So it basiclly tricks the website to think that we want to access a file outisde of the web directory.
and from there we can enumerate the server for more info one of the file we can access is.
curl http://mountaineer.thm/wordpress/images../etc/nginx/sites-available/default
which will give us more idea on the server configuration. And from there we can one more vhost we was not be aware of by the way i did enumeration about subdomains and vhost using gobuster.
So we only need to add this to the host file. and let's visit it to see what we have.
So from here i tried to bruteforce but it has rate limit so i belive that we can guss the password since we can not break the passwords nor bruteforce or maybe there is another way am not aware of.
I tried with most of them and luck me K2 works which i guess you can tell what the passwors is.
From there we can find two emails.
I tried to ssh using the password but it does not work. So i tried to login into wordpress for the user K2 and it actully works.
From here i can recall that we have an upload vuln if we have contributer access at least.
this is quite simple we can use the same creds from the roundcube.
Acess as kangchenjunga
So here i stuck for a while we can see that once we login as K2 we can see an email to guy called. Lhotse Which we has access to his directory.
And here i search about this and i found it some sort of encrypted databse which hold some information we can use john to crack so i tride john with rockyou file but it does not work. Thanks to bob again i see that he uses tool called cupp which help to generate some password based on user information.
To see the file content just upload the file enter the key and it will open. ANd from there we can find the username and password for the user : kangchenjunga.
Shell as Root.
So once we login we will find the flag as well as note which actully make me laugh.
This guy does not want to be hacked so he put strong password but his friend miss it all up LOL 😂.
So as to became a root its quite simple really. So reading the note above we can tell that the root user use this guy account. So let's see.
Hmmmm is it really ??.
indded. So let's login as root.
conclusion.
At the end this machine was so fun it actully not that hard but there is a key point which actully was challenging such that fact that i spend 3h to use sqlmap to get all the users databae with nothing at the end and the real exploit was quite simple aslo in the crack file it was quite easy but using the person information to get the real password was actully so smart and a new idea i can use in future challenges.
Finally i would like to thank and give a credit to bob he really help me thank you bob. Check his write up down show some love.
