TryHackMe Aratus

This is a video walk-through of TryHackMe's Aratus. If you prefer a written walk-through. You can find it here:

Buy Me A Coffee :)

Chapters:
0:00 Intro
1:05 Nmap scan and results
2:15 Start enumerating FTP and Website, nothing good
3:40 Finding and downloading Samba share with lots of files
6:17 Finding first clue
8:05 Using basic frequency analysis with grep to find RSA key
9:21 Using ssh2john to get RSA passphrase and accessing host
11:55 Start of basic enumeration
12:57 Checking capabilities, we can use tcpdump
15:10 pspy64s finds a authentication script running every minute
17:44 Using tcpdump on port 80 to find credentials
19:50 Using credentials to login, we can run bash script with sudo
21:30 Examining what the script does and looking at ansible-playbook
23:05 Finding yml files that we can write to
25:17 Start of ansible-playbook yml file exploitation
27:09 Our test command ran as root, setting the SUID to bash
28:36 Got root! looking through the rest of the machine

[matclarkcybersec]

appreciate this, learnt about red red hat acl permissions, I had no idea!! Managed to get theodore by myself and was stuck!!