🤖Cyborg

A box involving encrypted archives, source code analysis and more.

1.Scanning

1.1 Nmap

Using nmap to scan and identify open ports and services

  • We find 2 open ports. 22 and 80 running ssh and a web server respectively

  • Port 80 takes us to a default Apache homepage

2. Reconnaisance

2.1 Gobuster

  • Directory brute forcing using gobuster on port 80

  • Going over to /etc directory, we find a hash at /etc/squid/passwd to a music_archive

2.2 John

  • Coping the hash to hash.txt and running john to crack it

  • We get a potential password squidward

2.3 /admin

  • Going over to /admin directory

  • Navigating the webpage to /admin/admin.html, we find a conversation

  • Here, there is a mention of squid proxy , and a backup of music_archive as well as potential usernames Josh, Adam and Alex

  • We can find the archive, and it has an option to download it from the homepage

  • Downloading the archive archive.tar and extracting it

  • Reading the README file, we see that it is a Borg backup repository, and it gives us a link to the documentation

2.4 Borg Backup

  • Reading the documentations, we can see that Borg is a backup program with compression and encryption support

  • We can install borg in our Debian system with apt install borgbackup

  • We can list the files present using the option list and the path of the archive. A password is prompted, and we can use squidward which we had cracked earlier from the hash to show the archive

  • We can extract the files in archive with the command extract and specifying the archive name

  • The archive got extracted to the home directory

  • There is a note.txt in home/alex/Documents

This might be the login creds of alex

alex : S3cretP@s3

3. Gaining Access

3.1 SSH

  • We can ssh into the target with the credentials that we found.

  • We can see that Alex can run /etc/mp3backups/backup.sh as root

4. Privilege Escalation

  • Reading the script, we find that it is a script that compress mp3 files to an archive and can execute the command that we provide.

  • We can provide any command to run using -c

PreviousBoltNextHA Jocker CTF

Last updated