TryHackMe — Anonforce
Difficulty: Easy
Run An Nmap Scan Against The Machine’s IP Address.
One thing is pretty sure that we have access to the machines file system via FTP. which means we can’t run OS commands like cat,ls,whoami etc.
Initial Foothold
accessing the machine via FTP by logging in as anonymous and search for some interesting files
we got the user flag in this dir “/home/melodias”
Privilege Escalation To Root
Let’s Check Any Other Sus Things on FTP.
Get r00t4c1d (Rishi)’s stories in your inbox
Join Medium for free to get updates from this writer.
Here, we can see that there is one odd directory named as notread.
in that directory we can see there are two files namely backup.pgp and private.asc. This gives us a direct hint towards PGP cracking. And for that we first need to download both these files on our local system. access the encrypted data, we need to proceed in a defined step for more details can be found here
Our first task is to crack the private.asc file to get the passphrase. gpg2john it was used to convert the asc file to a format that can be understood by john.
we can easily import the private.asc key. and decrypt backup.pgp with that password too.
Then Crack a root Hash With John Tool Like This.
┌[redteam]─[22:31–14/05]─[/home/rishi/THM/Anonforce]
└╼root$john hash — wordlist=/usr/share/wordlists/rockyou.txt
Using default input encoding: UTF-8
Loaded 1 password hash (sha512crypt, crypt(3) $6$ [SHA512 256/256 AVX2 4x])
Cost 1 (iteration count) is 5000 for all loaded hashes
Will run 2 OpenMP threads
Press ‘q’ or Ctrl-C to abort, almost any other key for status
0g 0:00:00:13 0.04% (ETA: 08:01:33) 0g/s 448.4p/s 448.4c/s 448.4C/s sugarbaby..april27
<PASS> (?)
Then SSH To root Cat a root.txt Flag.
ROOTED
