Mirrors/CTF-Writeups
2
0
Fork 0
mirror of https://github.com/AbdullahRizwan101/CTF-Writeups synced 2024-11-21 19:43:03 +00:00
Code Issues Projects Releases Packages Wiki Activity

Add files via upload

Browse source
This commit is contained in:
ARZ 2021-02-16 03:43:27 +05:00 committed by GitHub
parent 12abb89b4a
commit 24b187f460
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 192 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

192
TryHackMe/Goldeneye.md Normal file
View file

@ -0,0 +1,192 @@
# TryHackMe-GoldenEye
## NMAP
```
Nmap scan report for 10.10.81.165
Host is up (0.15s latency).
Not shown: 65531 closed ports
PORT STATE SERVICE VERSION
25/tcp open smtp Postfix smtpd
|_smtp-commands: ubuntu, PIPELINING, SIZE 10240000, VRFY, ETRN, STARTTLS, ENHANCEDSTATUSCODES, 8BITMIME, DSN,
80/tcp open http Apache httpd 2.4.7 ((Ubuntu))
|_http-server-header: Apache/2.4.7 (Ubuntu)
|_http-title: GoldenEye Primary Admin Server
55006/tcp open ssl/unknown
|_ssl-date: TLS randomness does not represent time
55007/tcp open pop3 Dovecot pop3d
|_pop3-capabilities: AUTH-RESP-CODE TOP CAPA PIPELINING USER UIDL RESP-CODES SASL(PLAIN) STLS
|_ssl-date: TLS randomness does not represent time
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 502.67 seconds
```
## PORT 80
<img src="https://imgur.com/9ZADdWL.png"/>
Looking at source code
<img src="https://imgur.com/ozjQtjy.png"/>
This is an encoded text on visting `cyberchef` and decoding it using `magic` we decoded the text
<img src="https://imgur.com/KLXO8MS.png"/>
`InvincibleHack3` is the password for `boris`
But these creds are not right
<img src="https://imgur.com/2jjeAvg.png"/>
So let's enumerate different ports
## PORT 55007 (POP3)
I tired to brute force with `boris` but failed
<img src="https://imgur.com/3tYu6IL.png"/>
Earlier from the source code of the web page we saw a message that "Natalya could break your code" so maybe that's a potential username that we need to brute force so again using hydra
<img src="https://imgur.com/gZxYV4u.png"/>
After some time I was able to get the correct password
<img src="https://imgur.com/W1GunwN.png"/>
Also got boris's password with the `fasttrack` wordlist
<img src="https://imgur.com/hBNWUV9.png"/>
<img src="https://imgur.com/wd4IMFy.png"/>
## Boris's Mail
Here we used telnet to connect to pop3 service and logged in with boris's credentials. We can see that there are 3 messages
### Message 1
<img src="https://imgur.com/tpXPrl8.png"/>
### Message 2
<img src="https://imgur.com/ODm8rMe.png"/>
### Message 3
<img src="https://imgur.com/dlI6fqR.png"/>
## Natalya's mail
We do the same with natalya's mail
### Message 1
<img src="https://imgur.com/LJd7WdT.png"/>
### Message 2
<img src="https://imgur.com/JGW87vt.png"/>
So we found the creds and a domain , lets add the domain in `/etc/hosts` file
<img src="https://imgur.com/BLQ37fT.png"/>
Navigate to `severnaya-station.com/gnocertdir` and login with xenia's credentials
<img src="https://imgur.com/UwfmUwn.png"/>
Going to user's messages we can find a conversation with a user `doak`
<img src="https://imgur.com/a9yNvRj.png"/>
We find doak's password with the same procedure
<img src="https://imgur.com/qv2NcOI.png"/>
## Doak's Mail
<img src="https://imgur.com/eBtTiRM.png"/>
### Message
<img src="https://imgur.com/7tVw1gU.png"/>
Login as dr_doak on the website
<img src="https://imgur.com/q3n6qpr.png"/>
<img src="https://imgur.com/raDYBrK.png"/>
This is the message we get from that text file
```
007,
I was able to capture this apps adm1n cr3ds through clear txt.
Text throughout most web apps within the GoldenEye servers are scanned, so I cannot add the cr3dentials here.
Something juicy is located here: /dir007key/for-007.jpg
Also as you may know, the RCP-90 is vastly superior to any other weapon and License to Kill is the only way to play.
```
<img src="https://imgur.com/e7Sk885.png"/>
Running `exiftool` on it we can find a base64 encoded text
<img src="https://imgur.com/JMPkHns.png"/>
<img src="https://imgur.com/u2ddmjV.png"/>
<img src="https://imgur.com/0wwRyhO.png"/>
Now we are logged in as admin. One thing we can do now is look for any exploits for `Moodle`
## Getting a reverse shell
<img src="https://imgur.com/rsMwc1D.png"/>
<img src="https://imgur.com/2s63CZJ.png"/>
<img src="https://imgur.com/h4t02OV.png"/>
For some reason the exploit wasn't working . I double checked everything but still it was failing
<img src="https://imgur.com/qRKdfU5.png"/>
So I went with the manual exploitation of moodle
<img src="https://imgur.com/ZxaYJnc.png"/>
Under settings go to plugins ->Text Editors -> TinyMCE HTML editor and make sure to select Spell Engine as `PSpellShell`
Then make a blog post entry and click on spell check icon , if you have setup your netcat listener you'll get a shell frorm the target machine
<img src="https://imgur.com/cprnqAb.png"/>
<img src="https://imgur.com/oARTDqh.png"/>
<img src="https://imgur.com/Y7RFLxK.png"/>
Looking for kernel version
<img src="https://imgur.com/ZKSNs9y.png"/>
This is a really old kernel for linux so hopeully there will be an exploit on `exploit-db`
<img src="https://imgur.com/KAblTn8.png"/>
Download ,compile and transfer it to target machine
<img src="https://imgur.com/Xgf57Nz.png"/>
But on running it gave an error because gcc was not installed on the machine
<img src="https://imgur.com/IhOZTLh.png"/>
On googling I found cc which is alternate to gcc and it was on the box
<img src="https://imgur.com/XcQbpka.png"/>
<img src="https://imgur.com/Vtw1Dx7.png"/>
So we had to edit the exploit by replacing `gcc` to `cc` and then again transfer the compiled source code to the box
<img src="https://imgur.com/dkF08W1.png"/>
We got root !!