Hackthebox Tabby walkthrough

Enumeration<

ِNmap TIME!.

ِِِAs you can see 80,22,8080 are open. Let`s start checking

ِAfter some recon i didn`t found anything in 8080. ِBut i searched for megahosting exploit i found LFI so let`s try it.

ِBANG ! , we got credentials. After some search i found out that we can have a reverse shell by uploading it to manager page

Exploitation

ِAfte uploading our shell let`s execute it.

After some recon i found a backup file at /var/www/html So i made an http server to download it to my machine and crack it Let`s crack it with FCRACKZIP

Privilege Escalation

I didn`t find anything interesting in the file , In the recon phase i found ash user so i tried the password on it

BAM ! , we logged in and got user hash I found this article about LXD privilege escalation and knowing that the user is in LXD group lxd privilege escalation Let`s build ! # Thanks for Reading 🙏