Nmap scan:
Port 80 reveals some kind of website archive thing:
Checking the page source, we find that this is running CuteNews, which had a few RCE exploits available:
With this, we can easily gain a reverse shell:
Within the /var/www/html/CuteNews/cdata/users directory, we can find some base64 encoded lines:
When one of them was decoded, we find a token of some sorts:
We can crack this hash on crackstation:
Then we can su to paul:
Cool
When I ran LinPEAS on the machine, I found that the public key of nadav was the public key of paul...?
I tried to ssh in as nadav from paul, and it worked!
When running another LinPEAS, we find this part here:
Following this PoC would extract the private SSH key of root and allow me to SSH in as root:
