OpenAdmin_Lateral_Movement_jimmy

jimmy

---

┌──(kali㉿kali)-[~/archive/htb/labs/openadmin]
└─$ ssh jimmy@openadmin.htb
The authenticity of host 'openadmin.htb (10.10.10.171)' can't be established.
ed25519 key fingerprint is sha256:wrS/uECrHJqacx68XwnuvI9W+bbKl+rKdSh799gacqo.
This key is not known by any other names
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
warning: Permanently added 'openadmin.htb' (ED25519) to the list of known hosts.
jimmy@openadmin.htb's password: n1nj4W4rri0R!
Welcome to Ubuntu 18.04.3 LTS (GNU/Linux 4.15.0-70-generic x86_64)
 
 * documentation:  https://help.ubuntu.com
 * management:     https://landscape.canonical.com
 * support:        https://ubuntu.com/advantage
 
  system information as of tue oct 11 16:22:23 UTC 2022
 
  system load:  0.08              Processes:             186
  usage of /:   33.9% of 7.81GB   Users logged in:       0
  memory usage: 23%               IP address for ens160: 10.10.10.171
  swap usage:   0%
 
 
 * Canonical Livepatch is available for installation.
   - reduce system reboots and improve kernel security. activate at:
     https://ubuntu.com/livepatch
 
39 packages can be updated.
11 updates are security updates.
 
 
last login: Thu Jan  2 20:50:03 2020 from 10.10.14.3
jimmy@openadmin:~$ whoami
jimmy
jimmy@openadmin:~$ id
uid=1000(jimmy) gid=1000(jimmy) groups=1000(jimmy),1002(internal)
jimmy@openadmin:~$ ifconfig
ens160: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 10.10.10.171  netmask 255.255.255.0  broadcast 10.10.10.255
        inet6 dead:beef::250:56ff:feb9:4ef2  prefixlen 64  scopeid 0x0<global>
        inet6 fe80::250:56ff:feb9:4ef2  prefixlen 64  scopeid 0x20<link>
        ether 00:50:56:b9:4e:f2  txqueuelen 1000  (Ethernet)
        RX packets 1979390  bytes 367151090 (367.1 MB)
        RX errors 0  dropped 39  overruns 0  frame 0
        TX packets 1982559  bytes 971546129 (971.5 MB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0
 
lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
        inet 127.0.0.1  netmask 255.0.0.0
        inet6 ::1  prefixlen 128  scopeid 0x10<host>
        loop  txqueuelen 1000  (Local Loopback)
        RX packets 16997  bytes 1335987 (1.3 MB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 16997  bytes 1335987 (1.3 MB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

Password for the local DB, is the same for the jimmy user