Cyborg

Room Details

TryHackMe Cyborg room contains:

  • Service Discovery

  • Web Content Discovery

  • Hash Cracking

  • Data Decompression

  • Privilege Escalation

Target

  • IP: 10.10.230.194

Service Discovery

  • Scan for open ports with nmap

$ nmap -sC -sV -A -sS -Pn -oN nmap.txt 10.10.230.194
Nmap scan report for 10.10.230.194
Host is up (0.44s latency).
Not shown: 998 closed tcp ports (reset)
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.2p2 Ubuntu 4ubuntu2.10 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
|   2048 db:b2:70:f3:07:ac:32:00:3f:81:b8:d0:3a:89:f3:65 (RSA)
|   256 68:e6:85:2f:69:65:5b:e7:c6:31:2c:8e:41:67:d7:ba (ECDSA)
|_  256 56:2c:79:92:ca:23:c3:91:49:35:fa:dd:69:7c:ca:ab (ED25519)
80/tcp open  http    Apache httpd 2.4.18 ((Ubuntu))
|_http-server-header: Apache/2.4.18 (Ubuntu)
|_http-title: Apache2 Ubuntu Default Page: It works
No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ).
TCP/IP fingerprint:
OS:SCAN(V=7.92%E=4%D=7/10%OT=22%CT=1%CU=35008%PV=Y%DS=4%DC=T%G=Y%TM=62CAA3E
OS:0%P=x86_64-pc-linux-gnu)SEQ(SP=106%GCD=1%ISR=107%TI=Z%CI=Z%II=I%TS=A)OPS
OS:(O1=M505ST11NW6%O2=M505ST11NW6%O3=M505NNT11NW6%O4=M505ST11NW6%O5=M505ST1
OS:1NW6%O6=M505ST11)WIN(W1=F4B3%W2=F4B3%W3=F4B3%W4=F4B3%W5=F4B3%W6=F4B3)ECN
OS:(R=Y%DF=Y%T=40%W=F507%O=M505NNSNW6%CC=Y%Q=)T1(R=Y%DF=Y%T=40%S=O%A=S+%F=A
OS:S%RD=0%Q=)T2(R=N)T3(R=N)T4(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T5(R
OS:=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F
OS:=R%O=%RD=0%Q=)T7(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)U1(R=Y%DF=N%
OS:T=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)IE(R=Y%DFI=N%T=40%CD
OS:=S)

Network Distance: 4 hops
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE (using port 993/tcp)
HOP RTT       ADDRESS
1   279.37 ms 10.2.0.1
2   ... 3
4   514.99 ms 10.10.230.194

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .

  • Services Discovered

    Service
    Port
    Version

    HTTP

    80

    Apache 2.4.18

    SSH

    22

    OpenSSH 7.2p2

  • OS: Ubuntu from service description

  • Answer Task 2 first three questions

Web Content Discovery

  • Scan for directories using gobuster

  • Directories Discovered

Dirs
Description
Files Found

/admin

homepage

from archive dropdown found archive.tar file

/etc

squid proxy

squid password and configuration files

Analyzing Directories

  • From /etc found /etc/squid/passwd which contains password hash and squid config file /etc/squid/squid.conf

Cracking Password Hash

  • Store hash into a file passwd_hash.txt

  • Crack the hash using hashcat

    squidward (music_archive)

  • We've successfully found the password from the hash

Analyzing Tar file

  • extract tar file

  • Found readme file which leads us to the borg documentation page

  • We need to install borg to extract the files from the compressed format

  • Install borg

    For debian based For other distribution refer borg installation documentation

  • decompress extracted files from archive.tar using borg

  • After files are decompressed successfully, it data turns out to the home directory backup for alex's account

  • Found Password from /home/alex/Documents/note.txt

Login with ssh

  • Login using alex's

  • We got access to Alex Account

Get User Flag

Privilege Escalation

  • Check for sudo exectuables

    We can run file /etc/mp3backups/backup.sh as with root privileges

  • Check whether file is writable

    We cannot write file, but user is alex, so we can change file permissions using chmod

  • Allow all permissions to the files

    Note: Allowing all users rwx permissions isn't a good practice, but for ease, I've provided them rights

  • Overwrite file with Bash Reverse Shell on alex's machine

    Reverse shell will connect to attacker's machine on port 4444

  • Start netcat on attacker's machine

  • Execute bash script from target machine

  • Now, we've successfully rooted the machine

Get Root Flag

PreviousCrack The HashNextOverPass

Last updated

Was this helpful?