# Funnel (Tier 1)

## <mark style="color:blue;">Description</mark>

* **Tier&#x20;**<mark style="color:green;">**->**</mark>**&#x20;1**
* **Difficult** <mark style="color:green;">**->**</mark> Very Easy
* **OS** <mark style="color:green;">**->**</mark> Linux
* **Tags&#x20;**<mark style="color:green;">**->**</mark> FTP / PostgreSQL / Reconnaissance / Tunneling / Password Spraying / Port Forwarding\
  &#x20;             / Anonymous-Guest Access / Clear Text Credentials

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2Fq22wYpSdi4WtUtRVPGcX%2Fimage.png?alt=media&#x26;token=bf22fb4e-bfea-4a38-a67c-a08529f80bf5" alt=""><figcaption><p><a href="https://app.hackthebox.com/starting-point?tier=1">https://app.hackthebox.com/starting-point?tier=1</a></p></figcaption></figure>

## <mark style="color:blue;">Write-up</mark>

* I started doing an initial scan using [_Nmap_](../../../networks/tools-and-utilities#nmap)

{% code lineNumbers="true" %}
```bash
nmap 10.129.219.72 -p- -Pn --min-rate 2500 -oN scan.txt
```
{% endcode %}

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FaEsvtPGEnCLn9RbSdRyi%2Fimage.png?alt=media&#x26;token=2ef155d1-62bc-4c35-bb15-a3acdd80ca82" alt=""><figcaption></figcaption></figure>

***

* With this, I answered the first question

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2F19QsHHMFPufEfyzgNkB7%2Fimage.png?alt=media&#x26;token=ade4760c-4611-4768-9226-21ad699548ad" alt=""><figcaption></figcaption></figure>

> Answer: _**2**_

***

* Then I did an exhaustive scan to learn more about the running services on the open ports

<pre class="language-basic" data-line-numbers><code class="lang-basic"><strong>nmap 10.129.219.72 -p21,22 -sVC -oN serv_scan.txt
</strong></code></pre>

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FZgf3fEyK2fxvP5Br1krs%2Fimage.png?alt=media&#x26;token=43f24165-3120-46e9-acab-ca1e371a02dc" alt=""><figcaption><p>snippet</p></figcaption></figure>

***

* I identified two running services, focusing on the FTP protocol running on port 21, and tried logging in as an anonymous user and successfully got in

{% code overflow="wrap" lineNumbers="true" %}
```bash
ftp 10.129.219.72
```
{% endcode %}

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FA4vp1fue3CCpFeoFf4hI%2Fimage.png?alt=media&#x26;token=fff936a9-cbe2-4cae-a67c-49e82a8b7e7c" alt=""><figcaption></figcaption></figure>

{% hint style="success" %}
To learn more about the FTP protocol, you can go [here](../../networks/protocols/ftp)
{% endhint %}

***

* I checked the shared resources and found a folder named _mail\_backup._ I accessed it, listed its contents, and found two interesting files, which I downloaded from the server and closed the connection

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2Fsd3ReBSKSTUFEcwxuKJe%2Fimage.png?alt=media&#x26;token=40207ba7-a5ac-4e30-a343-7686aac4441c" alt=""><figcaption></figcaption></figure>

***

* With this, I answered the next question

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FkchLEtJVR8wLbWLnP67h%2Fimage.png?alt=media&#x26;token=e4a1c305-eed6-4074-9b2a-76c469403b38" alt=""><figcaption></figcaption></figure>

> Answer: _**mail\_backup**_

***

* I checked the contents of the downloaded files and found what seemed to be an email informing new employees of an enterprise about the password policy, and also a document containing the policy. Checking its content, I found valuable information letting me know that the default password used for the digital services was _funnel123#!#_

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FJPtMqqBj8qFnEtVkTkTc%2Fimage.png?alt=media&#x26;token=61d33934-f73f-4033-ab8a-d20b21ad28ad" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FiqIC6XwlCaLRgkoonuuH%2Fimage.png?alt=media&#x26;token=c23fe6dd-76e2-471e-9440-cef3f071f470" alt=""><figcaption><p>password_policy.pdf</p></figcaption></figure>

***

* With this, I answered the next question

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FR4PtVK66g2Z79XavPoX4%2Fimage.png?alt=media&#x26;token=817207ed-2ffe-41b2-bb42-4edd215b0e94" alt=""><figcaption></figcaption></figure>

> Answer: _**funnel123#!#**_

***

* Now with this password, I could try to log in somewhere else. As I also found an SSH service running on the machine, I tried to log in there using one of the users exposed in the email. After trying with all the usernames, I finally found that using _christine_ I successfully went in. After that, I sanitized the terminal to interact more comfortably with the system

{% code overflow="wrap" lineNumbers="true" %}
```bash
ssh christine@10.129.219.72
```
{% endcode %}

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2Fl4OWC2ZpcTT300I1WZvk%2Fimage.png?alt=media&#x26;token=62cc0b57-1444-4bc0-b38d-61253f675038" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FnwfmYYztYZPdgJfod8r4%2Fimage.png?alt=media&#x26;token=242b662c-d16d-4f37-a638-cb027cdc8d85" alt=""><figcaption></figcaption></figure>

{% hint style="success" %}
To learn about the sanitization process, you can go [here](../../../linux/useful-shell-resources#tty-sanitization), and to learn more about the SSH protocol, you can go [here](../../networks/protocols/ssh)
{% endhint %}

***

* With this, I answered the next question

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FUdta1YYYWCRIfhpLnyh7%2Fimage.png?alt=media&#x26;token=0c6565d4-64ca-45be-9b34-29cec86f69ee" alt=""><figcaption></figcaption></figure>

> Answer: _**christine**_

***

* Then I wanted to find a way to escalate privileges. After exploring some escalation vectors I didn't find anything relevant, so to go deeper, I tried checking the programs running locally on the host. With this, I found a process running on port 5432

{% code overflow="wrap" lineNumbers="true" %}
```bash
ps aux | grep "127.0.0.1"
```
{% endcode %}

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2Fnz7lrFXJZVB5aTjgGMqY%2Fimage.png?alt=media&#x26;token=6b8db887-c467-4763-a7c0-a5fd7edd3111" alt=""><figcaption></figcaption></figure>

***

* To get more details about it, I used the `ss` command to get information about the sockets running to relate any to the process found. I first listed the services, showing the port the sockets were running on, and then the name of the service to relate them. With that, I confirmed that port 5432 was running the _postgresql_ service

{% code overflow="wrap" lineNumbers="true" %}
```bash
ss -tuln
ss -tul
```
{% endcode %}

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2F2Wpw0mYmSAU43ka9RN9j%2Fimage.png?alt=media&#x26;token=d1193c60-095d-4b63-b0c0-2cd66cca18f5" alt=""><figcaption></figcaption></figure>

***

* With this and a little research, I answered the next questions&#x20;

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FCZQ1ZPI98uL1FzO99neV%2Fimage.png?alt=media&#x26;token=ff58e361-976b-41fe-906e-230a81cb028b" alt=""><figcaption></figcaption></figure>

> Answer: _**postgresql**_

***

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FgCy5Q9KrHUSjyzmhQhl8%2Fimage.png?alt=media&#x26;token=647802f1-1941-4a65-b101-4fe54e25831b" alt=""><figcaption></figcaption></figure>

> Answer: _**local port forwarding**_

***

* As the service was locally deployed, I couldn't access or interact with it, but as I had access via _SSH_, I could try to make a tunnel via Local Port Forwarding so I could access it from my machine. So I mounted the tunnel through _SSH_ and after that, I checked on my machine that the service had been forwarded properly

{% code overflow="wrap" lineNumbers="true" %}
```bash
ssh -L 7777:127.0.0.1:5432 christine@10.129.219.72
ss -tlp
```
{% endcode %}

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FqhS5swoylEMu8Xdnf1tv%2Fimage.png?alt=media&#x26;token=9daa54ee-66d5-4348-9cb9-3088fbcf0beb" alt=""><figcaption><p>snippet</p></figcaption></figure>

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FZxOIDYhuHUDmFp3xgekv%2Fimage.png?alt=media&#x26;token=7e677633-dd1c-4c0f-a558-6d643dbcd40c" alt=""><figcaption></figcaption></figure>

***

* Then I could interact with the service to connect to the database. I tried using the [_postgresql_](../../../database-attacks/tools-and-utilities#postgresql) command line utility, specifying the location of the service on my machine and using the credentials I had obtained. Once I had done it, I connected successfully to the database

{% code overflow="wrap" lineNumbers="true" %}
```bash
psql -h 127.0.0.1 -p 7777 -U christine
```
{% endcode %}

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FspNjDuuFzyGYFot01tH5%2Fimage.png?alt=media&#x26;token=4263f52a-b9eb-4112-bf48-70229d63f6fc" alt=""><figcaption></figcaption></figure>

***

* Once there, I listed the databases and found an interesting one named _secrets_, so I accessed it and listed the tables, finding a table named _flag_. Last, I retrieved all of the information from this table, and inside that, I found the flag

{% code overflow="wrap" lineNumbers="true" %}
```plsql
christine=# \l
christine=# \c secrets
secrets=# \dt
secrets=# SELECT * FROM flag;
```
{% endcode %}

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FqAwn7dLkTPsOqTeV9PXv%2Fimage.png?alt=media&#x26;token=085a0a9c-decc-42cb-83fa-ffebcb36b575" alt=""><figcaption></figcaption></figure>

***

* With this and a little research, I answered the last questions

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FzADbEvv3hephTuT35xZt%2Fimage.png?alt=media&#x26;token=b08f4be9-7fe5-477f-bef5-662e079af7f9" alt=""><figcaption></figcaption></figure>

> Answer: _**secrets**_

***

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FP4kc7dBQlNXZGsDJLQT8%2Fimage.png?alt=media&#x26;token=19f66c58-c464-4842-859e-665332c9c17c" alt=""><figcaption></figcaption></figure>

> Answer: _**Yes**_

***

* And finally, I got the root flag and pwned the machine

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2F7IT97FbkPlTo5KtwskbE%2Fimage.png?alt=media&#x26;token=04037b77-8ec9-429a-87d1-9f8e19d957fe" alt=""><figcaption></figcaption></figure>

> Answer: _**cf277664b1771217d7006acdea006db1**_
