Grotesque 1

By Lawcky 05/03/24

Introduction

Grotesque: 1

Difficulty : Medium

Additionnal info :

Name: * Grotesque: 1.0.1*
Release date: 10 Mar 2021
Author: tasiyanci
Series: Grotesque

---

In this write-up

• nmap
• ffuf
• steganography (binwalk)
• md5sum & dd
• wordpress & wpscan
• RCE
• Keepass file

---

Scans

---

Write-UP

Information Gathering

Fuzz : found nothing

port 66 :

found a download link with a zip file

this is a image with potential steganography

Steganography

using binwalk

first attempt to decode :

second :

this seems to be an equivalent of assembly language??..

all that seems useless

---

The Project

in the project we find a lot of files inside the _vvmlist with a repeated content

lets see if theres anything uniq in these files

in the enormous output we find this

since its a wordpress we can easily find the login page :

WPscan

with apparantly an uppercase password

we now need a username and a uppercase password, wordpress allows user enumeration.

found a valid usernames using author’s name on the site :

now we need a password that seems to be uppercase.

i created a wordlist using cewl than put it all in uppercase using dd

lets try attacking :

did not work lets try rockyou using the uppercase command

the solution was to copy the lyrics of one of the songs in a file and then md5sum it WITH the newline, then uppercase it to get the password… and the only thing that pointed to that direction was a giga chad meme on the site… these chads are too much 😭

i love it

---

Reverse Shell

injecting the 404.php page the page is located at : http://IP/lyricsblog/wp-content/themes/twentytwentyone/404.php

---

Privilege Escalation

found a mysql server in

raphael:_double_trouble_ mysql -h localhost -u raphael -p -D wordpress_db

found this :

erdalkomurcu:$P$BXHQZLhAms.Eo0DzlZRBKbyezUPDqf1

could not break

the users pass on unix was the same as the db password

first flag found F6ACB21652E095630BB1BEBD1E587FE7

---

Keepass

found in the home directory of raphael

its a password manager file

we extract its hash using keepass2john

$keepass$*2*60000*0*d34ff0b3bbce285d4553b994d1377a942145c2066611eeec2b4de8359f92d18c*e1ae12738ee79dabedfaf7f387275bfb4afc77b6943d02c156eabfaac3c2e58b*638b2e50ed9f0e910f7a96dbeb990c6d*4779254b4e0535bbfa31cf2d31a8ef86033ddbc13be2a5b25e9b0b5983448681*d32ea132be90e65089bfb5c7b6fee69019ada50b62d2e11c6d77d92f2856ba1c

then crack it using hashcat

master password is chatter

root password

root:.:.subjective.:.

second flag found AF7DD472654CBBCF87D3D7F509CB9862