Valentine

Gaining Access

Nmap scan:

$ nmap -p- --min-rate 5000 10.129.85.98
Starting Nmap 7.93 ( https://nmap.org ) at 2023-05-02 08:30 EDT
Nmap scan report for 10.129.85.98
Host is up (0.0087s latency).
Not shown: 65532 closed tcp ports (conn-refused)
PORT    STATE SERVICE
22/tcp  open  ssh
80/tcp  open  http
443/tcp open  https

Heartbleed

Both the HTTP and HTTPS ports just show this image:

This is a direct hint to use the Heartbleed exploit (the symbol is literally right there!). This exploit takes advantage of the OpenSSL library, allowing attackers to steal information from the memory of the target server.

There are tons of PoCs online for this. I used this.

We can make out some base64 at the end, and when decoded it gives heartbleedbelievethehype.

Web Enumeration

I did a gobuster scan on the web services to see where we can use this thing.

Found a /dev endpoint.

The first directory contains a lot of hex characters. We can download this to a file and convert it from hex to string. This would give a private SSH key:

Since we have a password, we can attempt to write decode the key via openssl.

Afterwards, just SSH in as hype using the key and grab the user flag.

Privilege Escalation

After we are in, we can view the bash history file because it is rather large:

So tmux is on the machine and it might be running. tmux is a terminal multiplexer, which basically means that the terminal is running on another window within the machine. What we can do is just attach ourselves to the existing tmux process and get a root shell.

PreviousTwoMillionNextValidation