From ace39fe854b02b97deb2d2df5e8c75b6d356cb08 Mon Sep 17 00:00:00 2001
From: AbdullahRizwan101 <60057481+AbdullahRizwan101@users.noreply.github.com>
Date: Thu, 28 Jan 2021 18:31:16 +0500
Subject: [PATCH] Add files via upload
---
TryHackMe/Cyborg.md | 114 ++++++++++++++++++++++++++++++++++++++++++++
1 file changed, 114 insertions(+)
create mode 100644 TryHackMe/Cyborg.md
diff --git a/TryHackMe/Cyborg.md b/TryHackMe/Cyborg.md
new file mode 100644
index 0000000..c4136ff
--- /dev/null
+++ b/TryHackMe/Cyborg.md
@@ -0,0 +1,114 @@
+# TryHackMe-Cyborg
+
+## NMAP
+
+```
+Starting Nmap 7.80 ( https://nmap.org ) at 2021-01-28 16:55 PKT
+Nmap scan report for 10.10.203.159
+Host is up (0.42s latency).
+Not shown: 998 closed ports
+PORT STATE SERVICE VERSION
+22/tcp open ssh OpenSSH 7.2p2 Ubuntu 4ubuntu2.10 (Ubuntu Linux; protocol 2.0)
+| ssh-hostkey:
+| 2048 db:b2:70:f3:07:ac:32:00:3f:81:b8:d0:3a:89:f3:65 (RSA)
+| 256 68:e6:85:2f:69:65:5b:e7:c6:31:2c:8e:41:67:d7:ba (ECDSA)
+|_ 256 56:2c:79:92:ca:23:c3:91:49:35:fa:dd:69:7c:ca:ab (ED25519)
+80/tcp open http Apache httpd 2.4.18 ((Ubuntu))
+|_http-server-header: Apache/2.4.18 (Ubuntu)
+|_http-title: Apache2 Ubuntu Default Page: It works
+Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
+
+Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
+Nmap done: 1 IP address (1 host up) scanned in 30.22 seconds
+```
+
+
+## Task 1
+
+Scan the machine, how many ports are open?
+
+`2`
+
+## Task 2
+
+What service is running on port 22?
+
+`SSH`
+
+## Task 3
+
+What service is running on port 80?
+
+`HTTP`
+
+## PORT 80 (HTTP)
+
+
+
+Running feroxbuster
+
+
+
+
+
+```
+music_archive:$apr1$BpZ.Q.1m$F0qqPwHSOG50URuOVQTTn.
+```
+
+Navigating to `/admin`
+
+
+
+We can download this tar archive on click the `archive` tab also visiting `admin` tab we can see some conversation which tells about squid proxy which we have already discoverd
+
+
+
+Extracting the tar contents
+
+
+
+
+
+This is all conmpressed and encrypted using `Borg`. Now in order to recover these encrypted files we need to have borg on our machine so let's download the binary from github
+
+
+
+
+
+It's asking for a passphrase ,so the hash we saw earlier let's try to crack it with `john`
+
+
+
+
+
+We got the `music_archive` which was in the conversation so now let's mount it on a folder using the passphrase
+
+
+
+
+
+
+
+It wasn't really a secret!
+
+
+
+And this might be the creds for SSH
+
+
+
+Here in this script `getops` is intersting which will lead us to privilege escalation
+
+
+
+In the while loop `c:` is the argument for getops also there is a swtich case for `c` which is the command so if we specify a bash command specify -c in the script it will get excecuted as root.
+
+
+
+
+
+We can get root if we specify `bash` after -c but we will run into a problem that we cannot see the output of the commands we are typing so to get a proper root shell we can SUID /bin/bash and can spawn a root shell with it
+
+
+
+
\ No newline at end of file