search

TryHackMe Chocolate Factory WriteUp

hashtag
TryHackMe Chocolate Factory WriteUp

Hello and Welcome to my first writeup!

hashtag
Reconnaissance and Enumeration

first we scan the machine using nmap using the command:

nmap -sV [IP HERE]

nmap scan

21/tcp  open  ftp        vsftpd 3.0.3

22/tcp  open  ssh        OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)

80/tcp  open  http       Apache httpd 2.4.29 ((Ubuntu))

100/tcp open  newacct?

106/tcp open  pop3pw?

109/tcp open  pop2?

110/tcp open  pop3?

111/tcp open  rpcbind?

113/tcp open  ident?

119/tcp open  nntp?

125/tcp open  locus-map?

ftp enumeration

we login to ftp using username: “anonymous” and password: “anonymous”

in ftp found “gum_room.jpg”

used steghide to extract it:

didnt put passphrase, b64.txt extracted.

found what looks like a /etc/shadow file. didnt find anything useful.

web enumeration

we open the webpage and find a login portal.

i used gobuster to enumerate directories.

result:

hashtag
Initial Access:

we navigate to home.php, you can run commands in it.

we try the whoami command

it works! we search for users in the home directory using "ls /home"

found user charlie, we list the files, using "ls /home/charlie"

Bingo! found ssh private key.

i copied it into id_rsa file then give it the right permissions using chmod +600 test if we can login using ssh to the user. the key works!

in /var/www/html i found a file named key_rev_key, i try to run it:

changed the permissions using chmod +x key_rev_key

since its a binary, we can check the file contents using strings key_rev_key

got the key!

b'-VkgXhFf6sAEcAwrC6YR-SZbiuSb8ABXeQuvhcGSQzY='

in /var/www/html we cat validate.php:

run validate.php , bingo we got charlies password :)

login to charlies account using “su charlie”.

user.txt

hashtag
Privilege Escalation:

The first thing you should check for is sudo -l, result:

in gtfobins, vi -c ':!/bin/sh' /dev/null

i ran it with sudo so if it works we could get root privileges sudo vi -c ':!/bin/sh' /dev/null

pwned!!

Finding the root flag

we find root.py we run it , enter the key we obtained before , and it shows us the root flag.

Happy Pwning :)

PreviousTryhackmeNextTryHackMe Blog WriteUp

Last updated