Deathnote (vulnhub machine )

Hi people, I hope you are doing well. Today we are trying to solve a Vulnhub.com machine called Deathnote.

Summary

Level — easy

Description : don’t waste too much time thinking outside the box . It is a Straight forward box .

This works better with VirtualBox rather than VMware

More about Deathnote

Download link :- Here

Recon part

First we have to find our machine’s ip address for this we can use two tools netdiscover and nmap

netdiscover 

nmap -Pn 192.168.1.1/24

In my case i used netdiscover and found an ip address 192.168.1.2

first one 192.168.1.2

After Nmap scan i found two open ports.

nmap -pn 192.168.1.2

22 ssh  Secure Shell
80 http  Hypertext Transfer Protocol

After opening ip in the browser, I didn’t find any. Then I used Dirb to find something.

dirb http://192.168.1.2

Dirb

Then i found three endpoints .

http://192.168.1.2/robots.txt
http://192.168.1.2/wordpress/index.php  --> http://192.168.1.2/wordpress/
http://192.168.1.2/wordpress/wp-content/uploads

robot.txt

wp-content

Hint

It is showing us Hint ! .Let’s open it

             Hint

Find notes.txt file on server
        see the L comment 

Let’s focus on hints.

As we know, we have to find notes.txt.

As we know, our website is on Wordpress, and we have an endpoint at http://192.168.1.2/wordpress/wp-content/uploads. Then try to find something.

After some time, I found directory listing on our endpoint.

http://192.168.1.2/wordpress/wp-content/uploads/2021/07/

Let’s open it.

After opening it, we found some directory in which there were two txt files, and we found our notes.txt.

let’s open both of them .

notes.txt

user.txt

look like a username and password file. but we don’t know which one is used for the password and which one is used for the username?

Get Milanjain’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

Now take a step back. We also have a robot.txt file. Let’s take a look at it

robot.txt

fuck it my dad 
added hint on /important.jpg

ryuk please delete it

something is in important.jpg .open it

curl http://192.168.1.2/important.jpg

It is showing that we can use user.txt for username, and we know that our ssh (22) is open. Let’s try to find a username and password form that

I used a Hydra tool.

hydra -L user.txt -P notes.txt ssh://192.168.1.2 

cool we found credentials

username :- l
password :- death4me

Let’s try to connect with ssh

ssh login done

As we know, on hint, we have to see L, and I found L in /opt/L.

and I found fake-notebook rules . Let’s see this

in these two files

case.wav :- look like hash code
hint :- tool to decrypt hash

I used CyberChef to decrypt this; it looks like hex code.

After decrypting it, we found the password of Kira.

passwd:kiraisevil

Now try to connect with kira

su kira 
pasword kiraisevil

In this, we found kira.txt. In this, there is a hash again. Try to decrypt it with the same method.

after decode it is saying something

please protect one of the following 
1. L (/opt)
2. Misa (/var)

Now we have to looking for misa which is in /var .

It is tooo late for misa

It is too late for Misa. Now try to get the root flag.

Then I checked permission for Kira, and Kira has all permission.

Here is a root directory

sudo su for root access 

Now we are able to see /root content

which is root.txt open it

cat root.txt

and we are to slove machine

Thanks for reading .