🇬🇧[EN] 5up3r_53cur3

WriteUp of the Box 5up3r_53cur3, created by @Noobosaurus_R3x :

Link :

LogoTryHackMe | Cyber Security TrainingTryHackMe

1 - Recognition

First let's start to discovering infos about the host using Nmap. Here we choose to search for all the opened ports and its services, with the -p- and -sV arguments, and an agressive scan with -A, all with the verbosity spitting with -vv, all with a SYN Scan -sS (note : some non-useful infos has been removed from the output) :

Interesting stuffs here, we have services running on common ports

  • FTP (21) on vsFTPD 3.0.3 :

  • SSH (22) on OpenSSH 8.2p1 Ubuntu 4ubuntu0.5 along with the public keys of the server

  • HTTP Server (80, 8080) on Apache 2.4.41

We can see that nmap found a file called "file.txt" on the server. This has been possible by trying to connect to it using Anonymous. Assuming that the FTP server accept Anonymous connection, let's try to get the file on it ! :

....Would have been to easy. Let's try to go on the web page despite it :D :

Here we can give it a new shot :

Still got nothing. But, if we look closely into the robots.txt file, we can see an interesting string... :

When we see it, it obviously looks like a base64 string. If we aren't sure, we can still pass it to CyberChef , the swiss army knife for encoded strings, URIs, zip... Absolute needed for CTFs. We can use the "magic" option to optain instant recognition of the string got if we still aren't sure of what type of string it is. Let's try the first one :

That's some good trolling. And what about the second ? :

Here we got it ! Another subdirectory called 5up3r_c4ch3, let's paste it and search for it !

Uh, nice... White page. Let's be serious for a minute, if we look into the source code :

We're on a good path ;) Let's feed this to cyberchef one more time :

2 - Getting an access :

Holy noobo :D

To remeditate this, just do the opposite of the "echo" and redirect it to your .bashrc ;) Don't forget to do "source .bashrc" to reload the modifications :

3 - Getting the first flag :

Now let's check for some files. I've put an alias to avoid typing "ls -l" all the time (and no, I'm not lazy) :

And we got the flag, hidden here but it start with the "n" character ;)

3 - Becoming r00t :

Now that we have our first user flag, we may want to acquire the super-root powers, right ? Let's start it by checking the other interesting file, "RouteToRoot.txt" :

"Search for the GET requests and you will find the flag, young Padawan"

"GET Requests", sounds like some networking stuffs for us right ?

Maybe we can take a look at the requests on the web server, using our favorite network-sword Wireshark :

Nothing on the page where we found the SSH creditentials. Maybe in the robots.txt page ?

There is still the Apache default web page :

Now let's check the error.log.1 :

Looks like there are some juicy informations here ! Someone tried to access to important ressources, like trying the "/../../../../../../etc/shadow" famous way to access hashed passwords stored on Unix OSs, or even the bootfile boot.ini, a text file that contains the boot options for computers with BIOS firmware running NT-based operating system prior to Windows Vista ! That's funny somehow :D

But, trying these path on the web page doesn't work, we're still stuck :/

No base64 or encoded string in the file. Maybe if we take a look at the other_vhosts_access.log file ?

Without waiting no more, let's feed it to CyberChef !

Yup, that looks nasty guys, let's get it over with ! :

Conclusion :

That was an easy and funny box to complete, thanks to @Noobosaurus_r3x for making and publishing it on THM ;) You can joing his Discord server, it's a real gold-mine (only in French of course :D) :

https://discord.gg/BXakAbF5 Thank you for reading, and have a nice day !

PreviousTryHackMe

Last updated