let's read the docs for the software, the default install is at folder daloradius since there is no subdomain we try http://underpass.htb/daloradius
Yes this works... great! let's find more info.
we get the software version on the login page daloRADIUS 2.2 beta here, I assume you here will do your enumeration as well http://underpass.htb/daloradius/app/operators/login.php
ssh svcMosh@underpass.htb
svcMosh@underpass.htb's password:
Welcome to Ubuntu 22.04.5 LTS (GNU/Linux 5.15.0-126-generic x86_64)
* Documentation: https://help.ubuntu.com
* Management: https://landscape.canonical.com
* Support: https://ubuntu.com/pro
System information as of Mon Dec 30 07:14:31 PM UTC 2024
System load: 0.0 Processes: 227
Usage of /: 92.2% of 3.75GB Users logged in: 0
Memory usage: 20% IPv4 address for eth0: 10.129.100.118
Swap usage: 0%
=> / is using 92.2% of 3.75GB
Expanded Security Maintenance for Applications is not enabled.
0 updates can be applied immediately.
Enable ESM Apps to receive additional future security updates.
See https://ubuntu.com/esm or run: sudo pro status
The list of available updates is more than a week old.
To check for new updates run: sudo apt update
Last login: Thu Dec 12 15:45:42 2024 from 10.10.xx.xx
svcMosh@underpass:~$ whoami
svcMosh
svcMosh@underpass:~$ hostname
underpass
YAY! get user.txt
ROOT
ok like usuall upload your local enumeration tools...
hold on this is an easy box so first the standard first steps like check for sudo privs
sudo -l
Matching Defaults entries for svcMosh on localhost:
env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin, use_pty
User svcMosh may run the following commands on localhost:
(ALL) NOPASSWD: /usr/bin/mosh-server
ok piece of cake! lets review that program or script
