TryHackMe|AgentSudo WriteUp\Walkthrough (English)

 Agent Sudo

Room Link: https://tryhackme.com/r/room/agentsudoctf

===================================================

• Sudo nmap IP you have 3 ports open 21,22,80. In ftp the anonymous login didn’t work. Now, we will start with the web page. There you will find a message that indicates you need to change your user agent in your http request. You can do that by using agent-switcher plugin.

• In the message, it shows that the Agent is a letter, so we can assume that all agents are also letters. So we will try the letters until we find a response. In the agent-switcher change the userAgent field with letters, then click apply container and finally click Refresh Tab. Letter C will work with you and will display a message. 

• Here it gave us that the username is Chris, and it told us that his password is weak, we can conclude from this that we can crack it. hydra -l chris -P /usr/share/wordlists/rockyou.txt ftp://IP the password is *******. 

• In the ftp server you will find 3 files download them all mget *. The text file told agent J that his password is stored in a picture, so we will look into pictures. By trying steghide info cute_alien.jpg it required a passphrase which we don’t have. Since steghide doesn’t support .png images we will use binwalk with cutie.png. binwalk cutie.png showed that indeed we have a file hidden inside this picture. to get it binwalk -e cutie.png. you will get _cutie.png.extracted folder, cd to it. 

• In this folder you have multiple files. The zip file is encrypted as it requests a password. zip2john 8702.zip > hash then john hash. The password for the zip file is *****. If you get into a problem when extracting a password with john and it tells you that “No password hashes left to crack” the solution is to use --show option. 

• Now you can unzip the zip file. If you run into problems with unzip use 7z e 8702.zip press Y then provide the password *****. Now open To_agentR.txt file. In this file, you have a text that appears to be encoded. Use cyberchef to guess the encoding and decode it. It appears that it is base64 encoding, and the decoded word is ******. 

• This password might be that of the .jpg picture. Steghide info cute-alien.jpg provide the password, and indeed we have a hidden text file. To extract it steghide extract -sf cute-alien.jpg give the password ******. Now we got a file called message.txt. In this file we got the info that we have a user james with the password ************.

• ssh to james@IP and you will find the first flag in his home directory ✨.

• To privilege escalate sudo -l , you will notice something different about this.

User james may run the following commands on agent-sudo:

    (ALL, !root) /bin/bash

Try to search for an exploit with “(ALL, !root) /bin/bash”, you will find one in exploit-db https://www.exploit-db.com/exploits/47502 . The implementation is so easy. Simply run sudo -u#-1 /bin/bash and you will get a root shell. cd /root and retrieve the flag ✨. For this file you can get the answer of the last question which is DesKel.