TryHackMe | GoldenEye | WriteUp

Bond, James Bond. A guided CTF.

Link to the room: https://tryhackme.com/room/goldeneye

GoldenEye

I’m not going to give you all the answers, i will be giving ways to proceed further. Use the ways, scan the machine, run the commands on your machine and get the answers on your own.

Task 1: Intro & Enumeration

Use nmap to scan the network for all ports. How many ports are open?

Let’s do some basic enumeration with given machine-ip using nmap

//this is going to take some time, take a coffee break if you want to.

nmap -T4 -sC -sV -p- -Pn -o nmap.scan 10.10.45.51

Answer is in output of the scan.

Who needs to make sure they update their default password?

From the above nmap scan it looks like some http service is running on port 80.

Navigate in browser, 10.10.45.51:80

Press Ctrl+U, to view the source code of webpage.

http://10.10.45.51/terminal.js

Looks like some message here, with encoded password.

Whats their password?

For this question, we need http://10.10.45.51/terminal.js , encoded password.

InvincibleHack3r

Using CyberChef, use Magic Operation to cook the result or use From HTML entity.

use this login credentials to log into http://10.10.45.51/sev-home/

Task 2: Its mail time…

Inspect port 55007, what service is configured to use this port?

From here, http://10.10.45.51/sev-home/, it’s known we will be using pop3.

telnet 10.10.45.51 55007

Quick overview of what is pop3, source: https://electrictoolbox.com/pop3-commands/

The commands used to retrive mail from a POP3 server by an email client are a series of text commands with single line responses from the mail server. The commands and examples used here are defined by RFC 1939 — Post Office Protocol — Version 3.

The most commonly used commands in a POP3 connection are as follows:

USER <username>
PASS <password>
STAT
LIST
RETR
DELE
RSET
TOP
QUIT

where <username> and <password> are your mailbox’s username and password. These are passed as plain text to the mail server and are not encrypted in any way.

All responses from the server will start with one of the following:

+OK
-ERR

There is usually more information displayed after this status value (+OK means your command was successful and -ERR that it failed) to indicate why there was an error, or what the result of the command was if it suceeded.

//used the above credentials but got error Authentication failed.

If those creds don’t seem to work, can you use another program to find other users and passwords? Maybe Hydra?Whats their new password?

Now going to bruteforce the password for boris. i’m using here hydra, great tool, you can use any of your choice.

hydra -l boris -P /usr/share/wordlists/rockyou.txt pop3://10.10.45.51:55007

rockyou.txt is big list, also taking much time, so used fasttrack.txt

hydra -l boris -P /usr/share/wordlists/fasttrack.txt pop3://10.10.45.51:55007

got -ERR Disconnected for inactivity during authentication.

so, tried once more. And got the password [sec****!]

now we can login into pop3.

telnet 10.10.45.51 55007

What can you find on this service?

— emails

What user can break Boris’ codes?

— Nat****

Using the users you found on this service, find other users passwords.

Going to make a user.txt of the names found from emails.

root

natalya

Xenia

alec

janus

hydra -L user.txt -P /usr/share/wordlists/fasttrack.txt pop3://10.10.45.51:55007/

Found natalya password.

Get Unkn9wn’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

telnet 10.10.45.51 55007 //login as natalya with the password

On reading emails, username: xenia password: RCP90rulez!

Also they mention servernaya-station.com, let’s add in /etc/hosts and do some surfing.

Task 3: GoldenEye Operators Training

Follow the instructions, “If you remembered in some of the emails you discovered, there is the severnaya-station.com website. To get this working, you need up update your DNS records to reveal it.

If you’re on Linux edit your “/etc/hosts” file and add:

<machines ip> severnaya-station.com”.

Once you have done that, in your browser navigate to: http://severnaya-station.com/gnocertdir

Try using the credentials you found earlier. Which user can you login as?

— xe***

Have a poke around the site. What other user can you find?

— d**k

What was this users password?

Going to bruteforce doak’s password.

hydra -l doak -P /usr/share/wordlists/fasttrack.txt pop3://10.10.45.51:55007/

goat the password.

login into pop3 as doak: telnet 10.10.45.51 55007

What is the next user you can find from doak?

username: dr_doak

password: 4England!

Login as dr_doak at severnaya-station.com.

look for “my private files” in right-most corner. Download the s3cret.txt

navigate to http://severnaya-station.com/dir007key/for-007.jpg

download the image and analyze using exiftool. See the image description, decode it using CyberChef, base64; xWinter1995x!

It’s look like passwd but for which user????

try stegano…; strings for-007.jpg

got some text, trying to connecting some dots, so trying after various usernames xenia, boris, goldeneye, james; it’s admin.

From TryHackMe: “Take a look into Aspell, the spell checker plugin.”

search for spell in search; There are 2 settings to modify so that it works:

• Spell engine: PSpellShell
• Path to aspell: your reverse shell // i used python-reverse-shell from https://highon.coffee/blog/reverse-shell-cheat-sheet/

setup the listener in our machine; nc -lvnp 1234

go to; Home->My profile-> Blogs -> Add a new entry and toggle spell checker;

got the shell, transfer LinEnum.sh to target machine in /tmp directory.

by executing LinEnum.sh enumerate the target machine.

Task 4: Privilege Escalation

Whats the kernel version?

uname -a

You can download the exploit from here: https://www.exploit-db.com/exploits/37292

Downloaded the exploit into target machine, but the exploit in C, and the problem is gcc compiler is not installed on our target.

used Question Hint; Its a VERY simple fix. You’re only changing 1 character…

may it is not gcc, its cc???

which cc

/usr/bin/cc

All we need to do is to replace gcc by cc in the exploit:

www-data@ubuntu:/tmp$ sed -i "s/gcc/cc/g" 37292.c

compiling 37292.c with /usr/bin/cc; got some error but it did our work.

just run the compiled version.

cc 37292.c -o expl

./expl

got the shell with root privileges.

ls -al

//568628e0d993b1973adc718237da6e93

looks like something there for us in /006-final/xvf7-flag/ — go for it.

so this is the end.

if you’re seeing this,

Thank u!