Agent Sudo

You found a secret server located under the deep sea. Your task is to hack inside the server and reveal the truth.

This is the write-up for room Agent Sudo on Tryhackme and it is part of our cybersecurity training from HackerU.

Firstly we have to make a connection with VPN or use the attack box on the Tryhackme site to connect to the Tryhackme lab environment.

Task 1:

First, deploy the machine after that we will get the Target system IP.

Target IP

Once the machine is booted up then will move to our next task.

Task 2:

In this task, we have 3 questions to answer.

The first is to get how many open ports are there. For this, we will run Nmap before that will check ping with the target system.

ping check

Now we are set to run an Nmap scan to find the open ports.

nmap -sS -sV -A 10.10.110.184

-sS (TCP SYN scan)

-sV (Version detection)

-A (Aggressive scan options)

Nmap scan

We found that there are 3 ports open port 21, port 22, port80.

As port 80 is open we will check the webpage for any information.

Webpage

As we can see a hint was given that we have to use our own codename as a user-agent.

The hint was given in THM that use user-agent C.

To change user-agent I will show three methods users comfortable with any of these can be used.

First method:

We will use curl to change the user agent. We can get details of command in cheatsheet of curl or man page or help.

curl cheatsheet

As seen in the cheatsheet we have to use -L and -A in command.

curl -A “C” -L http://10.10.110.184/

curl command

From this, we got some information like the agent name is Chris, and said that his password is weak.

Second method:

The hint was given to use the user-agent switcher will use this extension to change user-agnet.

user-agent switcher

As seen the highlighted there we have to replace user-agent and apply it and refresh the tab.

changed user-agent

We are redirected to the secret page as shown.

Third method:

Using Burpsuite we will intercept the connection and change the user-agent.

Burp intercept

As seen we intercepted the website and saw the user-agent column. Now will change it.

Changing agent value

We can directly change the user-agent or by going to the inspector option and change it as shown above.

In all three methods, we are redirected to the secret page and got the message hint.

We got an answer for all the three questions of Task 2.

Task 2

Now we will move to our next task.

Task 3:

We came to know that user Chris has a weak password so will try to crack the FTP password for the user using hydra.

hydra -l chris -P /usr/share/wordlists/rockyou.txt ftp://10.10.110.184

Hydra to crack password

We were successful in cracking the password for user chris.

User:- chris

Password:- crystal

Now will try to log in to FTP using these credentials.

FTP login

We logged in using chris user and found 3 files, will download all three files to our system to check what more information we can get.

File downloaded

Text file content

As seen above all files are downloaded and saved in our system. We will see the content of the text file, found information like there is a message hidden in the alien photo file which contains a user password and it is written to Agent J.

We will try to decode that picture using steghide. But the picture is asking for a passphrase so will first have to crack the image to see if we get any file or password using stegcracker.

stegcracker cute-alien.jpg

We got the passphrase as Area51. We got the password, we will extract the jpg file

steghide extract -sf cute-alien.jpg

The steghide extracted the jpg file & data is stored in the “message.txt” file.We will view the extracted file.

We found the user as “James” & the password is “hackerrules!”.

SSH password

We have to get the password of the zip file for this will have to decode cutie.png using binwalk.

binwalk -e cutie.png

binwalk

There is a zip file, will search for the content of the zip file. Check for the extracted directory. Inside the extracted directory, we can see the zip file.

We will convert the .zip file to txt file using john(Provided as hint)

zip2john 8702.zip >zip

zip2john

We will check for the content of the converted text file. Since the text file contains a hash, we will crack it using john the ripper

john zip

We found the zip file password is alien

john password crack

We got answers to all our 5 questions of Task 3.

Task 3

Now will move towards our next task Task 4.

Task 4:

In this task, we have to get a user flag.

For this, we will log in to SSH using the credentials we got.

SSH login

user.txt content

As seen we got the user flag. And there is another file which is a JPG file we will google check details for the question to answer.

File instance

we got answers to both the question of Task 4.

Task 4

Now we move towards our next and final task Task 5.

Task 5:

We have to capture the root flag in this task for this will first check if this user got sudo permission for any application to run.

sudo -l

sudo permission check

We found that it can run /bin/bash all as root we will check CVE details of this vulnerability in Exploit DB.

CVE details.

On checking this vulnerability we found a command to get root access(privilege escalation).

The command for privilege escalation.

We will use this command for privilege escalation and get root access.

sudo -u#-1 /bin/bash

root text

We were able to get root access and got the root flag. We got answers to all our questions in Task 5.

Task 5

Thus we successfully able to crack the box get privilege escalation and got root access and captured the flags.