Personal WebsiteGithubLinkedIn

tomghost

https://tryhackme.com/room/tomghost

Task 1: Flags

Compromise this machine and obtain user.txt

Let's run a nmap scan using the IP address.

$ nmap -sC -sV 10.10.106.51
Starting Nmap 7.92 ( https://nmap.org ) at 2023-11-13 19:55 IST
Nmap scan report for 10.10.106.51
Host is up (0.13s latency).
Not shown: 996 closed tcp ports (conn-refused)
PORT     STATE SERVICE    VERSION
22/tcp   open  ssh        OpenSSH 7.2p2 Ubuntu 4ubuntu2.8 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 f3:c8:9f:0b:6a:c5:fe:95:54:0b:e9:e3:ba:93:db:7c (RSA)
|   256 dd:1a:09:f5:99:63:a3:43:0d:2d:90:d8:e3:e1:1f:b9 (ECDSA)
|_  256 48:d1:30:1b:38:6c:c6:53:ea:30:81:80:5d:0c:f1:05 (ED25519)
53/tcp   open  tcpwrapped
8009/tcp open  ajp13      Apache Jserv (Protocol v1.3)
| ajp-methods: 
|_  Supported methods: GET HEAD POST OPTIONS
8080/tcp open  http       Apache Tomcat 9.0.30
|_http-title: Apache Tomcat/9.0.30
|_http-favicon: Apache Tomcat
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 29.95 seconds

There are four open ports:

Port
Service

22

ssh

53

tcpwrapped

8009

ajp13

8080

http

As we can see, the 8009 port is running AJP.

Let's visit port 8080 through the browser.

The version of Tomcat is9.0.30. This version is vulnerable to Ghostcat.

We can find the exploit on the Exploit Database website.

After downloading, we can run the exploit as follows:

We need to change bufsize to buffering at line 262.

Let's run it again.

We can fix this error by adding a b at line 302 before the "". This converts the string object into a byte object.

Our exploit should run fine now.

So the username is skyfuck and the password is 8730281lkjlkjdqlksalks.

We can now login through SSH using those credentials.

Username
Password

skyfuck

8730281lkjlkjdqlksalks

Let's look around for useful files.

We need to copy these files to our local machine. We can do this using scp.

Now using gpg2john, we can find the hash of the tryhackme.asc file.

Let's now use John the Ripper to find the password.

Let's read the tryhackme.asc file using the password.

We can now decrypt the credential.pgp file.

Look like another user's credentials.

Let's SSH login using the following credentials:

Username
Password

merlin

asuyusdoiuqoilkda312j31k2j123j1g23g12k3g12kj3gk12jg3k12j3kj123j

Let's cat the flag now.

Answer

Escalate privileges and obtain root.txt

We need to look for sudo entries first.

Let's go to GTFOBins to find some exploit.

Let's use the exploit.

Looks like we have root privilege. We can verify that using the id command.

Let's cat the root flag.

Answer

Last updated

Was this helpful?