Hi.
So far, we've managed to hack into the server and within this lecture we're going to try and escalate
our privileges.
So we have already used that.
So I'm going to close this down.
We don't need Warshel anymore.
OK, so let me come back here and I believe we don't need this and this one as well.
So far, so good.
Now, let me come back over here and just make this minimized so that we can see terminal in a better
way.
Yep.
Clear doesn't work.
So let me try and see if we have Shal over here and let me around.
Who am I?
Yep.
We are determined we can run alerts, but we cannot run.
Yeah of course we cannot go into the route.
OK, let me try to go into a home and in home we already see some kind of robot thing and we have I
believe we have a key to over here.
Let me try to get that and see if we can get this.
Nope.
We cannot get the second key.
We cannot get the second flag.
So it's better.
It's good that we cannot get this.
So I believe there is a user called the robot because that's where we have found it.
Right.
We have a robot user under the home directory and this key two of three should have been the robots
file.
So we cannot read that.
So let me read this password over here and see if this is the password of the robot user.
So there is a hash over here and the name the five hash.
And I believe we can just decrypt this so that we can try to see if we can log in as robot and use this
password.
Right.
So if we can do that, then we can get the second flag.
And I believe this is a good thing because we can be rude.
We are robots, apparently.
I don't know that yet.
So I'm going to go for decrypt them, the five on line over here and let's find something that works.
So I'm going to go here and the five phone line dot org and just get this.
Let me just get this over here, OK?
Let me just copy this.
And pasted over there so that we can just try and decrypt it if we do this, let's see if we can get
this.
Nope, no result found in our database.
So this decryption works like a wordlist attack.
So if they have the same thing in their database, of course, it's not a wordlist attack, but the
logic is they're comparing it with the previous hashes.
So I'm going to try a lot of websites over here.
So let's try this one in the five decrypt dot net.
Nope, this is not in their database as well.
So let's try this one hashes dot com.
Let me try and just submit this and here you go.
Hashes dot com.
Find something, found something and I cannot see it properly, but I'm just going to copy and paste
it in my notes that to see over here.
OK, so that we can just take a note.
I'm going to go over here and see to document CTF and Mr. Robot and over here we have to narrow into
NATO and under this code.
Yeah, here you go.
This is ABC PFG So this is the whole alphabet, I believe.
And the user must be robots.
We are not certain yet, but the leads actually pointed that direction.
So robot user with this password, let's try this.
So let me just copy and paste.
Yep, it works.
So let me go back to our session and try to go into robot by running some robot.
Yeah.
It says that it must be run from a terminal.
We don't have a shell over here.
I don't know what we are into right now.
So let's try and spawn the shell.
I'm going to open my notes.
As I have shown you before, we can try to spawn the shell with Titan.
If we can run Python over here with a one liner, that would be great.
So this is the first thing that I'm going to try.
You can try with Basche or S.H., obviously.
So patency import do device spawn Wimbush.
So we have seen that before.
If you didn't take note of that, just pulls the video and tried to take note of that.
I suggest that.
Really.
So here you go.
Now you got a shell.
So we are determined at Linux.
We cannot right clear right now, but we can run the other ones.
So let me try to robot one more time.
It will ask me for a password.
Now, let me get that password.
So let me close this down and verify it.
So we have to go to documents, CTF, Mr. Robot and over here, no strategically.
And copy that alphabet over here.
Right.
So let me copy this and come back to our session and pasted over there and see.
Here you go.
Now we are robots, so we managed to change the user and apparently we cannot clear disturbing at all.
But if we one who am I then we are robots.
If you're on it, we are robot.
If we cut this flag too.
Right now, let's see if we can do that.
Keiki two of three texte.
And here you go.
Now we managed to get the second flag.
Now I'm going to make a copy of this one as well and just leave it there so that if we can if we actually
need this later on, we can come back and get this.
So what I'm going to do, of course, I'm going to try and be rude now.
Right.
Because there are three flags and we are in the second flag phase and we need to be rude in order to
get the rude flak.
So let me try and see if we can find the root directory over here.
If you can see into that.
Nope, we cannot even code into the root directory.
OK, so we're going to stop here and within the next lecture, we're going to see how we can escalate
our privileges to become root.