Gotta Catch'em All
This room on TryHackMe is really a good one and can be considered as majorly designed in a CTF style. The main target is to find different flags that are related to various pokemon and submit them to complete the questions. So, let's begin!
Initial Foothold
The first thing that we need to do is to deploy the machine and then we can start our basic enumeration.
1. Find the Grass-Type Pokemon
Once deployed, we can visit the IP address where we can see the default apache page. With time I've observed that many times some important information is usually hidden in these default pages that are not directly visible but can be found in its source code.
We can open the source-code by right-clicking on the page and selecting 'view source-code'. At the end of the code we can find a pair of credentials:
Now, we have a username and password but we don't know where we can use them. So, we can run a nmap scan to see what other services are open where we can try to use these credentials.
From the nmap scan result, we can see that other than port 80 port 22 which is used for SSH is also open. Hence, we can try to access the machine via SSH using the discovered credentials:
And we do get into the machine. Now, we can start solving the question. The first question asks us to find a 'grass-type pokemon' for which we can run a find command as:
With this we can't find any useful file so, the next thing we can do is manually look for the file just in case if it is named something like gr4ss or something else.
On the Desktop, we can see a zip file which we can try to unzip and extract it's content.
In the extracted files we can find the file grass-type.txt. On viewing the content of the file, we can determine that is not the exact file but encoded in hex. So, we can use the CyberChef website to decode it and submit the obtained value as the answer to the first question.
2. Find the Water-Type Pokemon
Again we can use the find command and see if something related to water comes up.
It can be seen that we found a file namedwater-type.txtbut the value that it contains appears to be decoded using ROT13. So, we can again go to CyberChef and decode it using the ROT13 function.
But if we look properly, we don't get any proper result. So, the next thing that can be done is to try different rotation values. And while doing so, if we just go one step up i.e. ROT14, we get our deisred flag that can be submitted as the answer to the second question.
3. Find the Fire-Type Pokemon
This time also, we can find a file named fire-type.txt using the find command as:
Again the content of the file is decoded. At the end of the string, we can see==, which suggests that the string isbase64encode. So, we can decode this value and submit it as the answer to the third question.
Privilege Escalation
4. Who is Root's Favorite Pokemon?
In the/homedirectory, we can see a file namedroots-pokemon.txtthat can't be accessed aspokemonuser. Also, we can see there is another user named ash. From the permissions for the fileroots-pokemon.txt, it can be concluded that it is accessible only by the users that have root-level privileges.
We can see what privileges we have by using the command sudo -l:
Sadly, we are not allowed to run any commands as root on the machine. We can look for some other files in the system such as some shell script through which we can escalate our privileges to the root level.
On browsing through the various folders, we can find a bit strange sub-folder chain in ~/Videos folder.
Just by pressing thetabkey again and again we can get the entire path. At the end, we can find a file Could_this_be_what_Im_looking_for?.cplusplus.
The file contains a pair of credentials having username as ash. So, we can use these credentials and switch user as ash.
Now we can again try to access the roots-pokemon.txt file.
And we got the final flag as well!
With this, we completed this room!
Some Key Points to Take Away
When you suspect the presence of something use the
findcommand.Always enumerate different folders.
If vertical privilege escalation is not possible try to perform horizontal privilege escalation.
Last updated
Was this helpful?