From 561f4b91c15fe2254fdd837a71d95d615df4e5e0 Mon Sep 17 00:00:00 2001
From: ARZ <60057481+AbdullahRizwan101@users.noreply.github.com>
Date: Thu, 14 Jul 2022 15:01:16 +0500
Subject: [PATCH] Update TomGhost.md
---
TryHackMe/TomGhost.md | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
diff --git a/TryHackMe/TomGhost.md b/TryHackMe/TomGhost.md
index 28fb7d9..cce1e10 100644
--- a/TryHackMe/TomGhost.md
+++ b/TryHackMe/TomGhost.md
@@ -57,7 +57,7 @@ by OJ Reeves (@TheColonial) & Christian Mehlmauer (@_FireFart_)
When we visit `/manger` we are not prompt with login.
-https://imgur.com/fQZgbPW.png
+
Now we can look for port `8009` and there is an exploit for it `https://github.com/00theway/Ghostcat-CNVD-2020-10487.git`
@@ -67,21 +67,21 @@ Run the exploit
python3 ajpShooter.py http://10.10.109.92:8080 8009 /WEB-INF/web.xml read
```
-https://imgur.com/iVdmiAn.png
+
You will find credential `skyfuck`:`8730281lkjlkjdqlksalks`
-https://imgur.com/g1atsoj.png
+
Going to `merlin`'s folder we can find `THM{GhostCat_1s_so_cr4sy}`
we can see two files `credentials.pgp` and `tryhackme.asc` so we are going to use `gpg2john` to find hash of `tryhackme.asc`
-https://imgur.com/dwB310K.png
+
-https://imgur.com/nj8nfcL.png
+
```
alexandru (tryhackme)
@@ -172,4 +172,4 @@ root
```
We are now root.
-`THM{Z1P_1S_FAKE}`.
\ No newline at end of file
+`THM{Z1P_1S_FAKE}`.