Capture the Flag - Start Tr0lling

Overview

---

Objective: Get Flag

Tools used: netdiscover, nmap, nikto, wireshark, hydra, scp, a brain

OVA Link - Original Post

---

To start, we'll get the IP of the tr0ll VM. I usually just use netdiscover as follows: Next, we can do a quick nmap scan to see what we have going on. We can see telnet, SSH, and HTTP ports open. Going to the web page, we can see a troll face, which I guess is fitting. It doesn't look like the site is using a standard CMS we're going to exploit either. To get some more info, I'll run a Nikto scan to see if there's anything obvious I can't see. We have some interesting finds to go through! First up is the /secret/ directory, which gives us nothing to work with but: Looking at the /robots.txt, we can see it references the same directory. No need to go there again. At this point, we're better off moving to something else. Back up in the port scan, we can see ftp is open and check for anonymous access. Lo and behold, we can get in and retrieve a .pcap file! We can open the .pcap file in Wireshark and see what we have. This part was a little confusing. We can see a couple TCP streams to observe, one references a file called "secret_stuff.txt" and another stream has a message to mock us. Here comes the troll part of the challenge. While I can summarize in a paragraph what the next step is in a few seconds, it took me quite a long time to realize what we were supposed to get out of this .pcap file. Essentially, sup3rs3cr3tdirlol is actually a hint to a web directory, /sup3rs3cr3tdirlol/. Here we can see a file to download. This took me a little bit to figure out as well, however, here you can see the process I went through figuring out the hint to this file. Additionally, if you're running a 64bit OS, you're going to have to install a couple 32-bit packages to be able to read this file properly. At first, I ran through the elf file with readelf -a <filename>, however, there really wasn't anything I can find to go on. Then I remembered the Wireshark directory hint and well... Ok now we have two folders, I downloaded the contents with wget and you can see the output below. The Pass.txt file was located in /this_folder_contains_the_password/ directory, while the which_one_lol.txt was located in the /good_luck/ directory. First thought? Username list and password to brute force the SSH. Ok so first off, I cleaned out the " < -- Definitely not this one" part of that list. Next, I ran hydra using the two files and... got nothing. Hm. This was ridiculous actually. I got frustrated enough where I had to walk away, took a break, and sat down to give it all a second shot. Like the usual trolling, the situation isn't what it seems. You'd THINK the password would be 'Good_Job_:)', but it's not. I'll just post this hydra screenshot and you can see what actually is going on. So we can now login! A quick check of the kernel version and /tmp folder shows we can look up an exploit (old kernel) and use the /tmp folder as an upload vector. A quick search online shows a great exploit usable on this kernel version. I uploaded it to the target host using scp as follows: We can now see the exploit on the troll box, compile it, run it for root, and obtain the flag!