Personal WebsiteGithubLinkedIn

Agent Sudo

Task 1: Author note

Deploy the machine

No answer needed

Task 2: Enumerate

How many open ports?

Let's run a simple nmap scan on the IP address.

$ nmap -sC -sV 10.10.80.123
Starting Nmap 7.92 ( https://nmap.org ) at 2023-11-13 13:14 IST
Nmap scan report for 10.10.80.123
Host is up (0.13s latency).
Not shown: 997 closed tcp ports (conn-refused)
PORT   STATE SERVICE VERSION
21/tcp open  ftp     vsftpd 3.0.3
22/tcp open  ssh     OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 ef:1f:5d:04:d4:77:95:06:60:72:ec:f0:58:f2:cc:07 (RSA)
|   256 5e:02:d1:9a:c4:e7:43:06:62:c1:9e:25:84:8a:e7:ea (ECDSA)
|_  256 2d:00:5c:b9:fd:a8:c8:d8:80:e3:92:4f:8b:4f:18:e2 (ED25519)
80/tcp open  http    Apache httpd 2.4.29 ((Ubuntu))
|_http-title: Annoucement
|_http-server-header: Apache/2.4.29 (Ubuntu)
Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 32.64 seconds

There are three open ports:

Port
Service

21

ftp

22

ssh

80

http

Answer

How you redirect yourself to a secret page?

Let's visit the machine using the browser.

We have to use modify our request. For that we have to intercept it using Burpsuite.

Let's forward the request to the Intruder.

After setting the field on the User-Agent, we can move on to selecting the payloads.

We can set the Payload as a Simple list and use all the characters.

Let's start the attack.

We can see that the request where the User-Agent: C is being redirected to another page as shown by the 302 code.

Answer

What is the agent name?

Let's go to the Options tab and set the Follow redirection option to Always.

Now, let's start the attack again and check Response 2 to see if it has any useful information.

We are told the the user chris has a weak password.

Knowing that FTP is running on the machine, this could be an opportunity for brute forcing.

Answer

Task 3 Hash cracking and brute-force

FTP password

Using hydra, we can brute force the password for the user chris.

Now we know that the password for user chris is crystal.

Answer

Zip file password

Let's login through FTP using those credentials.

Let's list out the contents.

We can now download all the file using the get command.

Now that all of those files are in our machine we can search for the ZIP file. Let's use binwalk on the cutie.pngfile to find more information.

We can see that there is Zip archive data in one of the files. Let's use binwalk to extract the ZIP file.

Let's go to the _cutie.png.extracted directory and take a look inside.

We can use 7z to unzip the file.

We don't know the password yet. In order to unzip the file, we will first need to find it's hash. We can do that using zip2john.

Let's now try to crack the password using john (John The Ripper).

So the password of the ZIP file is alien.

Answer

steg password

We can now unzip the ZIP file.

Let's cat the content of To_agentR.txt.

The string QXJlYTUx looks to be Base64 encoded. Let's try to decode it.

Answer

Who is the other agent (in full name)?

Next we can extract information from the cute-alien.jpg file using steghide.

Let's cat the contents of message.txt.

So we know that the user james has the password hackerrules!.

Answer

SSH password

Answer

Task 4: Capture the user flag

What is the user flag?

Let's SSH into James' machine.

Now we can look at the files in the machine.

Let's cat the user_flag.txt file.

Answer

What is the incident of the photo called?

For this we have to download the Alien_autospy.jpg image.

We can now use TinEye to perform a reverse image search.

8

Let's upload the file.

9

Let's click on the top link.

10

Answer

Task 5: Privilege escalation

CVE number for the escalation

Let's look at what binaries have the

The users are not allowed to run /bin/bash as root. If we go to Exploit Database, we can find the CVE for this vulnerability.

11

Answer

What is the root flag?

We can also find the exploit for this vulnerability on Exploit Database.

12

Let's enter that in the terminal.

We have successfully escalated out privilege to root.

Let's cat the root flag.

Answer

(Bonus) Who is Agent R?

The message was from Agent R who is also known as DesKel.

Answer

Last updated

Was this helpful?