Mirrors/CTF-Writeups
2
0
Fork 0
mirror of https://github.com/AbdullahRizwan101/CTF-Writeups synced 2024-11-21 19:43:03 +00:00
Code Issues Projects Releases Packages Wiki Activity

Add files via upload

Browse source
This commit is contained in:
ARZ 2021-02-13 01:16:33 +05:00 committed by GitHub
parent 28c76d812a
commit c5fcf8cdf8
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 132 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

132
TryHackMe/MrRobot.md Normal file
View file

@ -0,0 +1,132 @@
# TryHackMe-MrRobotCTF
## NMAP
```
Nmap scan report for 10.10.200.232
Host is up (0.23s latency).
Not shown: 997 filtered ports
PORT STATE SERVICE VERSION
22/tcp closed ssh
80/tcp open http Apache httpd
|_http-server-header: Apache
|_http-title: Site doesn't have a title (text/html).
443/tcp open ssl/http Apache httpd
|_http-server-header: Apache
|_http-title: 400 Bad Request
| ssl-cert: Subject: commonName=www.example.com
| Not valid before: 2015-09-16T10:45:03
|_Not valid after: 2025-09-13T10:45:03
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 60.16 seconds
```
## PORT 80
<img src="https://imgur.com/hyURjVb.png"/>
Looking at `robots.txt` which is just a basic enumeration looking for these files
<img src="https://imgur.com/vew4kd4.png"/>
We have two files here `fscoiety.dic` which looks like a wordlist and `key-1-of-3.txt` which has the first flag
## Gobuster
```
/images (Status: 301)
/index.php (Status: 301)
/blog (Status: 301)
/rss (Status: 301)
/sitemap (Status: 200)
/login (Status: 302)
/0 (Status: 301)
/feed (Status: 301)
/video (Status: 301)
/image (Status: 301)
/atom (Status: 301)
/wp-content (Status: 301)
/admin (Status: 301)
/audio (Status: 301)
/intro (Status: 200)
/wp-login (Status: 200)
/wp-login.php (Status: 200)
/css (Status: 301)
/rss2 (Status: 301)
/license (Status: 200)
/wp-includes (Status: 301)
```
This was the list of directories I was able to find but only `wp-login` was of our interest rest of them were giving forbidden access messages
<img src="https://imgur.com/z7LIZg8.png"/>
So we need to know the usernames , there isn't any username on the blog so we might have to do trial and error to guess it but we have `fsociety.dic` that might be useful for usernames so let's intercept the login request to get paramters and then start bruteforcing it with `hydra` But it's going to take a lot of time bruteforcing against a list of usernames so as this box has theme of mr robot and the main character of that series is `elliot`
<img src="https://imgur.com/cBCNGKJ.png"/>
<img src="https://imgur.com/zx9T3MZ.png"/>
So this username is correct all we need to do is bruteforce against the words in fsociety.dic but picking the first word which is `true` it has 150 matches so it has a number of words repeated in it so we need to remove repeated words (I checked this through sublime's regex mode)
<img src="https://imgur.com/olul95x.png"/>
<img src='https://imgur.com/ku52oGe.png'/>
You see the difference in the repeated words
<img src="https://imgur.com/jlNXkrs.png"/>
Perfect now let's continue with intercepting the request and bruteforcing it against hydra
<img src="https://imgur.com/vWeNu1I.png"/>
But hydra was taking longer than usual so I moved to wspcan to bruteforce elliot's password
<img src="https://imgur.com/rdhp1YF.png"/>
<img src="https://imgur.com/kf1TBLt.png"/>
<img src="https://imgur.com/FJUJAXn.png"/>
Now go to `Appearance -> Editor` Then select the Twenty Fifteen theme and paste the php reverse-shell from pentest monkey (GitHub one)
<img src="https://imgur.com/s9giwgO.png"/>
Click on the update button
<img src="https://imgur.com/QykCq2q.png"/>
<img src="https://imgur.com/6o9Bq4Q.png"/>
Stablize the shell
<img src="https://imgur.com/wzag057.png"/>
<img src="https://imgur.com/Jvz28mz.png"/>
In the home directory of `robot` we can see a md5 hash that we need to crack inorder to switch user
<img src="https://imgur.com/GcRkbcB.png"/>
<img src="https://imgur.com/7fxygco.png"/>
We can see a cronjob running on the system
<img src="https://imgur.com/8ysoOSg.png"/>
Looking for SUID we find nmap having SUID bit
<img src="https://imgur.com/ggHhRnm.png"/>
Going to GTFOBINS
<img src="https://imgur.com/PZHOO4e.png"/>
<img src="https://imgur.com/34y1odH.png"/>