enumeration
starting with network reconnaissance:
nmap -v -sC -sV -oA nmap 10.10.153.21only port 80 was discovered as open. visiting the ip revealed a default ubuntu apache page with limited information. directory enumeration was performed:
gobuster dir -u 10.10.153.21 -w /usr/share/wordlists/dirb/common.txt -t 20 -x .php,.txt,.htma /webdav directory was identified, requiring authentication.
exploitation
default webdav credentials were discovered through research to be wampp:xampp. after authentication, the directory contained minimal content but revealed a password file. using the cadaver tool, a reverse shell was uploaded:
cadaver http://10.10.153.21/webdava reverse shell payload was placed in the webdav directory, then executed by accessing it through the web browser. a netcat listener was established to receive the connection.
shell improvement
the initial shell was upgraded:
python -c 'import pty; pty.spawn("/bin/bash");'privilege escalation
checking sudo permissions revealed access to the cat command without a password requirement. the root flag was obtained:
sudo cat /root/root.txtthe flag was successfully retrieved, completing the challenge.