Agent Sudo
November 22, 2022
Last updated
November 22, 2022
Last updated
Upon launching the box and entering the site, I am greeted with this:
I check if any extra directories exist and do a nmap scan to find some access points. No helpful directories exist but there are 3 ports open ftp, ssh, and http.
Next, I looked into the user-agent codenames, and at first I was confused about how to approach this and what my input should be. Eventually, I found that the user-agent should be altered to match some alphabet letters. After trying A, B, and C, I got this message with C as the user-agent:
Now that I had a username I can attempt brute forcing the ftp service. Hydra works perfectly and fetches the password "crystal".
There were a couple of files to extract with 2 being .png and 1 being a .txt file. The text file stated this:
I then used binwalk to extract out information from at least one .png file. I was able to receive a folder called "_cutie.png.extracted". Upon opening that directory I found a zip file that was password protected. This requires a tool like john2zip to get the hash and then use john to extract the password to unzip the file.
Once unzipped, I opened a message that contained a potential password, however, it was not working as a valid credential so I figured that something was not complete.
After a base64 decoding, I got this password.
After all that, I used steghide against the untouched .png file. It prompted a password as expected, and delivered a text file.
ssh into the user with the credentials and get the user flag. Next use scp james@<IP>:Alien_autospy.jpg ./ to get the image onto your attacker machine. You can view the message and drop it into a reverse image bin then use some keywords from the image plus "Fox News". You should quickly be able to find what the photo incident is referring to.
Lastly, check james privileges with sudo -l and you will notice james can run all commands except root on /bin/bash.
Simply searching (ALL, !root) /bin/bash will show an exploit from exploitdb.
CVE-2019-14287 https://www.exploit-db.com/exploits/47502
After reading through the exploit you can find this sudo -u#-1 /bin/bash. This grants root access and you can then retrieve the final flag!
