Tomghost

I'd consider this room in one of the most easiest rooms on TryHackMe. Though, there is one confusing point but if you know the proper way to get around solving this room and getting both the flags won't be difficult. This room is based on one of the broadly known vulnerabilities in Tomcat which is Ghostcat, using which we can get access to the machine. Also this room need basic knowledge of PGP encryption (even if you don't have, you'll learn). So, let's begin!

Initial Foothold

The first thing that we can do is check out if there is some webpage hosted on the machine's URL, which in this case is of no use. This suggests that port 80 must not be open on the machine. So, to check the ports we can run an nmap scan on the machine:

┌─[tester@parrot-virtual]─[~/Downloads/tomghost]
└──╼ $nmap -A 10.10.0.168
Starting Nmap 7.80 ( https://nmap.org ) at 2020-09-26 19:02 IST
Nmap scan report for 10.10.0.168
Host is up (0.16s latency).
Not shown: 996 closed ports
PORT     STATE SERVICE    VERSION
22/tcp   open  ssh        OpenSSH 7.2p2 Ubuntu 4ubuntu2.8 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 f3:c8:9f:0b:6a:c5:fe:95:54:0b:e9:e3:ba:93:db:7c (RSA)
|   256 dd:1a:09:f5:99:63:a3:43:0d:2d:90:d8:e3:e1:1f:b9 (ECDSA)
|_  256 48:d1:30:1b:38:6c:c6:53:ea:30:81:80:5d:0c:f1:05 (ED25519)
53/tcp   open  tcpwrapped
8009/tcp open  ajp13      Apache Jserv (Protocol v1.3)
| ajp-methods: 
|_  Supported methods: GET HEAD POST OPTIONS
8080/tcp open  http       Apache Tomcat 9.0.30
|_http-favicon: Apache Tomcat
|_http-title: Apache Tomcat/9.0.30
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 34.81 seconds

From the nmap scan we can see that on port 8080, Apache Tomcat is running. We can browse to that using the address <machine_ip>:8080:

Img. Default Homepage

Here, we can see the default page for Apache Tomcat and also the version that it is running which is 9.0.30. So, now we have a point for which we can look for exploits. After some googling, we can find this article which discusses about the Ghostcat vulnerability in Apache Tomcat. Now, all we need to look for an exploit related to this vulnerability. While looking for an exploit, I found this article from Chaitin Tech, the organization that discovered this flaw in Tomcat. In the article, they've mentioned:

Ghostcat is a serious vulnerability in Tomcat discovered by security researcher of Chaitin Tech. Due to a flaw in the Tomcat AJP protocol, an attacker can read or include any files in the webapp directories of Tomcat. For example, An attacker can read the webapp configuration files or source code. In addition, if the target web application has a file upload function, the attacker may execute malicious code on the target host by exploiting file inclusion through Ghostcat vulnerability.

So, with the help of this vulnerability, we can directly read the configuration files of Apache and look for some useful information over there.

After visiting a few more websites, we can find this exploit on GitHub which provides the exploit script along with a few screenshot to guide us how to use the exploit. We can clone the repository and run the script as explained:

So, we have got login credentials for a user named skyfuck on the machine. We can use these credentials and try to access the machine via SSH:

But we don't see the user.txt file here. So, we can find it as:

So, it appears that there is another user as well on the machine named as merlin. But even then we can try to access the flag file.

And we do get the user flag!

Privilege Escalation

Now that we have the user flag, we need to escalate our privileges to obtain the root file. So, we can check commands can the user skyfuck perform as sudo:

From the above response, it is clear that we first need to escalate our privileges to user merlin and from there we can try to become root.

While looking around at the files in skyfuck's directory, we can see two files credentials.pgp which is not in readable format and the other tryhackme.asc which contains a PGP private key.

It took me a while to understand how these two files are related with each other until I found this article. So, we can try to do the same by first importing the ASC key and then decrypting the PGP file.

So, here we have imported the tryhakme.asc key and next thing we need to do is decrypt the credential.pgp file:

But here it asks for a passphrase that we don't know. So, we need to find a file to extract the passphrase from either of the two ASC or PGP files.

After some googling, I came around this article where it has explained how we can extract the passphrase from an ASC key by first converting it to a hash understandable by john and then extracting the passphrase from that hash using john. If the gpg2john is not present in your system it can found in this repository.

The next thing that we need to do is to obtain the tryhackme.asc file the target machine on our local machine. This can be done by starting a python http server on the target machine and using wget on our local machine to retrieve the file:

On the target machine:

On our local machine:

Now, we can run gpg2john on the ASC file and convert it to a hash understandable by john.

The next thing that we need to do is run john on the newly created file named hash_for_john.

So, john has provided us the passphrase using which we can decrypt the credential.pgp file. Now, we can head back to the target machine and decrypt the PGP file:

Now we can switch user to merlin using the obtained password and check the command that can be performed with sudo privilege:

Here, we can we see that we can run the zip command as root. So, we can look for an exploit for zip on GTFOBins and try to perform the steps as mentioned over there and replacing zip with /usr/bin/zip.

With this, we escalated our privileges to root level and obtained the root flag!

Some Key Points to Take Away

  1. Always check Apache Tomcat for Ghostcat vulnerability.

  2. Whenever you find a PGP and ASC file, try to decrypt the data using gpg --import and gpg --decrypt.

  3. To crack ASC file passphrase use gpg2john and john.

Links Referred

  1. TryHackMe Tomghost: https://tryhackme.com/room/tomghost

  2. Tenable Blog on Ghostcat Vulnerability: https://www.tenable.com/blog/cve-2020-1938-ghostcat-apache-tomcat-ajp-file-readinclusion-vulnerability-cnvd-2020-10487

  3. Chaitin Tech Article and Gostcat Vulnerability Detection Tool: https://www.chaitin.cn/en/ghostcat

  4. Ghostcat Exploit by 00theway on GitHub: https://github.com/00theway/Ghostcat-CNVD-2020-10487

  5. Decrypt PGP Using ASC Key: https://superuser.com/questions/46461/decrypt-pgp-file-using-asc-key

  6. Recover Your GPG Passphrase Using JTR: https://www.ubuntuvibes.com/2012/10/recover-your-gpg-passphrase-using-john.html

  7. John Repository on GitHub: https://github.com/openwall/john

  8. GTFOBins: https://gtfobins.github.io/

PreviousYear of The RabbitNextJack of All Trades

Last updated

Was this helpful?