http://binternet.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/HTB/Medium/37.html
Nice try, we cannot ssh as ldapuser2 remotely, we need to do it locally using su: [2020-03-30] [ 10.10.14.42/23 ] [~/_HTB/Lightweight]
→ ssh
[email protected]
[email protected]'s password:
Last login: Mon Mar 30 15:33:14 2020
from 10.10.14.42
[10.10.14.42@lightweight ~]$ su ldapuser2
Password:
[ldapuser2@lightweight 10.10.14.42]$ whoami
ldapuser2
[ldapuser2@lightweight 10.10.14.42]$ cd ~
[ldapuser2@lightweight ~]$ cat user.txt
...