Creative TryHackMe Writeup

This is a Easy level machine, you can find it here.

Hey guys, myself prash0xd, codewithprash on tryhackme.

As the name suggests, we need to be creative, not much but a little, to get a foothold into the machine.

Click ‘Start Machine’ to initiate the boot2root machine. The victim IP assigned to me is 10.10.190.23.

USER FLAG:

I proceeded to run RustScan to enumerate the open ports and services.

The result shows that there are two open ports: 22 for SSH and 80 for HTTP.

Visiting port 80 hints at adding ‘creative.thm’ to my /etc/hosts file.

As mentioned, I added it to my /etc/hosts file. After visiting port 80, I’m greeted with a visually appealing webpage, but none of the functionalities seem interesting for a hacker. The contact form caught my attention for stealing admin cookies using XSS, but no admin was checking the information filled in our contact form on the backend.

I ran dirsearch to find hidden directories, but it wasn’t very fruitful.

Now, with experience in solving labs, I proceeded to scan for virtual hosts on creative.thm using FFUF.

Luckily, I found one sub-domain and added it to /etc/hosts.

Visiting the sub-domain, I’m greeted with the URL Tester Web Form, which checks whether a given URL is active or dead. If active, it also fetches the content of the page URL endpoint serving.

The victim machine wasn’t connected to the internet, but it was able to fetch content from my Python web server, and it was also able to fetch content from localhost (127.0.0.1).

Result of http://127.0.0.1/

I tried changing ports but was not able to find the active one on localhost.

Get Prashant aka v0idsharma’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

It’s brute force time! Let’s grab the top most used ports listed here. Format it and create a wordlist of the top 50 ports.(Hint: You can use chatgpt or gemini)

Using Burp Intruder , I found one active port serving the content of user home directory :)

From here I was able to read all the files(user.txt) present in user home directory.

user.txt

Next copy the content of user ssh private key.

ssh private key

Save it to a file on the local machine. Next, generate the hash of the private key to make it understandable by John.

Now, run JohnTheRipper on the id_hash file to crack the password for the private key.

Change the permission of the private RSA key to 600 before logging into the machine.

Now logging into the victim machine.

Here we can read the bash history file, found something interesting, yeah user’s password.

ROOT FLAG:

Next, executing “sudo -l” and using above found password revealed interesting.

You can’t directly escalate privileges by running “sudo” on “/usr/bin/ping”, but you can use “env_keep += LD_PRELOAD” configuration to escalate . You can read this article to learn how to escalate privileges using this configuration.

“Signing off for now! Happy Hacking, and until next time!”