Paper_SSH

SSH

---

Testing password reuse for the system user, dwight

┌──(kali㉿kali)-[~/archive/htb/labs/paper]
└─$ sshpass -p 'Queenofblad3s!23' ssh dwight@$IP                                     
activate the web console with: systemctl enable --now cockpit.socket
 
last login: Tue Feb  1 09:14:33 2022 from 10.10.14.23
[dwight@paper ~]$ whoami
dwight
[dwight@paper ~]$ hostname
paper
[dwight@paper ~]$ ifconfig
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 10.10.11.143  netmask 255.255.254.0  broadcast 10.10.11.255
        inet6 fe80::250:56ff:feb9:45da  prefixlen 64  scopeid 0x20<link>
        inet6 dead:beef::250:56ff:feb9:45da  prefixlen 64  scopeid 0x0<global>
        ether 00:50:56:b9:45:da  txqueuelen 1000  (Ethernet)
        RX packets 11406552  bytes 1039862242 (991.6 MiB)
        RX errors 0  dropped 48  overruns 0  frame 0
        TX packets 12491205  bytes 26941459387 (25.0 GiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0
 
lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
        inet 127.0.0.1  netmask 255.0.0.0
        inet6 ::1  prefixlen 128  scopeid 0x10<host>
        loop  txqueuelen 1000  (Local Loopback)
        RX packets 221990  bytes 68337522 (65.1 MiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 221990  bytes 68337522 (65.1 MiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0
 
virbr0: flags=4099<UP,BROADCAST,MULTICAST>  mtu 1500
        inet 192.168.122.1  netmask 255.255.255.0  broadcast 192.168.122.255
        ether 52:54:00:9b:e7:f7  txqueuelen 1000  (Ethernet)
        RX packets 0  bytes 0 (0.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 0  bytes 0 (0.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

Password reuse confirmed for the dwight user Initial Foothold established to the target system via SSH