# Synced (Tier 0)

## <mark style="color:blue;">Description</mark>

* **Tier&#x20;**<mark style="color:green;">**->**</mark> 0
* **Difficult** <mark style="color:green;">**->**</mark> Very Easy
* **OS** <mark style="color:green;">**->**</mark> Linux
* **Tags&#x20;**<mark style="color:green;">**->**</mark> Rsync / Protocols / Reconnaissance / Anonymous/Guest Access

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FyDLwiUArG8dMMIhzCvXk%2Fimage.png?alt=media&#x26;token=8ad0fc01-9e91-431c-b28f-cca9b7d320a9" alt=""><figcaption><p><a href="https://app.hackthebox.com/starting-point?tier=0">https://app.hackthebox.com/starting-point?tier=0</a></p></figcaption></figure>

## <mark style="color:blue;">Write-up</mark>

* With a little research, I started answering the first question

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FhgHSfL6QEnWzV17X5I7r%2Fimage.png?alt=media&#x26;token=e9a3f487-cf31-4e2b-bfad-16531faf670b" alt=""><figcaption></figcaption></figure>

> Answer: _**873**_

***

* Then I continued doing an initial port scan of the machine using [_Nmap_](../../../networks/tools-and-utilities#nmap)

{% code lineNumbers="true" %}
```bash
nmap 10.129.197.128 -p- -Pn --min-rate 2500 -oN scan.txt
```
{% endcode %}

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FwMXx9GhALhQiaQ3jm4Tq%2Fimage.png?alt=media&#x26;token=9d10812e-d87d-40ce-8419-14f9e09b6a02" alt=""><figcaption></figcaption></figure>

***

* With this, I answered the next question

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FXH7WlefFMy7tYEjQPD9b%2Fimage.png?alt=media&#x26;token=40627d44-ee3e-4e77-a566-1aa135d793bc" alt=""><figcaption></figcaption></figure>

> Answer: _**1**_

***

* Then I did an exhaustive scan of the ports we found to get information about the running service

{% code lineNumbers="true" %}
```bash
nmap 10.129.197.128 -p873 -sVC -oN serv_scan.txt
```
{% endcode %}

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2F5kthNzmNPgCA30W1RKhb%2Fimage.png?alt=media&#x26;token=ab3a11ad-0761-4480-a748-628a305f28f3" alt=""><figcaption></figcaption></figure>

***

* With this and a little research, I answered some questions

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FoM2KFgxydD78ZGfCgfWT%2Fimage.png?alt=media&#x26;token=2efeedb5-e92a-4602-a4e4-dc94b62f699a" alt=""><figcaption></figcaption></figure>

> Answer: **31**

***

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FFpDDWCFNZ2Oy103A7Xsn%2Fimage.png?alt=media&#x26;token=0c3bf787-8f5b-462f-8a96-e114a993e475" alt=""><figcaption></figcaption></figure>

> Answer: _**rsync**_

***

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2F1AAYiFQQr46vDzdaFB9n%2Fimage.png?alt=media&#x26;token=5fdaebec-ff9c-4558-a425-0b133db7fbb5" alt=""><figcaption></figcaption></figure>

> Answer: _**None**_

***

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FflGK56slg23aWDFuLDlk%2Fimage.png?alt=media&#x26;token=dd65e8c5-b0ee-45ce-8ee9-55cc35f38168" alt=""><figcaption></figcaption></figure>

> Answer: _**list-only**_

***

* I found there was a service named _rsync_ that, with a little research, I found was a file synchronization application. Also, I found that it was possible to interact with it using the [_rsync_](../../../networks/tools-and-utilities#rsync) command-line utility. So I tried using it to list the files being shared under this application, specifying it was using a daemon to run this service, and I saw it was successful

{% code overflow="wrap" lineNumbers="true" %}
```bash
rsync --list-only 10.129.197.128::
```
{% endcode %}

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FQ4HJrQLMKWimp6NaQUp7%2Fimage.png?alt=media&#x26;token=aa2333e0-e3f5-4ce8-afee-884b0cdeeddd" alt=""><figcaption></figcaption></figure>

***

* I found a _public_ folder, so I listed its content, where I found a _flag.txt_ file. So I transferred it from the server to my machine and read its content, finally finding the root flag

{% code overflow="wrap" lineNumbers="true" %}
```bash
rsync --list-only 10.129.197.128::public
rsync 10.129.197.128::public/flag.txt ./
cat flag.txt
```
{% endcode %}

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FcZ5E4SuLlLQiMRyjwrgP%2Fimage.png?alt=media&#x26;token=0f8b5ab8-a453-42d6-a55f-18461f1cc1f0" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2F7t1jyQXcTo6voZSObuFs%2Fimage.png?alt=media&#x26;token=7a3a05b7-3b46-4092-9b3b-1b3dbeec64f3" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FBFYbt3Kjzg2W3f6aPBl9%2Fimage.png?alt=media&#x26;token=cfc277e1-c064-4b4c-981a-0e4bcbaf2d98" alt=""><figcaption></figcaption></figure>

***

* With this, I got the root flag and pwned the machine

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FAJNJA9zQa10PurMdoG1I%2Fimage.png?alt=media&#x26;token=4807d32b-9f75-4295-9941-054c33325e9e" alt=""><figcaption></figcaption></figure>

> Answer: _**72eaf5344ebb84908ae543a719830519**_
