Agent Sudo TRYHACKME

---

DIFFICULTY : EASY

---

A quick nmap Scan gives us this:

We can see that we have port 21,22,80 opened, Port 80 looks juicy, We have an Announcement Http-Title.

---

Moving to the website we get this message:

We are asked to use a codename as user-agent to access some information on the site

• We can use the hackbar browser extension or burp suite to do this🤠
• In this case i will be using hackbar

Changing the value of the User-Agent to C gave us some useful information:

---

Now we are known as chris, We have successfully enumerated our target and can now bruteforce FTP on port 21 using hydra:

Syntax: sudo hydra -t 4 -l chris -P /usr/share/wordlists/rockyou.txt -vV 10.10.115.114 ftp

Login To FTP with ftp chris@10.10.115.114 and mget the files:

We can run binwalk in other to see all files embeded in each other:

We can see here that cutie.png has some zip archives, extract the archives with binwalk -e cutie.png, After extraction we get a folder:

We get a zip file here and it requires a password, we can bruteforce with john, but first of all create a password hash with zip2john and then bruteforce:

We got a password again, use it on the 8702.zip by using the command:

Make sure to type the password at the end of the prompt and type yes Now we have got a To_agentR.txt file, concatenating it gives us an output that says;

Agent C,

We need to send the picture to 'QXJlYTUx' as soon as possible!

By,
Agent R

Great we have got a base64 encoded data, QXJlYTUx, just do echo QXJlYTUx | base64 -d in your terminal to decode.

I think this should be the password to a steg .jpg file, remember the files we got from FTP, we have another image file, let try it out:

Time to login through SSH<port 22>:

We got the user flag and an image, We are asked to lookup the image 🙃

• You can use tinyEye to perform an image reverse
• Fox News tell us it is a “Roswell alien autopsy” ✔️

---

Priviledge Escalation

---

• We are logged in as user james.
• We can’t view the root folder, neither the content in it😮‍💨.
• A quick sudo -l tells us we can run bash

Tested this by getting a reverse shell using gtfobins

• After much enumeration, we found out that it is vulnerable to CVE-2019-14287,which allows bypass of !root configuration, and USER= logging, for a “sudo -u#-1 /bin/bash” command.

Happy Hacking🥱//