Tinkering in the shed.

  This was a really nice machine, if you like to be annoyed by trying to do the same thing many different ways until you eventually get somewhere... Thank you c4rta - looking forward to your next machine ;) Find it sudo netdiscover -r 10.0.0.0/24 -i eth1 -P  _____________________________________________________________________________    IP            At MAC Address     Count     Len  MAC Vendor / Hostname        -----------------------------------------------------------------------------  10.0.0.1        08:00:27:41:d0:fa      1      60  PCS Systemtechnik GmbH  10.0.0.123      08:00:27:fc:d6:0f      1      60  PCS Systemtechnik GmbH -- Active scan completed, 2 Hosts found. nmap -v -T4 -p- 10.0.0.123        Starting Nmap 7.94 ( https://nmap.org ...

  Its a nightmare! 1. Find subdomain target.  2. exploit oracle padding attack on cookie to become admin and get logs  3. sqlmap 'logs' to get users and salt table to find gitea credentials  4. gitea holds a comment to find the fastAPI URL  5. find the number for some creds to get a token  6. Crack OAUTH token and forge a new one as admin with 'isadmin=1' . 7. find and send commands to get reverse shell  8. Explore to find 'user' name and sshkey  9. use 'user' and 'www-data' to escalate to 'power' with fastcgi socket  10. reverse engineer regex as power to get root

Aqua by H1dr0 is classed as a medium difficulty machine buy the author.... but there are quite a few steps you need to take to get the initial foothold. Unnecessary steps and rabbit holes have been left out and this has been arranged into order afterwards as it was not as so obvious at the time! Find it ┌──( kali㉿kali )-[ ~/aqua ] └─ $ sudo netdiscover -r 10.0.0.0/24 -P | tee findit [sudo] password for kali:     _____________________________________________________________________________    IP             At MAC Address     Count     Len   MAC Vendor / Hostname         -----------------------------------------------------------------------------   10.0.0.1         08:00:27:4d:be:20       1       60   PCS Systemtechnik GmbH   10.0.0.53       08:00:27:8b:53:11       1       60 ...