Mirrors/CTF-Writeups
2
0
Fork 0
mirror of https://github.com/AbdullahRizwan101/CTF-Writeups synced 2024-11-24 21:03:07 +00:00
Code Issues Projects Releases Packages Wiki Activity

Add files via upload

Browse source
This commit is contained in:
AbdullahRizwan101 2021-01-12 11:06:28 +05:00 committed by GitHub
parent efd3930fd3
commit 1090a499f7
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 73 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

73
HackMyVM/Twisted.md Normal file
View file

@ -0,0 +1,73 @@
# HackMyVM-Twisted
## NMAP
```
Starting Nmap 7.80 ( https://nmap.org ) at 2021-01-12 09:38 PKT
Nmap scan report for 192.168.1.66
Host is up (0.00018s latency).
Not shown: 998 closed ports
PORT STATE SERVICE VERSION
80/tcp open http nginx 1.14.2
|_http-server-header: nginx/1.14.2
|_http-title: Site doesn't have a title (text/html).
2222/tcp open ssh OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)
| ssh-hostkey:
| 2048 67:63:a0:c9:8b:7a:f3:42:ac:49:ab:a6:a7:3f:fc:ee (RSA)
| 256 8c:ce:87:47:f8:b8:1a:1a:78:e5:b7:ce:74:d7:f5:db (ECDSA)
|_ 256 92:94:66:0b:92:d3:cf:7e:ff:e8:bf:3c:7b:41:b7:5a (ED25519)
MAC Address: 08:00:27:72:46:36 (Oracle VirtualBox virtual NIC)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 7.92 seconds
```
## PORT 80
On the web page we see two images and one hinting being different so this means there is some stegnography invloved
<img src="https://imgur.com/RS8GTLK.png"/>
I ran`stegcracker` on both the images and found two messages
<img src="https://imgur.com/1ZY3C8U.png"/>
<img src="https://imgur.com/RtHfpUI.png"/>
<img src="https://imgur.com/p1nQnLf.png"/>
In `markus` directory we see a note which tells about bonita's ssh private key.
<img src="https://imgur.com/M4nBZHD.png"/>
Going to web directory we find a `gogo.wav` file so let's download it to our machine and analyze it !
<img src="https://imgur.com/eOwvhRd.png"/>
I uploaded this file as it was a morse code so analyzed it through online morese code analyzer and it was a rabbithole
<img src="https://imgur.com/yfMduF9.png"/>
So only option left for me was to run linpeas.
<img src="https://imgur.com/B5eLeWd.png"/>
I found that there was a capaiblity set on `tail` which is like a SUID.So id_rsa that we found for `bonita` we cannot read it but we can read it through tail command. Tail will print the last ten lines of a file so we need to specify to print last 30 or 40 lines so we can get the whole id_rsa key
<img src="https://imgur.com/5Plzg1R.png"/>
<img src="https://imgur.com/URtaWMW.png"/>
There is a SUID binary but when running it says WRONG CODE so let's transfer it to our machine and analyze the binary
<img src="https://imgur.com/tw9Gtn7.png"/>
So using ghidra I saw that it is comparing variable with a hex value 0x16f8
<img src="https://imgur.com/3mGEucD.png"/>
Convert the hex value to decimal value
<img src="https://imgur.com/5r857Zi.png"/>
<img src="https://imgur.com/aaqDZOO.png"/>