# Devoops ## Gaining Access Nmap scan:

There's only one port open on this machine. ### XXE Injection On port 5000, this is what we see:

We can use `gobuster` on this to find more directories.

`/feed` would bring us here:

XML Injection is pretty helpful, and i noticed that when we upload a file using this API, a POST request would be sent to the `/upload` directory with HTTP form data. However, trying to send any XML files that I created results in a Internal Server Error message being returned. Turns out, there are specific elements that we need to use for this endpoint:

With these, we can wrap them in another tag and start getting successful uploads through.

From this, we identified that we have a user called `roosa`. Then, we can attempt some basic XXE LFI payloads to read the user's private SSH key.

Afterwards, we can simply SSH into the machine.

## Privilege Escalation ### Git Logs When checking the `id` of this user, we see that we are part of the `sudo` group.

Within the home directory of the user, we also find some Git repository files.

Using `find /home -name .git`, we can find the specific location of the Git repository to read its logs.

After heading to that directory, we would find an SSH key after using `git log -p -2`:

Surprisingly, this was the root SSH key.