. Thankfully, we can ask grep to provide us the following line using:

$ grep -A 1 passwd .bash_history

Finally, we can wrap this in a find command:

$ find /home -name .bash_history -exec grep -A 1 passwd {} \;

Unfortunately, we get too many results as our grep also match lines containing /etc/passwd. We can ask grep to only match the line starting with passwd by using ^:

$ find /home -name .bash_history -exec grep -A 1 '^passwd' {} \;

pentesterlab@4ee588fc5a15:~$ find /home -name .bash_history -exec grep -A 1 '^passwd' {} \;

10

In this challenge, the user root left a file named backup.tgz in /tmp. Administrators often leave files in /tmp as /tmp gets cleaned up after each reboot. It's often used when you don't want to keep the files you're working on or as a place to share files (as anyone can write in that directory on most systems). Therefore, it's really important when auditing or gaining access to a system to see what files you can find in /tmp.

If you look at the permissions, on the directory:

$ ls -ld /tmpdrwxrwxrwt   1 root root   4096 Mar 12 12:54 tmp

You can see that:

  • tmp is a directory as the line starts with d
  • tmp is available in read, write, execute for everyone.
  • tmp has the sticky bit set: the t at the end of the permissions.

The sticky bit only allows the user who created a file in this directory (or the owner of the directory, ie: root) to modify this file.

Based on the file extension (tgz), the file is a tar archive that has been compressed using gzip. If you decompress the archive, you should find a file that contains the key.

gzip -d backup.tgz

11

In this challenge, the user root left a file named backup.tbz in /var/tmp. Administrators often leave files in /var/tmp. The directory /var/tmp does not get cleaned up after each reboot.

Based on the file extension (tbz), the file is a tar archive that has been compressed using bzip. If you decompress the archive, you should find a file that contains the key.

tar -xvjf file.tbz
bzip2 -d file.tbz

13

openssl enc -d -aes256 -k passs -in backup.tgz.enc -out foo.tgz
tar -xzfv foo.tgz