TryHackMe: Boiler CTF walkthrough

As you know, to start we always have join their VPN. By attackbox or kali, that is your decision.

But anyhow, I will use my kali machine from vmware. If you want to join through virtual machine like me, just download the configuration file, or if you have already downloaded, type in terminal: 'sudo openvpn <your_config_file>.ovpn' . You should change the last part with your file name.

All of them finished, let's start by reconnaissance with nmap:

nmap -p- -sV 10.130.146.91

You can see that ports 21, 80, 10000 and 55007 are open. Let's check the FTP first:

ftp 10.130.146.91

And type anonymous as name

We've found valuable info.txt. So let's read it:

It looks like ciphered. It looks like seazar cipher. So, let's decode it:

You can answer first three questions with the help of nmap results. And also there is no exploit on running that port. So, we can't exploit it.

Now we should use gobuster in order to see what pages are available to check:

Let's look at joomla:

Let's further search about joomla:

So, it is CMS site. Now robots.txt:

We see some numbers in the below. They look like a cipher. So, let's try to decipher it:

It looks like a hash. So with the help of crackstation site, we found it out:

But kidding had no use. After that I resolved to make another gobuster on joomla directory:

From here, we can find the filename actually. I found an exploit from exploit-DB. Just add a command to exploit on it.

And it is good idea to look the content of log.txt:

And we have found username and password for ssh server. We have ssh server on the port of 55007 as you remember.

We found backup.sh file. And after looking content of it, we have found another username and password:

Now ssh into these credentials:

Now, we should escalate our privileges. Let's look at SUID premission with this command:

find / -perm -u=s -type f 2>/dev/null

Yeah, many binaries with SUID permission. Let's try find.

I visited GTFObins in order to get the command with find:

But use /usr/bin/find . -exec /bin/bash -p \; -quit . It is working:

So, we have finished with this room. It was perfect to work on this room. Thanks for reading!