Break Out of The Cage

Though this room has been categorized as beginner level, I found it to be a bit tricky. But to be honest, there's a lot to learn from this room. This room involves abusing SSH key, spectrogram, decoding and obviously privilege escalation.

Initial Foothold

1. What is Weston's password?

The first few things that we can do once the machine is deployed are accessing the IP address, running a directory brute force attack and an Nmap scan.

First, we can check the webpage:

Img. Homepage

We can check the content of the webpage and its source-code but we don't find anything useful over there.

The next thing that we can check is the nmap scan result:

Here, we can see that FTP port is open and we can login anonymously as well. So, the next thing that we can do is access the FTP as anonymous.

We can see that there is a file nameddad_tasksand on printing its content it can be seen that it encoded which appears to be Base64 encoding. We can go to CyberChef and decode it. On decoding the string from Base64 we get:

It looks like this data is encoded using simple rotation, so we try ROT13 decoding on it but we don't get any proper result. We can try different ROT values from 1 to 25 but we can't find any meaningful data in any of them. If it is not a simple letter substitution cipher then we can think that it might be encoded using Vigenere Cipher but for that, we need a key using which we can decode the data. But as of now, we don't know about any such value that can be used as the key. So, for now, we can move on and check the directory brute force attack result.

We can see that multiple directories have been detected which we can explore one by one. From all these directories, in the/auditionsdirectory, we can see an mp3 file. So, we can download it and check it for spectrogram using audacity.

Img. Spectrogram

Here, we can see a string that does not make any sense as it is but we can try to decipher the Base64 decoded data.

And we get the password. Now, as this file was stored by Wetson (Cage's son), we can assume that this is his password. We can confirm this by submitting this as the answer to the first question.

2. What's the user flag?

We can now try to get SSH access as wetson as we know his password.

We do get access to the machine as wetson but we don't find theuser.txtfile, which means this is not the account we are looking for. We can go t0 /home and see the other users on the machine.

Here, we can see that there is another account as well that belongs to cage. On trying to access cage's directory, the permission gets denied. So, we can look for some files on the system that are owned by cage but we can access them. This can be done as:

The files in the directory/opt/.dads_scriptslook a bit odd. On analyzing the spread_the_quotes.py file:

We can see that it reads the.quotesfile and selects a random line from it. Which is then displayed to all the users via the system command wall.

On checking the permissions of the .quotes file, we can see that others have the permission to read and write to the file. So, we can modify this file and add a bash reverse shell payload to it which would get executed by os.system() in the spread_the_quotes.py script as cage. With this, we will be able to access the machine as cage.

Along with this, we need to start a listener on our local machine using the command nc -nvlp 4242

Now, whenever the script would run, it will print Test on wetson's shell and we will get a reverse shell on our listener as cage.

We do get our shell as cage on our listener but we can't see the user.txt. Though we can check all the other files that we have access to. We can see a file named Super_Duper_Checklist in cage's directory, which we can check.

And we got the user flag which we can submit as the answer to the second question.

Privilege Escalation

3. What's the root flag?

Now that we have the user flag, we need to move on to get the root flag for which we need to escalate our privileges. On browsing cage's file we can find a file named email_3 in the email_backup directory which contains a weird string.

From past experience in the same room, we can assume that again Vigenere's cipher might be used over here. But again the issue here is we don't know about the key. We can try different rotations as well but we don't get any meaningful result which confirms that again this a case of Vigenere's cipher. Now, if we read the line immediately after the cipher string, it gives a hint that the guy was pretty much obsessed with cage's face. So, we can try to use the stringfaceas the key.

And now, we have the root's password as well. We won't be able to switch the user from the reverse shell, so we need to go back to the wetson's shell and from there we can switch the user to root and read the root flag.

Again, there is no root.txt, which means the flag must be in the directory email_backup.

With this, we get the root flag as well and have completed the room!

Some Key Points to Take Away

  1. If any of the simple substitution rotation ciphers don't work and you are sure that it is a case of cipher. Then start looking for other cipher methods such as Vigenere's Cipher.

  2. When need to perform horizontal escalation, look for files owned by other users that you can access.

Links Referred

  1. TryHackMe-Break Out The Cage: https://tryhackme.com/room/breakoutthecage1

  2. CyberChef: https://gchq.github.io/CyberChef/

PreviousKibaNextTartarus

Last updated

Was this helpful?