Chemistry_Lateral_Movement

rosa

---

Validating the cracked password of the rosa user

┌──(kali㉿kali)-[~/archive/htb/labs/chemistry]
└─$ sshpass -p 'unicorniosrosados' ssh rosa@$IP                                          
Welcome to Ubuntu 20.04.6 LTS (GNU/Linux 5.4.0-196-generic x86_64)
 
 * Documentation:  https://help.ubuntu.com
 * Management:     https://landscape.canonical.com
 * Support:        https://ubuntu.com/pro
 
 System information as of Sat 19 Oct 2024 10:02:11 PM UTC
 
  System load:           0.0
  Usage of /:            73.3% of 5.08GB
  Memory usage:          31%
  Swap usage:            0%
  Processes:             236
  Users logged in:       1
  IPv4 address for eth0: 10.129.254.176
  IPv6 address for eth0: dead:beef::250:56ff:fe94:5ef7
 
 
Expanded Security Maintenance for Applications is not enabled.
 
0 updates can be applied immediately.
 
9 additional security updates can be applied with ESM Apps.
Learn more about enabling ESM Apps service at https://ubuntu.com/esm
 
 
The list of available updates is more than a week old.
To check for new updates run: sudo apt update
Failed to connect to https://changelogs.ubuntu.com/meta-release-lts. Check your Internet connection or proxy settings
 
 
rosa@chemistry:~$ whoami
rosa
rosa@chemistry:~$ hostname
chemistry
rosa@chemistry:~$ ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
    link/ether 00:50:56:94:5e:f7 brd ff:ff:ff:ff:ff:ff
    inet 10.129.254.176/16 brd 10.129.255.255 scope global dynamic eth0
       valid_lft 3233sec preferred_lft 3233sec
    inet6 dead:beef::250:56ff:fe94:5ef7/64 scope global dynamic mngtmpaddr 
       valid_lft 86391sec preferred_lft 14391sec
    inet6 fe80::250:56ff:fe94:5ef7/64 scope link 
       valid_lft forever preferred_lft forever

Password reuse confirmed Lateral Movement made to the rosa user via SSH