FLAG1


FLAG2


FLAG3


Enumeration

PORT      STATE SERVICE VERSION
22/tcp    open  ssh     OpenSSH 8.2p1 Ubuntu 4 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   3072 9b:0d:ed:8d:1b:46:6c:3b:1e:63:07:9a:43:7e:aa:b7 (RSA)
|   256 4d:ca:db:4f:d1:e1:5b:a8:57:c6:05:dd:dc:70:09:ea (ECDSA)
|_  256 b9:6b:0b:fe:d0:83:e1:a1:31:86:fb:c3:5e:e4:04:5e (ED25519)
80/tcp    open  http    Apache httpd 2.4.41 ((Ubuntu))
|_http-title: 403 Forbidden
|_http-server-header: Apache/2.4.41 (Ubuntu)
22022/tcp open  ssh     (protocol 2.0)
| fingerprint-strings: 
|   NULL: 
|     SSH-2.0-Twisted_20.3.0
|     curve25519-sha256,[email protected],ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1
|     ssh-rsa
|     caes256-ctr,aes256-cbc,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,cast128-cbc,blowfish-cbc,3des-cbc
|     caes256-ctr,aes256-cbc,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,cast128-cbc,blowfish-cbc,3des-cbc
|     <hmac-sha2-512,hmac-sha2-384,hmac-sha2-256,hmac-sha1,hmac-md5
|     <hmac-sha2-512,hmac-sha2-384,hmac-sha2-256,hmac-sha1,hmac-md5
|     none,zlib
|_    none,zlib
1 service unrecognized despite returning data.

We have a strange port on 22022 which is running SSH and we have missing name on port 80

Untitled

Exploitation

After ssh into port 22022 as root with password root we got into this prompt

ssh [email protected] -p 22022 -oHostKeyAlgorithms=+ssh-rsa
>>> Here I write my personal notes!
Commands: clear exit help ls read write

ʕ•ᴥ•ʔっ ls
updates
test
to-do-list

ʕ•ᴥ•ʔっ read updates
Program can run persistently now!

ʕ•ᴥ•ʔっ read test
Just testing

ʕ•ᴥ•ʔっ read to-do-list
To-do list
- Thank admin for letting me use this server to test my programs
- Per admin recommendations, program activity logging function to improve this program's security

ʕ•ᴥ•ʔっ

Privilege Escalation