Personal WebsiteGithubLinkedIn

Startup

LogoStartupTryHackMe

Task 1: Welcome to Spice Hut!

What is the secret spicy soup recipe?

  • Let's first scan the IP address using nmap.

  • There are three open ports:

21

ftp

22

ssh

80

http

  • Let's visit the machine's HTTP port through the browser.

  • As we can see, there is nothing of importance on this page.

  • We can try to find other pages or directories using gobuster.

  • Let's try out the /files directory.

  • We can login go to the FTP server of the machine.

  • Note that the password for anonymous login is anonymous.

  • Let's look around a bit.

  • We can upload a reverse shell in this directory.

  • We will be using the /usr/share/webshells/php/php-reverse-shell.php script after making some modifications.

  • We replaced the IP address with our tun0 address and set the port to a port of our choice.

  • Let's upload the file to the FTP server using put.

  • Now we have to listen on the 9999 port using netcat.

  • Let's go to the /files/ftp folder.

  • All we have to do now is execute the php-reverse-shell.php file.

  • If we go back to our console, we must have a shell.

  • We can stabilize the shell using the following commands:

  • Let's look for the secret spicy soup recipe.

  • Here, the recipe.txt file seems interesting. We can read it using the cat command.

Answer

Question

What are the contents of user.txt?

  • We have to go to the /incidents directory.

  • Let's copy the suspicious.pcapng file to the ftp directory.

  • Let's look at the ftp login.

  • We can now download this file using the get command.

  • We can now use Wireshark to analyze the packet capture.

  • In frame 45 we can see that the user has entered some commands.

  • Let's Follow > TCP Stream.

  • The password for the lennie user is c4ntg3t3n0ughsp1c3.

  • We can now go to /home/lennie and get the flag.

Answer

Question

What are the contents of root.txt?

  • Let's check what's inside the scripts/ directory.

  • We can check what the planner.sh file is doing using cat.

  • We can see that it execute the /etc/print.sh file.

  • Let's check that file out.

  • So we can execute the print.sh file as lennie.

  • But before that let's modify it to get a reverse shell.

  • We can get a bash reverse shell from Revshells.com.

  • The IP address is our tun0 address.

  • After saving the changes, we can listen on port 9998 and run the planner.sh file.

  • Let's get the root flag.

Answer

Last updated

Was this helpful?