search

agent sudo

hashtag
General

This is a writeup of the room https://tryhackme.com/room/agentsudoctfarrow-up-right.

hashtag
Writeup

hashtag
Enumeration

First an initial nmap scan,

$ nmap -sV -oN nmap.out <ip>

which shows ftp on port 21, ssh on port 22, and a webserver on port 80.

Accessing the website shows a message from Agent R, indicating that the User-Agent must be manipulated to access the site.

Setting the User-Agent: R via curl yields the following,

$ curl -A "R" 10.10.94.61
What are you doing! Are you one of the 25 employees? If not, I going to report this incident
<!DocType html>
<html>
<head>
	<title>Annoucement</title>
</head>

<body>
<p>
	Dear agents,
	<br><br>
	Use your own <b>codename</b> as user-agent to access the site.
	<br><br>
	From,<br>
	Agent R
</p>
</body>
</html>

which indicates all letters of the alphabet are used as identifiers for the different agents.

Iterating through the alphabet, one will find the name of the agent being asked for.

hashtag
Hash cracking and brute-force

Anonymous FTP login was not possible, and guessing the intended username for the FTP service is possible from the enumeration part, hence the password must be brute-forced. In this case, hydra was used like so:

Ultimately, this yields a password that can be used to login at the FTP service, and thereby list the following files:

To download all those files to analyze them locally, the following can be used:

Moving on with binwalk to find embedded files and extracting those:

Extracting the zip archive:

The zip archive turns out to be password-protected. Here zip2john can be used:

The file john.txt is then passed on to john, yielding the password:

This allows us to unzip the archive, and we can then read To_agentR.txt. Utilizing https://gchq.github.io/CyberChef/arrow-up-right and its Magic functionality proposes what turns out to be the password needed for extracting the embedded content in the other image file, cute-alien.jpg.

For this, steghide can be used. First we try to get information on embedded data:

It turns out that cute-alien.jpg contains a message.txt file. This is then extracted:

From the content of message.txt, we can derive the full name of the other agent and the SSH password.

hashtag
Capture the user flag

Upon logging in via SSH, a file user_flag.txt is found together with an image file, Alien_autopsy.jpg. Some googling should get you the answer to the incident question.

hashtag
Privilege escalation

So, the name of the CTF kind of hints at the attack vector already. Nevertheless, it is always nice to see what can be executed as root to begin with:

If we then see what version of sudo is running on the machine:

Then we rather quickly find that the exploit found here https://www.exploit-db.com/exploits/47502arrow-up-right is suitable, and works perfectly fine to obtain root and answer the remaining questions.

PreviousTryHackMeNextskynet

Last updated