> For the complete documentation index, see [llms.txt](https://rouvin.gitbook.io/ibreakstuff/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://rouvin.gitbook.io/ibreakstuff/writeups/hackthebox/medium/lightweight.md).

# Lightweight

## Gaining Access

Nmap scan:

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-7adbe6c0c76e3040d3da29d9a9d856f4a483746f%2Fimage.png?alt=media)

### Website Hints

On port 80, we can find some interesting information.

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-2f6271200436a7f0ef667e2b79b96313b185940c%2Fimage.png?alt=media)

The user page tells us how to use SSH to get into the machine.

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-94a132db076267e767099325d65cee2764a48c7c%2Fimage.png?alt=media)

So our IP address is our username and password for this machine. Interesting.

### LDAP Scan

I found it rather interesting that there was a LDAP service running on this Linux machine, and wanted to enumerate this within the machine as other scans weren't giving me much to work with.

First, we can SSH using our IP address as the username and password. We can view other users on the machine.

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-03c91ca017a81e414c8fc3053ca697f5d0f29189%2Fimage.png?alt=media)

The most interesting part was the within the `/etc/passwd` file, a completely new user was being created for each IP address.

### Sniffing

I was stuck here for a long time because I could not find anything of interest on the machine that we could access.

I found it really odd that LDAP was listening on the machine and I did not know what it was doing. As a last resort, I sniffed the traffic of LDAP using `tcpdump` on port 389. Surprisingly, I found some credentials in plaintext.

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-69aff6cfce9a1b834060433c6bce06778ad4daec%2Fimage.png?alt=media)

We can `su` as `ldapuser2` using this plaintext credential (it's the hash).

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-ad4bcf39f23e756c500512b7a68997e53316a80f%2Fimage.png?alt=media)

## Privilege Escalation

### backup.7z

Within the new user's directory, we can find a backup file.

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-c0d7f11dd5132c8c41f4610f06d7c0729a664551%2Fimage.png?alt=media)

It was password encrypted, but that's no issue for `john`.

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-744f1eb468a2612c437c5d867f7734ff1ae160cf%2Fimage.png?alt=media)

Then, we can extract the files using `7z e`. Within the `status.php` file, we find another set of credentials.

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-2596368acf8defe72059612f55dcee78d57bff55%2Fimage.png?alt=media)

We can now access `ldapuser1`.

### OpenSSL Cap

Within the user directory, we can find that there some binaries present.

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-607527ae7222307620eda696c101e185778532ea%2Fimage.png?alt=media)

The `openssl` and `tcpdump` binaries are identical to the normal ones, but checking the permissions reveals something different.

```
[ldapuser1@lightweight ~]$ getcap tcpdump /usr/sbin/tcpdump
tcpdump = cap_net_admin,cap_net_raw+ep
/usr/sbin/tcpdump = cap_net_admin,cap_net_raw+ep
[ldapuser1@lightweight ~]$ getcap openssl /usr/bin/openssl 
openssl =ep
```

`openssl` in this folder has the `=ep` capability, which means it has **all the capabilities present**. This essentially means we can read and edit files the same as the `root` user would.

We can use this to capture the root flag:

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-5bff0264b10b4f933ce4f1b2e27cadda09aa0541%2Fimage.png?alt=media)

But that's not good enough for OSCP. So, I decided to overwrite the `root` user's hash in `/etc/shadow`. This allows me to `su` as `root` using a password of my choosing.

First, we need to generate a new hash.

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-40edaf2a71b1771362efedfd3649fd7f8b94e33f%2Fimage.png?alt=media)

Then, we can get a copy the `/etc/shadow` file into the `ldapuser1` user directory.

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-2d2c7989980ec59ec7226d19c5b3f6b384aceb5d%2Fimage.png?alt=media)

Then we can replace the root hash with our own.

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-ba78c19586a50ff45d9a21b13216792b4faba705%2Fimage.png?alt=media)

Afterwards, we can overwrite the `/etc/shadow` file with the edited version, then `su` to get a root shell.

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-25b2db7484f8ed9365f900fa5903d6bac774ca4f%2Fimage.png?alt=media)