Start with a nmap scan

I see some ports, after a new scan on port 21 it shows “anonymus” login allowed.

after logging in to the server i try liste the files, it only show 3 dirs, the first thing that court my eyes was the dir “…”, after getting ind to the dir, i find a file call “-” downloadet the file, and open the document in vim.

finding a user name “john”.

then went to the first web on port 80, that only gave me a default page.. moving on to apache on port 62337.

finding a login page from a Codiad Web IDE.

from the ftp server i have the name “john”, with the tekst of a password reset. Ussing intruder in burp with a common password file, i then find the password, fore the user “John”.

as shown the length in collum 6 change from 338 to 324, so som thing was change.. trying with john:password i recive a login successful.

Looking at little on the page i didn’t finde anything special so i moving on to search for a exploit.

on github i find https://github.com/WangYihang/Codiad-Remote-Code-Execute-Exploit

there is a exploit that requiring a user name and password to work

after running the exploit i receive a reversshell.

navigating to the home dir, i find a user call drac. looking at the .bash_history
there is a password.

trying the user name drac and the password found, to logins on port 22 with ssh. And it workt

finding the first flag ind the users home directory user.txt

then running sudo -l to list what the users can do with sudo. i see the output “user drac may run the following commands on ide:(ALL : ALL) /usr/sbin/service vsftpd restart”

searching for the vsftpd service.
find . -name vsftpd.service 2>/dev/null

Finding the service config file and is allowed to read/write the file, so i open the service in nano.
nano /lib/systemd/system/vsftpd.service

in the “ExecStart=” i set up a reversshell to my kali.

starting a netcat on port 1234

restarting the vsftp service

great it workt a revers root shell.

navigting root dir. and cat the second flag. “root.txt”