Personal WebsiteGithubLinkedIn

Cyborg

LogoCyborgTryHackMe

Task 1: Deploy the machine

Deploy the machine

  • We simply have to click on the Start Machine button.

No answer needed

Task 2: Compromise the System

Scan the machine, how many ports are open?

  • Let's perform an nmap scan on the IP address.

  • There are two open ports:

Port
Service

22

ssh

80

http

Answer

What service is running on port 22?

Answer

What service is running on port 80?

Answer

What is the user.txt flag?

  • Let's check the target's web page through the browser.

  • Now that we know it is hosting a apache2 server, we can brute force the directories using gobuster.

  • Let's go to the admmin directory and see what we can find.

  • Let's go to the Admin page.

  • From what Alex said in his final message, we know that he has probably set up a squid proxy.

  • Before we look for it's directory let's see what Archive has.

  • Let's click on Download.

  • We can extract his archive using the tar utility.

  • After extracting the archive, if we go to home/field/dev/final_archive and cat the README file present there we get the following information.

BORG backup

  • BORG is a duplication program used to securely and efficiently backup data.

  • It can also be used to backup entire filesystems which can then be mounted onto other filesystems for easier examination.

  • Having read the messages between the two admin, we can guess that this is a probably a backup of Alex's filesystem.

  • However, before we do that, let's first check out the etc directory as well.

  • Ah! So this is where the squid directory for the Squid proxy was located. Let's go inside.

  • The passwd file probably has some useful information.

  • We have what looks to be a pair of a username music_archive and a hashed password $apr1$BpZ.Q.1m$F0qqPwHSOG50URuOVQTTn..

  • Let's identify the hash using the hash-identifier utility.

  • Before we crack the hash let's save the hash in a hash.txt file and take a look at the hash-mode for MD5(APR).

  • Now we can use hashcat to crack the hash.

  • Now we know both the username and the password.

  • We are all set to extract the Alex's filesystem. We can use the borg utility to do this.

  • If we then go to the home/alex/Documents directory, we see a note.txt file.

  • Let's cat out the file.

  • Let's try to ssh into the machine using the above credentials.

  • We have successfully logged on to Alex's machine.

  • Let's look around to see what we can find.

  • The user.txt file seems interesting. Let's check it's contents.

Answer

What is the root.txt flag?

  • In order to find the root flag we need to become the root user.

  • Using the sudo -l command we can see what sudo permissions the alex user has.

  • We can see the /etc/mp3backups/backup.sh script can be executed by any user, including us.

  • Looking inside the while look, we can see that the program takes in user command identified by -c, and executes it.

  • Using this knowledge, we can set the suid bit on the /bin/bash file.

  • Now on executing the bash command, we will get root privilege.

  • Let's check our effective ID.

  • We can now go the /root directory.

  • Let's cat the flag.

Answer

Last updated

Was this helpful?