Easy Peasy
The Easy Peasy room on TryHackMe is marked as a beginner and it is a beginner-level room but even then it'll take a lot of time and efforts to break it. This room is mainly about one and only one thing and that is Enumeration! Enumeration! and Enumeration!
Even after being a beginner level room, it took me quite some time to drill down and complete the room. But to be honest, this room made me realize the importance of enumeration.
[Task 1] Enumeration Through Nmap
As all the questions in this task are based on nmap, we can directly start a nmap search first and then look at the questions
1. How many ports are open?
The answer to this question can be found by directly count the number of open ports for which nmap has provided the details.
2. What is the version of nginx?
We can see on what port nginx is running and along with that we are provided the version of nginx as well.
3. What is running on the highest port?
There is only one service that is running on the port number greater than 65K and that service is the answer to this question.
[Task 2] Compromising The Machine
Now, the fun part begins!
The questions in this task require us to find hidden pages and files. Hence, we can start dirb scan beforehand and then use all that information to answer the questions.
Remember, on our nmap scan we saw two open ports; one for nginx and the other for apache. So, we can start two different dirb scans for each port.
Dirb scan for port 80:
Dirb Scan for port 65524:
1. Using GoBuster, find flag 1.
From dirb scan for port 80, we can see that a /hidden directory has been found so we can go and check if we can find something useful over there.
Over there, we can see this one image and nothing else. Not even in the HTML file.
We can also see that another sub-directory is present in the /hidden directory named as /whatever, we can also go there and check it's content.
Again, the same thing. There is just an image but this time in the HTML file, we can see a value named hidden and the == at the end suggest that it is a base64 encoded file. So, we can decode it as base64 and check what it actually is. We can use GCHQ CyberChef for decoding.
Once decoded, we can see that we have got our first flag!
2. Further enumerate the machine, what is flag 2?
As for port 80, no other directories or files were detected (other than robots.txt which did not contain anything useful) we can now move on to the dirb results from port 65524.
We can also check the homepage that is hosted on port 65524 which appears to be the default Apache page and hence, we can say that there is nothing useful here.
In the dirb scan results for port 65524, another robots.txt was detected. So, we can go and check this as well. There we can see one really odd kind of an user-agent specified.
Whatever it might be we can try to curl a request with this User-Agent.
Even after curling a request to the homepage with a modified user-agent, we still got the same page itself but while looking at the result of this request properly we can see that the Flag 3 is present over here only. So, if not flag 2 we got flag 3 at least.
As it appears to be a random string, we can try different decoding methods on it to check if can get some meaningful data out of it. This can be done by using the magic feature on GCHQ website. But even over there, we can find any meaningful decoding output for this string.
The next thing about which we can think is hashes. We can pass this string to hash-identifier and check if it can detect something.
And we can see that it has been detected as a possible MD5 or MD4 hash. We can not look for some online md5 cracker tools and try to crack this hash. I tried various websites but was not able to crack it until I found this website.
After select MD5 as the hash type and passing on the hash value, we can see in the result that we now have flag 2 as well.
So with this, we got all the 3 flags but now the important part begins which is gaining access to the machine.
3. Locate flag 3.
Check Task 2, Question 2 for the solution as it was found before flag 2.
4. What is the hidden directory?
We have browsed all the pages that were detected by dirb on both port 80 and 65524 but we did not find any hidden directory that gets accepted as the solution to this question. This means we have not observed something that was present in the detected pages.
We can go through all the pages and directories that have been detected to find out what we have missed. From the pages on port 80, we can't find anything. But on the index.html page on port 65524 from where we got our third flag, we missed one important detail:
This value again appears to be some sort of hashed value or encoded value. But in the statement, it is written that 'its encoded with ba....:' which suggests that this is some sort of baseX encoded data. So, we can go back to CyberChef and try different base encoding methods and determine which one decodes this string. After multiple trials and errors with various base encoding method, we can determine that this is the hidden directory encoded using base62.
So, we got the name of the hidden directory as well.
5. Using the file found in the hidden directory, find and crack a password hidden in the file.
It can be seen that there is one full-screen background image on top which there is another image named "binarycodepixabay.jpg" and below that another text string. First, we can look at the string. Again, this appears like a hash, so we can send it to hash-identifier.
This time the possible hashing methods that got detected are SHA-256 and Haval-256. So, we can go back to the same hash cracker website that we used earlier and crack the hash. But even after multiple attempts, the hash does not get cracked either as SHA-256 or Haval-256. We can even the least possible hashing methods.
When we select GHOST hashing method in hash type and pass our hash value then the hash gets cracked. The cracked values appear to be the password of something but what we don't know yet.
But for now, this password can be submitted as the answer to this question.
6. What is the password to login to the machine via SSH?
Coming back to the webpage where we found this hash, we had observed that was an image as well. So, we can save that image and check it for steganography and pass the found password as the passphrase for this file's steganography test.
Now, the secrettext.txt file we can get the username and the password which is stored in binary.
So, we can again head back to GCHQ and convert this binary data to text to get the password for this account. Also, this password can be submitted as the answer to this question.
7. What is the user flag?
Now that we have both the username and password, we can easily access the machine via SSH. But one thing to remember here is that the SSH was not running on the default port 22 but some other custom port. So, while connecting we need to mention that port number as well.
And we get the user flag (partially) but not in the exact state. It is also mentioned in the user.txt file that the flag has been rotated. So, we can go to CyberChef and rotate the flag using ROT13and get our desired flag!
8. What is the root flag?
We are already at the user level, so we just need to escalate ourselves to the root level in order to gain root-level access to the machine.
As a regular process, we can check the /etc/passwd file, run sudo-l and check /etc/crontab. We don't find any useful information from the passwd file and also we are not allowed to run any commands as sudo on this machine. But in /etc/crontab we can find a job running every minute that too with root as user:
We can further check and confirm that we have access to this /var/www/.mysecretcronjob.sh and also that we can modify it. So, now we can simply enter the command cat /root/root.txt > /tmp/flag in this shell file.
Also, we need to make a new file named flag in /tmp directory and change it's permissions so that root can write to it using the command: chmod 660 flag. We can wait for some time and then check the content of the flag file.
In nano, we can add the command cat /root/root.txt > /tmp/flag and save it. Once, all these steps are performed, we can wait for a minute so that the cronjob gets executed and the flag gets printed to our /tmp/flag file.
But even after waiting for some considerable time, nothing gets printed to the file. So, we need to check if the file root.txt is actually present at the location or so. This can be done by adding the command: ls -la /root > /tmp/flag to /var/www/.mysecretcronjob.sh and again wait for some time to see the output.
Here, we can see that the file has been named as .root.txt so we need to change our previous command a little bit like: cat /root/.root.txt > /tmp/flag and again wait for some time.
With this, we will get the root flag as well as complete the room!
As I said earlier, there was a lot of enumeration involved at the beginning to gain the initial foothold whereas the privilege escalation part was pretty simple. We could have used payloads to get a reverse shell as well if we wanted to by exploiting the shell file.
Some Key Points to Take Away
Look closely at all the information on a web page as we can find some sensitive information.
In case of any string first, check it with
hash-identifierand then check for different encoding methods to crack it.If you see any doubtful image, check it for steganography.
Tools to keep in handy:
Last updated
