TryHackMe Chocolate Factory WriteUp
TryHackMe Chocolate Factory WriteUp
Hello and Welcome to my first writeup!
Reconnaissance and Enumeration
first we scan the machine using nmap using the command:
nmap -sV [IP HERE]nmap scan
21/tcp open ftp vsftpd 3.0.3
22/tcp open ssh OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
80/tcp open http Apache httpd 2.4.29 ((Ubuntu))
100/tcp open newacct?
106/tcp open pop3pw?
109/tcp open pop2?
110/tcp open pop3?
111/tcp open rpcbind?
113/tcp open ident?
119/tcp open nntp?
125/tcp open locus-map?ftp enumeration
we login to ftp using username: “anonymous” and password: “anonymous”
in ftp found “gum_room.jpg”
used steghide to extract it:
didnt put passphrase, b64.txt extracted.
found what looks like a /etc/shadow file. didnt find anything useful.
web enumeration
we open the webpage and find a login portal.
i used gobuster to enumerate directories.
result:
Initial Access:
we navigate to home.php, you can run commands in it.
we try the whoami command
it works! we search for users in the home directory using "ls /home"
found user charlie, we list the files, using "ls /home/charlie"
Bingo! found ssh private key.
i copied it into id_rsa file then give it the right permissions using chmod +600 test if we can login using ssh to the user. the key works!
in /var/www/html i found a file named key_rev_key, i try to run it:
changed the permissions using chmod +x key_rev_key
since its a binary, we can check the file contents using strings key_rev_key
got the key!
b'-VkgXhFf6sAEcAwrC6YR-SZbiuSb8ABXeQuvhcGSQzY='
in /var/www/html we cat validate.php:
run validate.php , bingo we got charlies password :)
login to charlies account using “su charlie”.
user.txt
Privilege Escalation:
The first thing you should check for is sudo -l, result:
in gtfobins, vi -c ':!/bin/sh' /dev/null
i ran it with sudo so if it works we could get root privileges sudo vi -c ':!/bin/sh' /dev/null
pwned!!
Finding the root flag
we find root.py we run it , enter the key we obtained before , and it shows us the root flag.
Happy Pwning :)
Last updated