TryHackMe|WonderLand WriteUp\Walkthrough (English)

Wonderland

Room Link: https://tryhackme.com/r/room/wonderland
================================================================

• After an Nmap scan, you will notice that you have 2 open ports, 22 and 80.

• Go to port 80. There you will find a text and a picture. Run gobuster on the target to see if there are any hidden folders. you got 2 hidden folders /img and /r. The /img folder has 3 pictures in it, download them for further inspection.

• Using exiftool there is nothing. Trying binwalk -e [picture name] and also there is nothing except that alice_door.png has a zlib file in it, that has nothing interesting. Moving on to steghide, with steghide we've found a file called hint.txt embedded in it.

Extract this file steghide extract -sf white_rabbit_1.jpg. The hint is:

 

Which is not clear right now but it will be :).

• We have another folder that we need to inspect. The /r folder. If you continue to run gobuster on the subfolders, you will get more one-letter folders.

Now from the hint we can assume that the folders end with /r/a/b/b/i/t.

• Go to http://IP/r/a/b/b/i/t and look into the source code. You will find a hidden text which contains the password for Alice. Use this password to log in via SSH.

• Once you are in. look around the machine. from ls /home you will see that you have 4 users: alice, hatter, rabbit, tryhackme. In Alice’s home directory, you don’t have the flag, but the hint on the website tells you that (everything is upside down here). If you look at the contents of this home directory you will find the root.txt so you can assume that the user.txt is in the roots home directory cat /root/user.txt and you will get the user flag ✨.

• Now you need to get the root.txt. To be able to read this file you need root privileges. Transfer linpeas.sh to the victim machine using python http server and change it to an executable. If you execute the script, you will see a PE vector with a chance of 95%.

The problem here is that the only user that can execute perl is hatter. So you need to be hatter.

• Use sudo -l to see what commands Alice can run as root.

So Alice can only run this code in Python with sudo and as the user rabbit. It must be something there😉.

• If you look into this code. It is a simple code that prints a random 10 lines from the poem. We can see that the code imports random. We can leverage this by creating our own random that the code will call and execute. vim random.py then type these two lines in it, save it and change its permissions to +x.

• Now run this code using sudo -u rabbit /usr/bin/python3.6 /home/alice/walrus_and_the_carpenter.py and you will get a rabbit shell immediately.

• Now you are rabbit. Go to his home directory. And you will find a setuid file. This file is owned and executed by root. If you tried to run this file you will see that it prints the date and tell you to ask questions.

If you tried to use strings to look into it, strings is not in this machine so transfer the file to your attacker machine to inspect it. There are multiple ways to transfer the file into your machine, I used netcat here.

• strings teaParty you will notice that it called date without specifying an absolute path, so you can manipulate that. Create a file called date and in it write these two lines:

Save it in /tmp and change its permissions to be executable. Now for this script to be executed we need to add /tmp to the PATH.  

 

 

Now every time a program is called without specifying an absolute path, our shell will first look in /tmp.

• Now execute the teaParty setuid and you will get a hatter shell.

If you run the id command you will notice that you are still in rabbit group. To change that you can use the password provided in hatter’s home directory then login as hatter.

• Remember the linpeas.sh results? now we can use it to get root. Search for Perl in GTFObins https://gtfobins.github.io/gtfobins/perl/#capabilities, you only need to execute this command perl -e 'use POSIX qw(setuid); POSIX::setuid(0); exec "/bin/sh";' and you will get a root shell.

To change the group run sudo su, then cat /home/alice/root.txt and you now have the root flag ✨.