Personal WebsiteGithubLinkedIn

Year of the Rabbit

LogoYear of the RabbitTryHackMe

Task 1: Flags

Question

What is the user flag?

  • Let's scan the target machine using nmap.

  • There are three open ports:

Port
Service

21

ftp

22

ssh

80

http

  • We can brute force the directories of the webpage using gobuster.

  • Let's go to the assets/ directory.

  • Let's check out the style.css file. We will avoid the RickRolled.mp4 file for obvious reasons.

  • So now we can go to /sup3r_s3cr3t_fl4g.php.

  • If we click OK we just get Rick Rolled.

  • Let's intercept the request in Burpsuite.

  • We can Forward this request.

  • Let's see what is in the /WExYY2Cv-qU directory.

  • We can download the Hot_Babe.png file using wget.

  • Let's use the strings utility to see the strings present inside the file.

  • Let's save the password to a file called ftp_passwords.txt.

  • Now using hydra we can brute force the FTP login.

  • So the password for ftpuser is 5iez1wGXKfPKQ.

  • Let's login using those credentials.

  • Let's look around for important files.

  • We can download the Eli's_Creds.txt file to our machine using the get command.

  • Let's read the contents of the file.

  • The text is in Brain Fuck.

  • We can use an online decoder to decode it.

  • The password for the eli user is DSpDiM1wAEwid.

  • We can try to login through SSH using these credentials.

  • After a bit of searching we can find the user.txt file.

  • Let's try to read it.

  • The user eli does not have the permission to read the user.txt file.

  • Let's try to find the s3cr3t mentioned in the message.

  • We can now read the .th1s_m3ss4ag3_15_f0r_gw3nd0l1n3_0nly! file.

  • So now we know that the password for gwendoline user is MniVCQVhQHUNI.

  • Let's switch users.

  • We can now read the user.txt file we saw earlier.

Answer

What is the root flag?

  • We can check what commands gwendoline can execute using sudo.

  • Let's check the version of sudo.

  • We can find an exploit for that version om Exploit-DB.

  • Let's craft our exploit.

  • Next we have to type the following:

  • We must have root access.

  • Let's get the root flag.

Answer

Last updated

Was this helpful?