TryHackMe | Anonforce Writeup

TryHackMe’s Anonforce room is an easy room where we’ll use anonymous FTP access and bruteforcing to get root on the target machine. This writeup will go through each step required to complete the room.

Task 1: Anonforce Machine

1. user.txt
Let’s start the target machine by clicking the green “Start Machine” button at the top of the task. Next, we need to connect to the TryHackMe network. I’m using a Kali virtual machine so I’ll connect using OpenVPN. Now that we’re connected, let’s get started.

Starting the target machine

We’ll start by doing an nmap scan on the target. We want the services to be listed and the results to be very verbose, so we’ll include the sV and vv flags in our scan. The following will be the full command.

nmap -sV -vv 10.10.11.205

This reveals two open ports to us, FTP and SSH.

Results of the nmap scan

Since FTP is open, we may be able to make an anonymous login to the service. We can use the following command to connect.

ftp anonymous@10.10.11.205

When asked for a password, we simply hit enter and see if we get access.

Logging into FTP anonymously

We’re in! Now, let’s list the files to see if anything interesting is on the service.

Files on the FTP service

It looks like we have access to a lot of stuff. Let’s see if we can get our user flag now. We can look at the home directory for users and see if anything is there.

Finding and getting the user flag

The user flag was under the “melodias” user. We’re able to enter their directory and get the file. We can then open it on our machine and submit the flag.

Get Carson Shaffer’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

2. root.txt
We got the user flag, but now we need a way to get into the root account. There was a unusual directory called “notread” when we originally listed the contents of the FTP service, let’s take a look at what’s inside there.

Looking inside the notread directory

These files look useful. Let’s get them and see what’s inside.

Getting the backup and private files

The backup.pgp file is locked, so let’s try to use gpg2john with the private.asc file. We’ll save it to a file called “hash” and then use john with rockyou to crack it.

Getting the password

Now we can import that key using the following command.

gpg --import private.asc

When prompted for the password, we enter the one found by john. Now we can decrypt the backup.pgp file using the following command.

gpg --decrypt backup.pgp

From that we get what looks like a backup of the /etc/shadow file. It lists a password hash for root and melodias.

Finding password hashes of root and melodias

Looking at the root hash, we see that the password hash starts with “$6$”. A quick Google search reveals that this is a SHA-512 hash. Let’s try to use hashcat to crack this password hash. I called the file hashroot and removed everything except for the hash.

File with root’s password hash

The hashcat code for SHA-512 is 1800, we’ll use the rockyou wordlist, so we’ll use the following command.

hashcat -m 1800 hashroot — wordlist /usr/share/wordlists/rockyou.txt

Within a few seconds we get a hit for our password.

Getting the root password

With the root password, we can access the machine using SSH.

Logging in as root

Now all we need to do is list the files in the root directory and get the flag.

Getting the root flag

We’ve completed the room! We used anonymous FTP access and bruteforcing to go from an nmap scan to root access. I hope this writeup could be helpful in completing the room! If you are still struggling please leave a comment or message me on Twitter and I will try my best to assist!

Lessons Learned:

• Anonymous FTP access is very powerful

Things I struggled with:

When I accessed FTP, I immediately downloaded the /etc/passwd file which listed the melodias user. I assumed that I would have to use hydra to bruteforce the password, SSH in, and escalate from there. I let Hydra run for a long time before looking back at the FTP files. When I went back I noticed the “notread” directory which contained the actual files to use. I wasted a lot of time waiting for Hydra because I didn’t pay attention to all the files.

Conclusion:

I thought this room was good. I think this is the first ctf writeup I’ve done where the HTTP port wasn’t open which was a nice change. This room was good for practicing discovery and hashcat. I would recommend this room to someone who has done a few other easy rooms and wants to practice.