Pwned1 Medium box on Offensive Security Proving Grounds - OSCP Preparation.

Hello,

We are going to exploit one of OffSec Proving Grounds Medium machines which called Pwned1 and this post is not a fully detailed walkthrough, I will just go through the important points during the exploit process.

Enumeration:

• Nmap:

• Reading /robots.txt:

• We got a list of possible paths on the server on /hidden_text/secret.dic

• Running gobuster using that list:

• Checking the source code of that page:
  • we have a user and password: ftpuser:B0ss_Pr!ncesS:
• Login to ftp:

• Downloading id_rsa and notes.txt files to our local machine:

• Getting Shell through SSH:

Privilege Escalation:

• Enumeration:
  • sudo -l: we can run /home/messenger.sh script as selena without password.

  

  • Reading /home/messenger.sh file:

  

• Getting shell as selena user:

sudo -u selena /home/messenger.sh

• As you can see in the screenshot above, we are a part of docker group, so let’s exploit that:

docker run -v /:/mnt -it alpine

Happy Hacking!