Anonforce

8 August 2020 4 minutes to read

Link: https://tryhackme.com/room/bsidesgtanonforce

Another day, another CTF writeup from tryhackme. This is my second boot2root writeup series. The challenge is rather easier compared to the first boot2root write-up. Less tricky and straight forward. Without further ado, let’s get it on.

Task 1: Capture the flag

As always, your task is to capture the user and the root flag.

Task 1-1: Capture user’s flag

First and foremost, launch your nmap scanner with the following command.

In a jiff, you will be presented two open ports, specifically Port 21 (FTP) and Port 22 (SSH). Let’s check the FTP port first.

OMG., who the hell put the entire system folder inside the FTP. In addition, everyone can access the FTP server. Moral of the story, direct the Anon user to a specific FTP directory (not the whole system) or secure the FTP with a password. Enough of that, let’s check the user flag inside the home directory.

That’s it, easy and straight forward.

Task 1-3: Capture the root’s flag

1) The GPG

There are tons of directory yet to be discovered. After a quick search, I come across an unusual filename called ‘notread’.

Inside the ‘notread’ directory, we have a PGP file and a private key. Download both files into your machine and let’s import the private key using the following command.

Uh-oh, guess we need a password to access the key. Maybe Mr.john can help us out, I mean John the Ripple (JtR). Without further ado, export the key into the hash and run JtR.

The password for the private key is ‘xbox360’. After that, input the password to import the private key.

Then, decrypt the backup.pgp file using the following command.

Once again, you will be prompt with another password field. Now, enter the ‘xbox360’ password into the field.

2) Crack the hash

After decrypted the PGP file, a shadow file contains two users’ hashed password shown on the terminal.

To identify the type of hashes, you can visit the hash . After performing a quick search, the hash-name for the root user is ‘ sha512crypt $6$, SHA512 (Unix) 2 ‘ while the hash-name for user melodias is ‘ md5crypt, MD5 (Unix), Cisco-IOS $1$ (MD5) 2 ‘ . Let’s do the hashcat crack using the following command.

I am going to use my host computer to crack the hash because of the hashcat inside the kali VMware does not support the GPU processor. You can refer to my for more detail.

After a few seconds, you will be prompted with the cracked password which is hikari (mean light in Japanese).

3) Capture the flag

Meanwhile, can we crack melodias’s hash? Nay, we can’t. A root password should be more than enough to solve this challenge. After that, log in to the root’s ssh shell using the following command.

Congratulation, you are now rooted in the machine. Let’s check for the flag.

Conclusion

That’s it, we just finished our second boot2root challenge by stuxnet. Hope you learn something new today. See ya ;)

tags: tryhackme - CTF - recon - crack

Thanks for reading. Follow my for latest update

If you like this post, consider a small . Much appreciated. :)

Vortex