---
description: November 29, 2022
---

# Lian\_Yu

{% embed url="https://tryhackme.com/room/lianyu" %}

### Deploy the VM and Start the Enumeration.

For enumeration, I found these open ports of interest: ![](https://850580359-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSqAgfe92W3tM8LBhIHHu%2Fuploads%2FpARKFdREaERbAxDWMcE7%2Fimage.png?alt=media\&token=478192f0-9632-40d4-96cc-52c3f6bb5f18)

Next, I used gobuster to look for directories.&#x20;

`gobuster dir -u http://<ip>/ -w /usr/share/dirb/wordlists/big.txt` This gives us the directory /Island

![](https://850580359-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSqAgfe92W3tM8LBhIHHu%2Fuploads%2FzUL7FgUUPepoHsBLi81x%2Fimage.png?alt=media\&token=0effe479-6539-4118-be00-8ba24db6230f)&#x20;

The webpage attempts to hide the codeword by making it blend in with the background.

![](https://850580359-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSqAgfe92W3tM8LBhIHHu%2Fuploads%2F7JRoLQFZzVPM0R2I2uC0%2Fimage.png?alt=media\&token=7518dab5-6d2e-4142-aa9b-10ed8308b162)

We have a codeword, however, we should enumerate the directories further.

### What is the Web Directory you found?

Using gobuster on /island gives us another directory. I did need to change the wordlist though to find it.

`gobuster dir -u http://<ip>/island -w /usr/share/dirbuster/wordlists/directory-list-2.3-medium.txt`

This would give us the directory /2100. This link had a broken YouTube link, but contained an important note inside the webpage.

![](https://850580359-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSqAgfe92W3tM8LBhIHHu%2Fuploads%2FSUk6eadad3Fo6oe1DXsD%2Fimage.png?alt=media\&token=b0dfc1f1-e5cc-4bbf-9272-4160706a7eb7)

### What is the file name you found?

/2100 mentions a .ticket extension here. This led me to believe there was another directory/file with this extension that could be enumerated further.

`gobuster dir -u http://<ip>/island/2100 -w /usr/share/dirbuster/wordlists/directory-list-2.3-medium.txt -x .ticket`

The gobuster command resulted in this page: http://\<ip>/island/2100/green\_arrow.ticket

![](https://850580359-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSqAgfe92W3tM8LBhIHHu%2Fuploads%2FCQ2oQpWyl7fdGnuIKnWK%2Fimage.png?alt=media\&token=80b11869-8d4b-4852-9abd-cccce14583c5)

### What is the FTP Password?

This was rejected as a password and upon using the THM hint I used cyberchef to unmask its contents. I had to use a base 58 decoder which was certainly new for me. This gave me the password "**!#th3h00d**".

Now that we have a password we can use that in combination with the codename for ssh or ftp.&#x20;

### What is the file name with SSH password?

The codename and first password found are used to access ftp.

While looking through ftp we find some images and other files.

![](https://850580359-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSqAgfe92W3tM8LBhIHHu%2Fuploads%2FMzKrXWZd5jORDkfsEBfK%2Fimage.png?alt=media\&token=be8e1c4b-d34a-4323-a2e3-98ee69f97bd2) _Important note:_ use `ls -a` to see the file .other\_user

You can also view other users' directories with `ls ..` to see the name of our other user, "**slade**".

Next, we use `get` to transfer the files and pictures from ftp.

I used `steghide --info aa.jpg` and this prompted a password.

I got stuck here for a bit, and needed to research how to beat this steg challenge. I found something about magic numbers and this was a great deal of help.

{% embed url="https://www.geeksforgeeks.org/working-with-magic-numbers-in-linux/" %}

This bit helped identify if an image had been altered and what someone could do to repair the alterations. First I used `xxd Leave_me_alone.png` since it was the only image not working. This revealed that the magic numbers were incorrect from a standard .png file.

![](https://850580359-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSqAgfe92W3tM8LBhIHHu%2Fuploads%2FMkyVkOLRh8T9JR2l7ncZ%2Fimage.png?alt=media\&token=41a86b4a-1030-480e-a8ce-1e64f082f18d)

With that information, I used `hexeditor Leave_me_alone.png` to adjust the first line.

![](https://850580359-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSqAgfe92W3tM8LBhIHHu%2Fuploads%2FcHzwINF1nAuFKdxfcuJX%2Fimage.png?alt=media\&token=584a9267-f5cb-4e0a-ab0a-57abe9c02055)

This allowed the image to open with a password.

![](https://850580359-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSqAgfe92W3tM8LBhIHHu%2Fuploads%2FskNMOANT0YCsroVetzQ6%2Fimage.png?alt=media\&token=fb8eea57-8fc0-49c9-8ea5-7659023a756f)

Finally, I used this password with `steghide extract -sf aa.jpg` and unzipped the contents of the hidden file to find a file name and password for slade.

![](https://850580359-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSqAgfe92W3tM8LBhIHHu%2Fuploads%2FJtEhCx3i2h1m5tVc4zUs%2Fimage.png?alt=media\&token=7bfb4ecc-ba62-4785-a774-0e35a51007e8)

### user.txt

Use the credentials for slade with ssh to read user.txt.

![](https://850580359-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSqAgfe92W3tM8LBhIHHu%2Fuploads%2Folt8ZWs08KW55AcqoUpU%2Fimage.png?alt=media\&token=55f58ee3-66e2-47ca-8f11-6183bb384b6d)

### root.txt

This was a simple privilege escalation. I just used `sudo -l` to see current privileges and went to gtfobins to use `sudo pkexec /bin/sh` to gain root privileges.

![](https://850580359-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSqAgfe92W3tM8LBhIHHu%2Fuploads%2FDScejrfmNWBPxhdHKmfh%2Fimage.png?alt=media\&token=2ea2bba9-4f1a-4216-89fb-488230df9934)
