Mirrors/CTF-Writeups
2
0
Fork 0
mirror of https://github.com/AbdullahRizwan101/CTF-Writeups synced 2024-11-24 21:03:07 +00:00
Code Issues Projects Releases Packages Wiki Activity

Delete Super-Spam.md

Browse source
This commit is contained in:
ARZ 2021-08-03 02:25:42 +05:00 committed by GitHub
parent 3f5d8c7de0
commit 400b74a7b0
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 0 additions and 123 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

123
Super-Spam.md
View file

@ -1,123 +0,0 @@
# TryHackMe- Super-Spam
First of all let's check for open ports on the machine so I will be running rustscan
## Rustscan
<img src="https://imgur.com/BzKBX8m.png"/>
It showed us 3 ports , port 80 is for HTTP but we don't know about the other two so let's wait for the scan to complete
<img src="https://imgur.com/TLiQYED.png"/>
It showed us that port 4012 is `SSH` and port 4019 is `FTP` so let's start enumerating FTP first
### PORT 4019 (FTP)
<img src="https://imgur.com/99nzC8I.png"/>
We can a `.cap` folder , `IDS_logs` and a `note.txt` reading that note
```
12th January: Note to self. Our IDS seems to be experiencing high volumes of unusual activity.
We need to contact our security consultants as soon as possible. I fear something bad is going
to happen. -adam
13th January: We've included the wireshark files to log all of the unusual activity. It keeps
occuring during midnight. I am not sure why.. This is very odd... -adam
15th January: I could swear I created a new blog just yesterday. For some reason it is gone... -adam
24th January: Of course it is... - super-spam :)
```
It seems the blog has been hacker by someone , let's just dive into `.cap` as it was meant to be hidden
<img src="https://imgur.com/pg3OnLb.png"/>
This folder contain a lot of .cap files and a hidden note as well which says
```
It worked... My evil plan is going smoothly.
I will place this .cap file here as a souvenir to remind me of how I got in...
Soon! Very soon!
My Evil plan of a linux-free galaxy will be complete.
Long live Windows, the superior operating system!
```
So this is refering to how he got in so it must be important to see what .cap file is and why it is important to him , google says that
```
the CAP file extension is most likely a Packet Capture file created by packet sniffing programs
```
Now looking at the name `SamsNetwork` this maybe a capture file related to WIFI also opening the file with wireshark it includes a TP-Link router
<img src="https://imgur.com/d10G7eB.png"/>
So this confirms that this is a file containing WIFI handshake. We can crack the password of the wifi with `aircrack-ng` or by converting this file to hashcat's format of cracking WPA2 passwords
<img src="https://imgur.com/k9a0Nax.png"/>
<img src="https://imgur.com/erIoEUy.png"/>
And we got a password `sandiago` so now let's visit the web page
## PORT (80)
We can find the web flag in `robots.txt`
<img src="https://imgur.com/70zQ5TN.png"/>
<img src="https://imgur.com/XVGdm6q.png"/>
I tried logging in with `Adam_Admin` but it failed so let's try logging in with other users with that password we cracked
<img src="https://imgur.com/5GyNbmr.png"/>
I found this username and try to login
<img src="https://imgur.com/4qSRxFL.png"/>
We logged in and looks like we are admin on this blog
<img src="https://imgur.com/nPy7Nk2.png"/>
We can go to `Reports` tab and can see that this is an outdated version of druapl cms so it might have some vulnerabilites
<img src="https://imgur.com/0ktsP7p.png"/>
Found RCE exploit for drupal_cms so let's test to see if it works
<img src="https://imgur.com/jiSVZ7y.png"/>
<img src="https://imgur.com/38vtxDo.png"/>
<img src="https://imgur.com/awWUqKI.png"/>
<img src="https://imgur.com/BcSAZ24.png"/>
<img src="https://imgur.com/loaD5Rb.png"/>
Now if we visit `http://ip/modules/drupal_rce/shell.php?cmd=id;`
<img src="https://imgur.com/eNxUYeQ.png"/>
We can do remote code execution so let's just catch a reverse shell
<img src="https://imgur.com/UDBfFL1.png"/>
If we check what permissions `www-data` has
<img src="https://imgur.com/huW4QP5.png"/>
It can run symlink binary as root so we can exploit this by making a file having bash command in it then making a symlink with `ln` binary and run it as sudo so it will execute `bash`
<img src="https://imgur.com/gUnFpO8.png"/>