First let's start to discovering infos about the host using Nmap. Here we choose to search for all the opened ports and its services, with the -p- and -sV arguments, and an agressive scan with -A, all with the verbosity spitting with -vv, all with a SYN Scan -sS (note : some non-useful infos has been removed from the output) :
Interesting stuffs here, we have services running on common ports
FTP (21) on vsFTPD 3.0.3 :
SSH (22) on OpenSSH 8.2p1 Ubuntu 4ubuntu0.5 along with the public keys of the server
HTTP Server (80, 8080) on Apache 2.4.41
We can see that nmap found a file called "file.txt" on the server. This has been possible by trying to connect to it using Anonymous. Assuming that the FTP server accept Anonymous connection, let's try to get the file on it ! :
# ftp Anonymous@10.10.113.169
Connected to 10.10.113.169.
220 (vsFTPd 3.0.3)
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> ls
229 Entering Extended Passive Mode (|||8712|)
150 Here comes the directory listing.
-rw-r--r-- 1 65534 65534 25 Nov 27 11:41 file.txt
226 Directory send OK.
ftp> get file.txt
local: file.txt remote: file.txt
229 Entering Extended Passive Mode (|||26615|)
150 Opening BINARY mode data connection for file.txt (25 bytes).
100% |***********************************| 25 8.08 KiB/s 00:00 ETA
226 Transfer complete.
25 bytes received in 00:00 (0.62 KiB/s)
ftp> exit
221 Goodbye.
┌──(root💀el-huervo)-[~/others_stuff/thm/5up3r_53cur3]
└─# cat file.txt
Naaaah ! Not that fast !
....Would have been to easy. Let's try to go on the web page despite it :D :
When we see it, it obviously looks like a base64 string. If we aren't sure, we can still pass it to CyberChef , the swiss army knife for encoded strings, URIs, zip... Absolute needed for CTFs. We can use the "magic" option to optain instant recognition of the string got if we still aren't sure of what type of string it is. Let's try the first one :
That's some good trolling. And what about the second ? :
Here we got it ! Another subdirectory called 5up3r_c4ch3, let's paste it and search for it !
Uh, nice... White page. Let's be serious for a minute, if we look into the source code :
We're on a good path ;) Let's feed this to cyberchef one more time :
2 - Getting an access :
jeannoobie@sup3r-s3cur3:~$ history
1 su - root
2 su - root
3 ls -la
4 echo 'set +o history' > .bashrc
5 ls -la
6 bash
jeannoobie@sup3r-s3cur3:~$
Holy noobo :D
To remeditate this, just do the opposite of the "echo" and redirect it to your .bashrc ;) Don't forget to do "source .bashrc" to reload the modifications :
jeannoobie@sup3r-s3cur3:~$ echo 'set -o history' > .bashrc
jeannoobie@sup3r-s3cur3:~$ source .bashrc
jeannoobie@sup3r-s3cur3:~$ echo "Now we're good"
Now we're good
jeannoobie@sup3r-s3cur3:~$ history
1 su - root
2 su - root
3 ls -la
4 echo 'set +o history' > .bashrc
5 ls -la
6 bash
7 su - root
8 su - root
9 ls -la
10 echo 'set +o history' > .bashrc
11 ls -la
12 bash
13 echo "Now we're good"
14 history
jeannoobie@sup3r-s3cur3:~$
3 - Getting the first flag :
Now let's check for some files. I've put an alias to avoid typing "ls -l" all the time (and no, I'm not lazy) :
jeannoobie@sup3r-s3cur3:~$ alias 'll=ls -l'
jeannoobie@sup3r-s3cur3:~$ ll
total 8
-rw-rw-r-- 1 jeannoobie jeannoobie 65 Nov 27 14:08 RouteToRoot.txt
-rw-rw-r-- 1 jeannoobie jeannoobie 20 Nov 27 13:26 user.txt
jeannoobie@sup3r-s3cur3:~$ cat user.txt
n***{*************}
jeannoobie@sup3r-s3cur3:~$
And we got the flag, hidden here but it start with the "n" character ;)
3 - Becoming r00t :
Now that we have our first user flag, we may want to acquire the super-root powers, right ? Let's start it by checking the other interesting file, "RouteToRoot.txt" :
jeannoobie@sup3r-s3cur3:~$ ll
total 8
-rw-rw-r-- 1 jeannoobie jeannoobie 65 Nov 27 14:08 RouteToRoot.txt
-rw-rw-r-- 1 jeannoobie jeannoobie 20 Nov 27 13:26 user.txt
jeannoobie@sup3r-s3cur3:~$ cat RouteToRoot.txt
Cherche les GET requests et tu trouveras le flag, jeune Padawan.
jeannoobie@sup3r-s3cur3:~$
"Search for the GET requests and you will find the flag, young Padawan"
"GET Requests", sounds like some networking stuffs for us right ?
Maybe we can take a look at the requests on the web server, using our favorite network-sword Wireshark :
Nothing on the page where we found the SSH creditentials. Maybe in the robots.txt page ?
jeannoobie@sup3r-s3cur3:/var/log/apache2$ ll
total 150348
-rw-r----- 1 root adm 10799 Dec 17 17:37 access.log
-rw-r----- 1 root adm 153906428 Nov 27 16:57 access.log.1
-rw-r----- 1 root adm 688 Dec 17 16:35 error.log
-rw-r----- 1 root adm 11042 Nov 28 00:36 error.log.1
-rw-r----- 1 root adm 14364 Dec 17 17:58 other_vhosts_access.log
-rw-r--r-- 1 root adm 1540 Nov 28 00:36 other_vhosts_access.log.1
jeannoobie@sup3r-s3cur3:/var/log/apache2$ cat error.log.1
[Sun Nov 27 14:01:44.236975 2022] [core:error] [pid 2184:tid 140150269007616] [client 192.168.30.157:32776] AH00126: Invalid URI in request GET /../../../../../../../../../../../../etc/shadow HTTP/1.1
[...]
[Sun Nov 27 14:01:45.939389 2022] [core:error] [pid 2183:tid 140150260614912] [client 192.168.30.157:34034] AH00126: Invalid URI in request GET /../../../../../../../../../boot.ini HTTP/1.1
[Sun Nov 27 14:01:45.942934 2022] [core:error] [pid 2184:tid 140150578464512] [client 192.168.30.157:34188] AH00126: Invalid URI in request GET /../../../../winnt/repair/sam._ HTTP/1.1
[Sun Nov 27 14:01:45.963024 2022] [core:error] [pid 2184:tid 140150419977984] [client 192.168.30.157:34190] AH00126: Invalid URI in request GET ////./../.../boot.ini HTTP/1.1
[Sun Nov 27 14:01:46.028399 2022] [core:error] [pid 2183:tid 140150419977984] [client 192.168.30.157:34198] AH00126: Invalid URI in request GET /DomainFiles/*//../../../../../../../../../../etc/passwd HTTP/1.1
[Sun Nov 27 14:01:46.181120 2022] [core:error] [pid 2183:tid 140150461941504] [client 192.168.30.157:34260] AH00126: Invalid URI in request GET /../../../../../../../../../../etc/passwd HTTP/1.1
[Sun Nov 27 14:01:46.201075 2022] [core:error] [pid 2184:tid 140150478726912] [client 192.168.30.157:34426] AH00126: Invalid URI in request GET /%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/windows/win.ini HTTP/1.1
[Sun Nov 27 14:01:46.203644 2022] [core:error] [pid 2184:tid 140150378014464] [client 192.168.30.157:34428] AH00126: Invalid URI in request GET /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd HTTP/1.1
[Sun Nov 27 14:01:47.856118 2022] [core:error] [pid 2183:tid 140150478726912] [client 192.168.30.157:35614] AH00126: Invalid URI in request GET /file/../../../../../../../../etc/ HTTP/1.1
[client 192.168.30.157:44452] AH01630: client denied by server configuration: /var/www/html/.htpasswd
[Sun Nov 27 14:01:51.771853 2022] [authz_core:error] [pid 2183:tid 140150436763392] [client 192.168.30.157:44452] AH01630: client denied by server configuration: /var/www/html/.htaccess
[Sun Nov 27 14:01:51.818572 2022] [core:error] [pid 2183:tid 140150386407168] [client 192.168.30.157:44452] AH00126: Invalid URI in request GET ////../../data/config/microsrv.cfg HTTP/1.1
[Sun Nov 27 14:01:51.821260 2022] [core:error] [pid 2184:tid 140150394799872] [client 192.168.30.157:44790] AH00126: Invalid URI in request GET ////////../../../../../../etc/passwd HTTP/1.1
[Sun Nov 27 14:01:52.361710 2022] [negotiation:error] [pid 2184:tid 140150586857216] (2)No such file or directory: [client 192.168.30.157:45054] AH00683: cannot access type map file: /var/www/html/index.html.var
[Sun Nov 27 14:02:04.271525 2022] [core:error] [pid 2183:tid 140150411585280] [client 192.168.30.157:43340] AH00126: Invalid URI in request GET /sdk/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/etc/vmware/hostd/vmInventory.xml HTTP/1.1
[Sun Nov 27 14:02:04.906543 2022] [core:error] [pid 2183:tid 140150461941504] [client 192.168.30.157:43864] AH00126: Invalid URI in request GET /../../windows/dvr2.ini HTTP/1.1
[Sun Nov 27 14:02:04.911716 2022] [core:error] [pid 2184:tid 140150445156096] [client 192.168.30.157:44106] AH00126: Invalid URI in request GET /htdocs/../../../../../../../../../../../etc/passwd HTTP/1.1
[Sun Nov 27 14:02:04.953817 2022] [core:error] [pid 2184:tid 140150428370688] [client 192.168.30.157:44112] AH00126: Invalid URI in request GET /help/../../../../../../../../../../../../../../../../etc/shadow HTTP/1.1
[Sun Nov 27 14:02:33.491800 2022] [core:error] [pid 2183:tid 140150260614912] [client 192.168.30.157:45000] AH00135: Invalid method in request QIOT / HTTP/1.1
[Sun Nov 27 14:26:42.138572 2022] [mpm_event:notice] [pid 2182:tid 140150597483584] AH00491: caught SIGTERM, shutting down
[...]
Looks like there are some juicy informations here ! Someone tried to access to important ressources, like trying the "/../../../../../../etc/shadow" famous way to access hashed passwords stored on Unix OSs, or even the bootfile boot.ini, a text file that contains the boot options for computers with BIOS firmware running NT-based operating system prior to Windows Vista ! That's funny somehow :D
But, trying these path on the web page doesn't work, we're still stuck :/
No base64 or encoded string in the file. Maybe if we take a look at the other_vhosts_access.log file ?
Without waiting no more, let's feed it to CyberChef !
Yup, that looks nasty guys, let's get it over with ! :
jeannoobie@sup3r-s3cur3:/var/log/apache2$ su - root
Password: #Type the password obtained here ;)
root@sup3r-s3cur3:~#
root@sup3r-s3cur3:~# ll
ll: command not found
root@sup3r-s3cur3:~# ls -l
total 12
-r-x------ 1 root root 131 Nov 27 17:12 rabbitHole.sh
-rw-r--r-- 1 root root 31 Nov 27 17:18 root.txt
drwx------ 4 root root 4096 Nov 27 11:42 snap
root@sup3r-s3cur3:~# cat root.txt
n***{*********************}
root@sup3r-s3cur3:~#
Conclusion :
That was an easy and funny box to complete, thanks to @Noobosaurus_r3x for making and publishing it on THM ;) You can joing his Discord server, it's a real gold-mine (only in French of course :D) :
