Bounty Hacker & Agent Sudo
Find open ports on the machine
Who wrote the task list?
login to the FTP server as anonymous:
Here I wanted to view the files in the current directory, but it was not able to do it, to solve this issue, enter: passive
Get the two files:
On your local machine:
Lin
What service can you bruteforce with the text file found?
ssh
What is the users password?
We will use Hydra to brute-force Lin’s password
Syntax:
hydra -l [username] -P [password list] [target IP addr] [service]hydra -l lin -P locks.txt 10.10.207.169 ssh
RedDr4gonSynd1cat3
user.txt
Ssh to the target machine with the credentials we just got:
THM{CR1M3_SyNd1C4T3}
root.txt
View the sudo list, we have the tar command as the root user privilege:
We can find privilege escalation method on GTFobins:
https://gtfobins.github.io/gtfobins/tar/
enter the above command provided in GTFObins for allowing a normal user to run as a root user:
find and print the flag:
THM{80UN7Y_h4cK3r}
Agent Sudo
Task 2 Enumerate
How many open ports?
nmap -T4 -sV -v 10.10.113.54
3
How you redirect yourself to a secret page?
user-agent
What is the agent name?
Intercept the traffic visiting the website and change the user-agent to C:
Chris
Task 3 Hash cracking and brute-force
FTP password
Hydra can brute-force the FTP server with rockyou.txt wordlist:
hydra -l chris -P /usr/share/wordlists/seclists/Passwords/Common-Credentials/best110.txt [Your target machine ip add] ftp
crystal
Zip file password
Get YCZHU’s stories in your inbox
Join Medium for free to get updates from this writer.
login to the FTP server as chris and get all files:
mget *.*
view the txt file, we get the hints:
Analyse two image files by binwalk:
the .jpg is empty, however we got some information from .png, now we can extract the binaries in .png:
binwalk -e cutie.png
The 8702.zip is encrypted:
Use zip2john to crack the zip file:
Use john to crack the hash:
alien
steg password
From this output we are revealed that the content was saved to the To_agentR.txt:
The code ‘QXJlYTUx’ looks interesting we can try to decode it:
Area51
Who is the other agent (in full name)?
Now we have the password for the file cute-alien.jpg:
james
SSH password
hackerrules!
Task 4 Capture the user flag
What is the user flag?
ssh to the james account :
What is the incident of the photo called?
Send the jpg to the local machine:
search for the image on google:
Task 5 Privilege escalation
CVE number for the escalation
Display sudo version information:
sudo -V
Search for some information about the sudo 1.8.21 version:
The highlighted price of info is what we are looking for, download the code:
CVE-2019–14287
What is the root flag?
transport the python code form the local machine to james account:
execute the code:
Now we are the root user, print the flag:
b53a02f55b57d4439e3341834d70c062
(Bonus) Who is Agent R?
DesKel
