TryHackMe | Wgel CTF Writeup

TryHackMe’s Wgel CTF room is an easy room involving scanning, directory bruteforcing, and privilege escalation to get root access on a machine. This writeup will cover everything needed to complete the room.

Task 1: Wgel CTF

1. User flag
Let’s start with an nmap scan to see what ports are open on the target machine. We’ll want a list of services so we can use the sV flag and we want the results to be very verbose so we’ll use the vv flag. The full command will look like the following.

nmap -sV -vv 10.10.180.171

From the scan we can see two open ports, SSH and HTTP.

Results of the nmap scan

Let’s check out the HTTP page. We are greeted with a default Apache2 page.

Navigating to the website

This isn’t really anything special, so let’s do a Gobuster scan with the common.txt wordlist to see if we can find any interesting directories. The command we’ll use is:

gobuster dir -u http://10.10.180.171 -w /usr/share/wordlists/dirb/common.txt

This gives us one result that might be useful.

Results of Gobuster scan

The only directory that we may be able to use is /sitemap, let’s navigate there and see what we find.

Going to /sitemap

I’ve never heard of unapp before, so let’s run another Gobuster scan to find any directories after sitemap. The command will look like:

gobuster dir -u http://10.10.180.171/sitemap -w /usr/share/wordlists/dirb/common.txt

This reveals something very interesting.

Results of the second Gobuster scan

There is a /.ssh directory, let’s see what’s on that.

Navigating to /.ssh

There is an id_rsa file. We can use this to SSH into the target, let’s copy the key into a file called “idrsa”. We should then change the permissions to allow us to use it as an SSH key.

Copying the id_rsa key

We have an SSH key, but we don’t have a user, let’s try to find one. We can look at the source code of the default Apache page and use ctrl+f to search for words. If we search for “<! --“ we can see any comments that are in the code. The last comment gives us a user.

Finding a user

We have found someone named Jessie, let’s try to login as them using SSH and the key we found. We’ll use the following command to SSH as Jessie and specify the key.

ssh jessie@10.10.180.171 -i idrsa

And we’re in.

Logging in as Jessie

Get Carson Shaffer’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

Let’s find and submit the user flag.

Finding the user flag

2. Root flag
Let’s look for privilege escalation vectors. We’ll start by running “sudo -l” to list our sudo privileges.

Sudo permissions

We can run wget as root without a password. Let’s take a look at gtfobins to see if we can utilize this to escalate our privileges.

Results of gtfobins

We can use wget to get files from our machine and save it as any file on the target. Let’s try adding a new root user to the machine. We’ll use “cat” to get the /etc/passwd file, then we can change it on our machine and use wget on the target to save it.

Saving /etc/passwd to our own machine

Let’s create a new user and add it to the passwd file. We’ll start by generating a password using openssl. Our password doesn’t need to be complex, so I’ll use a password of 1 with a salt of 1.

Generating a password

Now we need to add this with our user to the passwd file. Since we want our user to be root, we can simply copy the root passwd entry, then we can change the username and password to what we want.

Adding our user

Now we need to utilize wget to get this file from our machine to the target. We need to start a http server so that the target can access the file. We’ll use the following command to start that.

sudo python3 -m http.server 80

This starts a server on port 80. Now we can use the commands from the gtfobins entry to specify our web server and file. We want to replace the /etc/passwd file so we’ll specify that as the LFILE. We’ll use the following commands to do this.

URL=http://<our_ip>/passwd
LFILE=/etc/passwd

With those two things specified and our server set up, we can run the last command to grab and replace the /etc/passwd file.

Using wget on our passwd file

Now we should be able to use “su carson” with our password of 1 to change to our new root user.

Changing to root

Nice! We now have root on the target machine. Let’s go get the root flag now.

Getting the root flag

The room is done! We’ve gone from an nmap scan to root access using directory bruteforcing, sudo permissions, and adding a new root user. I hope this writeup could be helpful in completing the room! If you are still struggling please leave a comment or message me on Twitter and I will try my best to assist!

Lessons Learned:

• Wget can be used to replace files with malicious ones
• New users can be added if you can change the /etc/passwd file

Things I struggled with:

When trying to escalate my privileges, I first sent myself the /etc/passwd and /etc/shadow file and tried to use John to crack passwords. After waiting for a long time I realized that the password was probably not in rockyou. I then spent a while trying to figure out a way to escalate when I was halfway there with the passwd file. I then messed up the file the first time and broke the system and had to reset the machine, which was annoying. Nothing else was too difficult, and I think I approached the room pretty well.

Conclusion:

I liked this room. I think the main thing that I liked was the privilege escalation vector, as I hadn’t done it before in a room. You could probably use wget for other vectors like maybe scheduled tasks or something, which adds variety to how you can complete the room. I would recommend this room to someone who has done some easy rooms and wants a bit of a challenge.