Personal WebsiteGithubLinkedIn

Chill Hack

LogoChill HackTryHackMe

Task 1 Investigate!

User Flag

  • Let's run a simple nmap scan against the target machine.

  • There are three open ports:

Port
Service

21

ftp

22

ssh

80

http

  • We can connect anonymously through FTP.

  • There is a note.txt file that we can download on our machine using the get command.

  • Let's cat out the note.txt file.

  • So there is some page where we can input commands which are then filtered.

  • Let's try to find out the page where this is happening using gobuster.

  • The /secret page looks interesting, let's visit it through our browser.

  • As we can see this is the page where we can input commands.

  • Let's pass the following command:

  • Looks like it worked.

  • Let's list out the content of the directory:

  • Ah so our command probably matched some black-list string and was filtered.

  • We can try to bypass the filter using single quotes:

  • There is an index.php file. If we can manage to read it, we might be able to see how the black-list is implemented.

  • Let's cat it out.

  • We can do the same bypass as before with single quotes:

  • The layout looks different. That is because the ìndex.php file was read and executed.

  • We can now check the source code using CTRL+U.

  • Now we know what pattern are being filterd.

  • Let's set up a nc listener.

  • Now we have to provide a PHP reverse shell:

  • Let's check back on our listener.

  • We can get a stable shell using the following command:

  • Let's chat files the www-data user can run using sudo.

  • Let's take a better look at what the .helpline.sh file does.

  • So it uses the /bin/bash interpreter for all of the user input. Which means we we should be able to get a shell.

  • Let's get the flag from /user.txt.

Answer

Root Flag

  • Let's list out the contents of the directory.

  • We can see that there is a JPG image.

  • Let's set up a Python3 server so that we can get this file from our attacker machine.

  • On our attacker machine we have to use wget to download the JPG file.

  • Using steghide we can check if there is any embedded file or message and extract it.

  • Let's unzip the ZIP file.

  • In order to unzip it we need a password.

  • We can use zip2john to convert the ZIP file into a hash.

  • Now, using john we can crack the hash.

  • Let's unzip the file using the pass1word password.

  • In the source_code.php file we can see a message for a user Anurodh and a Base64 encoded password.

  • Let's decode the password using base64.

  • We can now login through SSH as the user anurodh using the !d0ntKn0wmYp@ssw0rd password.

  • Using the id command we can check the groups that the anurodh user is part of.

  • So the anurodh user is part of the docker group.

  • We can find an exploit for Docker on GTFOBins.

  • Let's use the exploit without the sudo.

  • We are now the root user and can read the root flag.

Answer

Last updated

Was this helpful?