Day 25 | Advent of Cyber 2
Tags: Hackathons, Ctf Writeup, Hacking, Tryhackme, Cybersecurity

Day 25 | Advent of Cyber 2

Ready for one last challenge to make sure you’ve earned your presents this year? Use the skills gained throughout Advent of Cyber to prove your mettle and conquer day twenty four! tocto Follow Dec 24, 2020 · 5 min read

last room of the event! this is practically a typical capture the flag so let’s do it!

As there are many questions, instead of answering one by one I am going to solve the challenge to get the user flag and the root flag.

The questions are resolved as we progress!

Enumeration

As we can see in the following image, we find two web servers.

The one on port 80 does not present anything special while the one on port 65000 seems to contain more interesting things.

We are going to run a directory scan and as we can see, it seems that there is an uploads directory with HTTP 200 code, that is, we have access to said page

On this page we can upload files, however, I can’t upload anything with the typical bypass tricks ??

I investigate the source code of the web page and I find the following script

const filter = file => {

if(["image/png", "image/jpeg", "image/jpg"].indexOf(file.type) < 0){

return false;

} else if (["png", "jpeg", "jpg"].indexOf(file.name.split(".").pop()) < 0){

return false;

}



//Let's be honest -- these things are dangerous. May as well always return false Â¯\_(ãƒ„)_/Â¯

return false;



}

always returns false ??

Explotation

as it seems that it is in a separate file, maybe we can capture the HTTP responses and not allow this script to reach our browser.

If we capture the HTTP responses from burpsuite (including the java script responses) we see that one of them is filter.js , we are going to press drop so that it does not run and we can skip the filter on the client side.

Now we should be able to upload the files we want, the problem is that the server is probably waiting for the same type of files as filter.js , that is, images.

now if we can put into practice the bypass techniques learned on day 2! we are gonna name the file something like:

file.png.php

we are going to download a revshell and then access it and be able to access the machine!

done! we managed to upload our rev shell

now, to find where it has been uploaded is as easy as looking at the gobuster directory scan, it seems that there is an unusual directory called grid/ .

and as we supposed, there is our revshell. Now it is as easy as putting a listener on our machine in the correct port and executing the file!

Instead of netcat , I use this tool (I leave the link) that has some interesting little thing that makes life much easier!

As the main page of the web was a login form, perhaps there are the credentials to compare in one of the files on the server!

we found the credentials of a database!

tron:IFightForTheUsers

let’s connect to her to see what there is:

mysql -u tron -p

Enter password: IFightForTheUsers mysql> show databases;

mysql> use tron

mysql> describe users;

+----------+--------------+------+-----+---------+----------------+

| Field | Type | Null | Key | Default | Extra |

+----------+--------------+------+-----+---------+----------------+

| id | int(11) | NO | PRI | NULL | auto_increment |

| username | varchar(255) | NO | UNI | NULL | |

| password | varchar(255) | NO | | NULL | |

+----------+--------------+------+-----+---------+----------------+ mysql> select * from users;

+ — — + — — — — — + — — — — — — — — — — — — — — — — — +

| id | username | password |

+ — — + — — — — — + — — — — — — — — — — — — — — — — — +

| 1 | flynn | edc621628f6d19a13a00fd683f5e3ff7 |

| 2 | admin | 21232f297a57a5a743894a0e4a801fc3 |

+ — — + — — — — — + — — — — — — — — — — — — — — — — — +

prize! We found some encrypted credentials, in the following link I leave a page that does our dirty work to decrypt them!

admin:admin

flynn:@computer@

There is no admin user on the machine so I try to switch to the Flynn user, it seems to work and we get the first flag!

Privilege scalation

Now, when looking a little more deeply at the user, we verify that this is part of the lxd group.

This will allow us to climb to root and thus get the last flag of the event!

I hope you enjoyed the event as much as I did and that you have learned new things or at least reviewed abandoned topics!