Agent Sudo
Task 1 - Deploy the machine
🎯 Target IP: 10.10.62.30
Create a directory for machine on the Desktop and a directory containing the scans with nmap.
Task 2 - Reconnaissance
I prefer to start recon by pinging the target, this allows us to check connectivity and get OS info.
Sending these three ICMP packets, we see that the Time To Live (TTL) is ~64 secs. this indicates that the target is a *nix system (probably Linux), while Windows systems usually have a TTL of 128 secs.
Task 3 - Enumerate
3.1 - How many open ports?
sudo
run as root
sC
run default scripts
sV
enumerate versions
A
aggressive mode
T4
run a bit faster
oN
output to file with nmap formatting
It looks like there are three open ports on the machine: 21, 22, 80.
3.2 - How you redirect yourself to a secret page?
3.3 - What is the agent name?
We can see our user-agent using dev mode (F12)
We say that the correct user-agent is a capital letter, than using BurpSuite we can test all alphabet
We need to set user-agent to 'C' and we can see agent name.
For this thing, we can use a firefox extension: User-Agent Switcher and Manager
Refreshing page we see agent name:
Task 4 - Hash cracking and brute-force
4.1 - FTP password
We knwo a username: chris, then, we can use hydra to find psw:
chris::crystal
4.2 - Zip file password
It's time to access with ftp credentials:
Dear agent J,
All these alien like photos are fake! Agent R stored the real picture inside your directory. Your login password is somehow stored in the fake picture. It shouldn't be a problem for you.
From, Agent C
It surely means that we're talking about steganography, then, we download all photos with get command.
These two informations are important:
Then, we use flag -b to extract archive:
it's not a good solution, we can try another similar tool (binwalk):
So we used “zip2john” to crack the zip file password:
And then we used John the Ripper to crack the hash:
We've found the archive password:
4.3 - Steg password
So we tried to extract the zip file but unzip command didn’t work so we used this command
Agent C,
We need to send the picture to 'QXJlYTUx' as soon as possible!
By, Agent R
This word: QXJlYTUx can be an encoded psw,
we can use a web tool: https://gchq.github.io/CyberChef/#input=UVhKbFlUVXg or
4.4 - Who is the other agent (in full name)?
Reading last request (steg psw), we image that's the cute-alien.jpg steg password, then we use steghide to extract information:
Hi james,
Glad you find this message. Your login password is hackerrules!
Don't ask me why the password look cheesy, ask agent R who set this password for you.
Your buddy, chris
4.5 - SSH password
Reading message.txt, we know that the psw is:
Task 5 - Capture the user flag
5.1 - What is the user flag?
5.2 - What is the incident of the photo called?
We need to find out where the image is from. You can use the command below to download the image from the machine and do a reverse image search on Google
We can do a reverse image search on this jpg using Google:
Task 6 - Privilege escalation
6.1 - CVE number for the escalation
We can check the user's permissions by the following command:
Googling the result we find the following vulnerability:
In alternative we can retrieve sudo version and find it on searchsploit.
6.2 - What is the root flag?
We use this exploit to scale privileges:
We're root!
6.3 - (Bonus) Who is Agent R?
Reading all message of root's flag, we can say the name of agent R:
To Mr.hacker,
Congratulation on rooting this box. This box was designed for TryHackMe. Tips, always update your machine.
By, DesKel a.k.a Agent R