TryHackMe|Startup WriteUp\Walkthrough (English)

Startup

Room Link: https://tryhackme.com/room/startup

• sudo nmap IP -vv you have 3 open ports 21,22,80. sudo nmap IP -vv -A -oN nmapResults from the results you knew that ftp allows anonymous login. You have a folder called ftp that has nothing and there are two other files important.jpg and notice.txt. Looking to the text file there is nothing important, and for the jpg if you want to use steghide you need a password and binwalk extracted a zlib file that I couldn’t open. So we will move on to port 80.

• At the root of the website, nothing is interesting, in the source code or on the homepage itself. gobuster dir -w /usr/share/dirb/wordlists/common.txt -u http://IP -r you have a folder called /files. If you go there and look closely you will notice that you have the same files that were in the ftp server. So upload a php shell to the ftp directory in the ftp server. Then set up a listener on your machine nc -nlvp 1234 and to activate the shell click on it from your browser. You will get a shell back with the user www-data. python3 -c 'import pty; pty.spawn("/bin/bash")' .

• The current directory you will be in is /. Look around in the directories you have. There are some interesting ones such as: /incidents, /vagrant , and the file recipe.txt. in the latter file you will find the answer for the first question which is l***. In /vagrant nothing is interesting but in /incidents we have a .pcapng file called suspicious.pcapng that it’s better to look into it.

• Transfer suspicious.pcapng to your system using nc and open it using wireshark. From there click on any TCP packet and follow the TCP stream.

You have an interaction between the server and a client. Here it tried a password for www-data but it didn’t work. This password is for sure left here for a purpose.

• cd /home and you will find a user called lennie. The password might be for lennie. su lennie then paste in the password and you are Lennie now. Retrieve the answer for the 2^nd question which is user.txt ✨.

• There is a folder called scripts. Inside it you have a script planner.sh and a file stratrup_list.txt owned by root, interesting!!!. cat planner.sh

This script prints the value of LIST into startup_list.txt and then run the script /etc/print.sh. ls -l /etc/print.sh

Nice !!. It looks like we have the permissions to modify the print.sh file that user root execute it. From how the things are going, it is obvious that we have a cron job running planner.sh.

• The contents of print.sh are:

So we need to modify it to be able to get the root.txt. echo “cp /root/root.txt /home/lennie/root.txt” >> /etc/print.sh. Now root will execute planner.sh which will consequently execute print.sh and we will get a file in the home directory of lennie called root.txt that has the final flag✨. Just wait for some time a minute or so to get the file.