# SolidState

## Gaining Access

Nmap scan:

<figure><img src="https://content.gitbook.com/content/qpzdj1tPRpELJdvxuVYh/blobs/ue7Ej16I0aRgtz0oSeMf/image.png" alt=""><figcaption></figcaption></figure>

### JAMES Server

SMTP is open, which is rather suspicious. I connected via `nc` and tested some default credentials, and found that `root:root` worked.

<figure><img src="https://content.gitbook.com/content/qpzdj1tPRpELJdvxuVYh/blobs/hqd9oTHzJDcoK75Pu0S9/image.png" alt=""><figcaption></figcaption></figure>

Now that we are logged in, we can read some emails:

<figure><img src="https://content.gitbook.com/content/qpzdj1tPRpELJdvxuVYh/blobs/eIeOGFxhNBYOlYOeenWy/image.png" alt=""><figcaption></figcaption></figure>

With this, we can SSH in as `mindy`.

### Shell Escape

When in the user's directory, we find a restricted shell where we cannot execute a lot:

<figure><img src="https://content.gitbook.com/content/qpzdj1tPRpELJdvxuVYh/blobs/B4GIeHWrqwaqIVi9Zu0g/image.png" alt=""><figcaption></figcaption></figure>

I researched a bit on how to escape this shell, and found that appending `-t "bash --noprofile"` works:

<figure><img src="https://content.gitbook.com/content/qpzdj1tPRpELJdvxuVYh/blobs/7BjP0zO0LGO5fNGHGArh/image.png" alt=""><figcaption></figcaption></figure>

## Privilege Escalation

### Cronjob Injection

We can run `pspy32` on this machine to view processes:

<figure><img src="https://content.gitbook.com/content/qpzdj1tPRpELJdvxuVYh/blobs/88vql4fiX1zopEskAAto/image.png" alt=""><figcaption></figcaption></figure>

I found that we have write access over this file, so we can just append a reverse shell to it:

<figure><img src="https://content.gitbook.com/content/qpzdj1tPRpELJdvxuVYh/blobs/9FBrgpL0ntGXDXQgf0nI/image.png" alt=""><figcaption></figcaption></figure>

After waiting for a bit, we would catch a reverse shell:

<figure><img src="https://content.gitbook.com/content/qpzdj1tPRpELJdvxuVYh/blobs/h9X0iE3l7OfIFWIpyH8A/image.png" alt=""><figcaption></figcaption></figure>
