Agent Sudo

In my opinion, the Agent Sudo room on TryHackMe is one of the best rooms for beginners. It focuses on various things related to enumeration, steganography as well as reverse image searching. There were some things that even I encountered for the first time.

So, let's begin!

[Task 1] Author note

We don't need to do anything more than just deploying the machine for this task and get the IP address for the box.

[Task 2] Enumerate

1. How many open ports?

This can be found out by simply running annmapscan on the target machine. The results of the scan would look somewhat like:

tester@kali:~/Desktop$ nmap -A -T4 10.10.92.183
Starting Nmap 7.80 ( https://nmap.org ) at 2020-08-13 00:10 IST
Nmap scan report for 10.10.92.183
Host is up (0.15s latency).
Not shown: 997 closed ports
PORT   STATE SERVICE VERSION
21/tcp open  ftp     vsftpd 3.0.3
22/tcp open  ssh     OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 ef:1f:5d:04:d4:77:95:06:60:72:ec:f0:58:f2:cc:07 (RSA)
|   256 5e:02:d1:9a:c4:e7:43:06:62:c1:9e:25:84:8a:e7:ea (ECDSA)
|_  256 2d:00:5c:b9:fd:a8:c8:d8:80:e3:92:4f:8b:4f:18:e2 (ED25519)
80/tcp open  http    Apache httpd 2.4.29 ((Ubuntu))
|_http-server-header: Apache/2.4.29 (Ubuntu)
|_http-title: Annoucement
Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 34.51 seconds

From the above results, we can count the number of open ports easily.

3. How you redirect yourself to a secret page?

We can visit the machine IP to check if we get some useful information over there.

And we do find the answer to the question directly at the homepage which says that we need to use our codename as theuser-agentwhile sending theGETrequest to the machine. This can be done using curl.

4. What is the agent name?

We know that one of the agent's name is R, so we can first create a request with R as our user-agent and check if get some other information. Some of the curl requests that we can try to access the site are given below:

With all the first 3 requests we would still go to the site that opens up with default user-agent but with the fourth one we get some different response:

With this, now we know how we modify the user-agent in order to access the site. We can either write a script to automate this process or do this manually. I wrote a simple script to dump the response with all the uppercase characters as user-agent:

From the output of this script, we can see that for request with C as user-agent the response was different:

From this output, we get the agent's name which can be submitted as the answer to third question.

[Task 3] Hash cracking and brute-force

1. FTP password

From the last question, we know that Agent C's password is weak and also we know his name. So, we can now use hydra to brute force their password:

With this, we found the password for one of the user's on the machine. Also, this password can be submitted as the answer to the first question.

2. Zip file password

We can access the FTP using the credentials we found in the last question and check the files to which we have access:

We can see that there are 3 image files present in the FTP. We can download all of them using the command mget *. Once, downloaded, we can check the content of each of these files.

Let's begin with the text file first:

From this message, there are a few important points that we need to note:

  1. If all these images are fake, there must be some real image.

    1. The real image is stored inside Agent J's directory.

    2. Agent J's account password is stored in these fake images (hints towards steganography).

Now, we have two images one is .png and the other is .jpg. Also, we know that jpg files can be used for hiding data using steganography. So, we can try to extract it's content using steghide:

But as we don't know the passphrase, we won't be able to access its content.

We also have another png image on which we can run the binwalk command:

And binwalk finds some hidden content in the image and extracts it to a folder _cutie.png.extracted. We can see in the newly created directory that 4 files have been detected:

The To_agentR.txtthe file appears to be empty whereas the filefilewhen checked with thefilecommand shows simply content type as data. Even using thestringscommand does not provide any useful result. We are also having a zip file but it appears to be locked with a password:

We can use fcrackzip to crack the password for this zip file:

But it can be seen that the password was not found.

Switch

Meaning

-v

Verbose

-u

use unzip to weed out wrong passwords

-D

use a dictionary

-p

use strings as password

So, the next thing we can do is use zip2john to crack the password, which can be done as:

What we have done over here is:

  1. First converted the zip to a format that can be understood by john using zip2john and stored it in a file named for_john.

  2. Then we used john to crack the password in for_john file and specified that the format of the value that is to be cracked is zip

And in this way, we get the password of the zip. This password is also the answer to the second question.

3. steg password

Now, that we have the password of the zip file, we can extract its content and read the file To_agentR.txt.

We can see that there is an encrypted stringQXJlYTUxin the message. We can decode it using CyberChef's magic method. From there, we can see that the string wasBase64encoded. We can try to use this decoded value as the passphrase for cutie.jpg the file:

And we were able to extract a new file. So, now we know the steg password as well that can be submitted as the password to the third question.

4. Who is the other agent (in full name)?

We can now read the message.txt and see if there is some useful information.

We do find the name of the other user at the very beginning of this message. This name can be submitted as the answer to the fourth question.

5. SSH password

In the message.txtthe file itself, we can find the password for the user. We can use the same username and password to gain SSH access to the machine. Also, this password can be submitted as the answer to the fifth question.

[Task 4] Capture the user flag

1. What is the user flag?

To get the user flag, we can SSH into the user's account:

So, we found the user flag.

2. What is the incident of the photo called?

In the same directory, we can find a file Alien_autospy.jpg. To view this file, we need to download this file on our local machine. This can be done by starting a python server on the target machine and using wget on the local machine to download the file:

Img. File Download

It can be seen that in the lower half we have started a python3 server on the target machine and in the upper half of the image we have used wget to download the file on our local machine.

On opening the image, we can find that it shows a dead alien. We can use Google Image Search to upload the file and find information related to the image.

Hint: You can easily get the first two words but for the third word think of some term similar to the second term in the image's filename.

Some Key Points to Take Away

  1. Use curl to change the User-Agent.

  2. When you have a zip file:

    • Use fcrackzip to crack its password

    • OR use zip2john along with john to crack the password

  3. Try to think of reverse searching the image if some details for the same are needed.

PreviousLian YuNextGotta Catch'em All

Last updated

Was this helpful?