Time to user.txt: ~45 minutes
Time to root.txt: ~55 minutes
Reconnaissance
- Identified open ports: 22 (SSH), 80 (HTTP), 161 (SNMP).
- Used
snmpwalkon the public community string to extract system information. DiscoveredUnDerPass.htbindicating a daloradius instance. - Verified HTTP path
/daloradius/directly from the hint in the SNMP response. - Directory brute-force tools (Gobuster, ffuf) ran into 403 Forbidden for many standard paths, but
login.phpunder/daloradius/app/operators/was available.
Foothold
- Used default credentials
administrator:radiusto log into the daloRADIUS operator portal. - Navigated the panel and found a user
svcMoshwith MD5 password hashunderwaterfriends. - Logged in via SSH:
svcMosh:underwaterfriends. - Captured
user.txt.
Privilege Escalation
- Ran
sudo -lto find that thesvcMoshuser can runsudo /usr/bin/mosh-server newwithout a password. mosh-serverexecutes the command with the privileges of the user invoking it (root).- Used
mosh-server new -c 256 -- /bin/sh -c "cp /root/root.txt /tmp/root.txt && chmod 666 /tmp/root.txt"natively on the target host via SSH to have mosh-server spawn as root, execute the copy payload when a mosh client connects. - Triggered execution by running
mosh-clienton the target system to grab the flag safely. - Captured
root.txt.
Lessons Learned
- Always check SNMP if available, as the
sysDescrobject often leaks valuable context like hostnames or installed appliance software. - Default credentials on known appliances (like daloRADIUS) are common footholds.
- Sudo access to commands that can spawn shells or execute arbitrary commands (like
mosh-server) effectively means full root access.