Tomghost CTF

Link ctf:https://tryhackme.com/room/tomghost

Author:0xNOVA

Platform: TryHackMe

Scaning

We begin our assessment by running an Nmap scan against the target IP (10.128.134.30) to discover open ports and running services.

Results:

Port 22 (SSH): OpenSSH 7.2p2 (Ubuntu)

Port 53 (DNS): tcpwrapped

Port 8009 (AJP): Apache Jserv (Protocol v1.3)

Port 8080 (HTTP): Apache Tomcat/9.0.30

Vulnerability Research

After identifying the services and their exact versions via Nmap (specifically Apache Tomcat 9.0.30), we searched Exploit-DB for known vulnerabilities, CVEs, or public exploits associated with this version to determine whether a web-based vector was viable.

Started the Metasploit console

Searching for the Exploit

Selected the GhostCat auxiliary module (auxiliary/admin/http/tomcat_ghostcat) and configured the target IP (RHOSTS)

Run the Exploit

search tomcat ajp
use 0
set RHOSTS 10.128.134.30
run

The exploit successfully bypassed restrictions and dumped the contents of the target file, revealing a hardcoded description containing valuable credentials (skyfuck:8730281lkjlkjdqlksalks).

ssh login

using the credentials (skyfuck:8730281lkjlkjdqlksalks) obtained via the GhostCat vulnerability, we successfully established an initial shell on the target machine via SSH.

Get 0xNOVA71’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

Two critical files required for the next stage of our escalation:

• credential.pgp (an encrypted credentials file)
• tryhackme.asc (an encrypted PGP key)

We imported the PGP private/public key using the gpg utility:

We printed the contents of the key file directly to the terminal:

To decrypt the sensitive credential file, we needed to unlock the PGP private key. Since the key was protected with a passphrase, we extracted its hash into a format compatible with password-cracking utilities and attacked it using a wordlist.

We converted the PGP key into a John-compatible hash using

gpg2john tryhackme.asc > thm.hash

We used John the Ripper alongside the popular rockyou.txt wordlist to crack the extracted hash

John succeeded in finding the secret key hash and instantly recovered the plaintext passphrase: alexandru

We executed the decryption command using the gpg utility

gpg --decrypt credential.pgp

Username / Password: merlin : asuyusdoiuqoilkda312j31k2j123j1g23g12k3g12kj3gk12jg3k12j3kj123j

After logging into the machine via SSH using merlin's credentials, we checked our sudo permissions (sudo -l), which showed that merlin could execute /usr/bin/zip as root without a password (NOPASSWD).

By referencing GTFOBins, we executed the exploit command to spawn a privileged shell:

sudo zip /tmp/test.zip /etc/hosts -T -TT '/bin/sh #'

Verify our identity with whoami confirm full root access, and capture the user.txt and root flag!

Thanks❤️