Year of The Rabbit
To be honest, I found this room one of the most challenging beginner level rooms on TryHackMe. All you need to do is just find the user and root flags but to get them is a really tricky task. I won't say it was difficult but there were definitely a lot things that I didn't know such as analyzing URL redirection and determining unknown ciphers. Also, this room not only involved vertical but as well as horizontal escalation.
So, let's begin!
Initial Foothold
To begin with, we can start a nmap scan against the IP address we get once we deploy the machine. Meanwhile, we can check the IP address on the browser to see if can find some content over there.
And we get the default Apache page. Also, we don't find anything useful in it's source-code. Moving to the nmap scan results:
Here, we can see that port FTP is open but anonymous login is not enabled so we'd need FTP credentials to access it. Along with that we can see port 22 and 80 are also open. The next thing that we can do is run a directory brute force attack.
Here, we can see a directory named assets has been detected. We can check if there is some userful information over there.
And we can see that there are two files present in this directory, one is a ".mp4" video and the other one is a ".css" file. We can first go and check the ".css" file as this appears to be a bit odd place for storing such a file.
And to no surprise we do find a hint towards a hidden page on the website. But when we try to access that page we get a pop-up:
Once we click ok, it redirects us to YouTube. So, we can try to turn off the JavaScript (using add-ons like NoScript) and see what happens.
So, once JavaScript is blocked it brings us to this page and we can see that it says above that there is a hint in the video. So, we can listen to the song and see if we can get something out of it.
But this appears to be a rabbit hole as at 56 seconds we can hear someone saying:
Now, we have two hints:
There is a redirection
The person burps
Both these makes us suspicious to use Burp Suite and analyze the redirection.
With Burp Suite fired up, when we again access the hidden page we can see that there is a redirection from the response code 302. Also, we can see a redirection towards /intermdiary.php.
On accessing the /intermediary.php webpage it again leads us to the YouTube page. But if we look properly a hidden_directory parameter is being passed as well. We can try to access that path directory and see if it works.
We can see that there is an image file in the directory and nothing else. So, we can download it and analyze it further. As this is a ".png" file hiding data through steganography won't be possible. Hence, we can run binwalk over the image.
But we don't find anything useful as there are only part which both constitute to the PNG image. So, we need to think of some other way to get the data from the image. We can try to use strings and see if there are some string values in the file.
From the strings output we get the username of an FTP user and also a list of passwords. So, we can copy this list of passwords in a file and pass it to hydra along with the username we just found to get the correct password from all these.
Now, we have the username and password for FTP. So, we can explore the FTP directory and download any files present there.
So, we downloaded one file named Eli's_Creds.txt but the content of this file is really odd.
This appears to be some sort of encoding but what I did not have any idea. I saw this type of encoding for the first time in my life.
To decode this, we can go to google and search for encodings that use dashes, arrows, plus signs, square braces. But we won't find any satisfying results. The next thing that we can do is copy some part of this and search it with google. This would immediately lead us to a new term called Brainfuck and actually this encoding does fuck your brain. There is even a Wikipedia article on this. We can then search for Brainfuck decoder and then use it to decode the this data. I used this tool, to decode the data.
From the decoded data we get:
Now we have Eli's username and password. So, we can try to SSH into her account.
As soon as we login in, this banner is displayed to us which is actually a message from root to Gwendoline which talks about some secret hiding place. So, we can run a find command and check if there is actually some file.
Now that we have the credentials of user Gwendoline, we can switch the user and access out user flag.
So, our first task to obtain the user flag is completed. Now, we need to escalate our privileges to root level to get the root flag.
Privilege Escalation
We can run the sudo -l command to see what commands can the user run with root privileges.
Now, this (ALL, !root) NOPASSWD is actually a vulnerability mentioned in CVE-2019-4287. On the same page it has explained how to exploit it. So, following the same instructions we can escalate our privileges over here as well:
This would lead us to vim editor and display the user flag as we have passed the user flag file in the command. To get the root flag, we need to execute command from vim itself.
This can be done by first pressing the escape(Esc) key, then :! and then entering whatever command that needs to be executed which in our case would be cat /root/root.txt. Once executed, we get the root flag as well and the room is completed!
Some Key Points to Take Away
Always check odd files present at odd locations.
Whenever you find some redirection, analyze it with Burp Suite.
PNG images contain two parts which are PNG and zlib data.
If steganography or binwalk don't work try to
catorstringsthe file.When you find ciphers that you don't understand, copy some part of it and google it.
Reference Links
TryHackMe-Year of The Rabbit: https://tryhackme.com/room/yearoftherabbit
Brainfuck Decoder: https://www.splitbrain.org/_static/ook/
CVE-2019-4287: https://www.exploit-db.com/exploits/47502
Last updated
Was this helpful?