DriftingBlues 4 Walkthrough
| Platform | Room | Difficulty | OS |
|---|---|---|---|
| VulnHub | DriftingBlues 4 | Easy | Linux |
Scanning and Initial Findings#
Start with an Nmap scan and find the open ports: FTP (21), SSH (22), and HTTP (80).
Web Page Analysis#
In the webpage source code, I found a nested Base64 encoded string. After decoding it multiple times, I reached a final decoder that revealed a TXT file location.
Inside the TXT file, there was a lot of Brainfuck code.
QR Code and Usernames#
After decoding the Brainfuck code, I found the location of an image containing a QR code. Scanning the QR code revealed some usernames.
Brute Forcing FTP#
I started with brute-forcing the FTP credentials. I found a valid user hubert.
The FTP directory for hubert had an empty .ssh folder, so I uploaded a custom-generated public key and the corresponding private key.
Gaining User Access#
After uploading the public key and setting the correct permissions, I logged in as hubert and retrieved the user flag.
Privilege Escalation#
Using linpeas and manual enumeration, I found a SUID binary named getinfo.
The binary read the ip file in the /tmp directory. I created a script in /tmp, made it executable, and modified the PATH to run my script instead. This allowed me to gain root access.
Adapted from sagar-sehrawat/VulnHub-Machine-Solutions under MIT.