My name is Terry Amondi and I am thrilled by offensive security
LinkedInLink: Valley
/pricing on the website. You’ll find that there is a note./gallery. You only find gallery.html here but you should be able to run another gobuster scan from here to find other hidden files or directories. This does not provide any results. Another directory found on the site was /static. Run a gobuster scan from here to find other directories or files./00. When you go to this location, you find another note./dev1243224123123. Also, note that the name of the user is valleyDev. Now go to the aforementioned directory and you’ll find a login page.dev.js provided login credentials.mget as shown below.siemHTTP2.pcapng. The POST header shows credentials that were provided by the user.valley which authenticates the user. When you run this script, it asks for a username and password, and you are only authenticated if these credentials are correct. This means that there is a chance you can review the strings on the script to find credentials. Since you can’t run the strings command on the target machine, you should download this script to your machine and analyze it from there. You can either use scp or create a python server.strings on the script and open the text, you will see that the first line contains the word UPX suggesting that the binary was packed using UPX.upx -d valleyAuthenticator. Now, you can run the strings command and put the output in a file. You can then view the file to find credentials. You know that when run, the script asks for username and password so you can search for the word password or username to make things easier. In Nano, you can search using ctrl+w and in Vim, you can type the forward slash and then type the word you’re looking for.valley and his password is liberty123. Let’s switch to this user.cat /etc/crontab.valley, you can modify this library. This is because valley is in the group valleyAdmin which can modify this library as shown below.os.system(“chmod u+s /bin/bash”) ```
/bin/bash which allows you to run it with sudo permissions even when you do not own it./bin/bash using the command ls -l /bin/bash.bash -p and you’ll have a root shell. From here, you can get the last flag.