Fowsniff CTF — TryHackMe — Writeup
Hello. I’m Rahmos. Here is my Fowsniff CTF — TryHackMe — Writeup. Check it out!
First deploy the machine and scan for opened ports.
We can see there is port 80 open. So let’s access its website.
Well, now we know the company’s name is Fowsniff Corp. Search on Google for some information about this company
Luckily we found some twitter account with the same name of the company. Go to this twitter page and we found a pastebin file contains some password!
Here is the link to pastebin password’s file:
So i copy all the user:passwd to a file and use john to crack the md5 hash of password.
john — format=Raw-MD5 corp.txt
- I named the file corp, so change corp to your file name
So I’ve cracked seina’s password!
#7 scoobydoo2 is ans for question 7
Now login to pop3 service by seina email and password!
nc <ip> 110
*110 is the port for pop3 service.
Type these commands in order to login to her email using pop3. For more information, take a look at this page: https://www.suburbancomputer.com/tips_email.htm
Ok now we see there are 2 messages. Let’s read all of them using command retr
retr 1
Now there is her ssh password. So:
#9 S1ck3nBluff+secureshell is ans for question 9
I know the password, but I cannot login as seina as she has changed her password. Let’s take a look at the other email
retr 2
Well now i know that this guy hasn’t changed his default password yet! So I will use his username and the password above to login via SSH. His username is:
Now let’s SSH to this machine.
ssh baksteen@<ip>
Success! Now we will get root.
First let’s see if we can run sudo on this machine
sudo -l
Unfortunately, we cannot run any cmd with sudo right on this machine. So we will find another way.
Get the sudo version to find exploit:
sudo -V
The version is 1.8.16. Search on Google for priv escalation and immediately I found the CVE:
https://www.exploit-db.com/exploits/44298
Download the C code and then compile using gcc
gcc file.c -o linuxpriv
*I named the file linuxpriv, you can name it whatever you want.
chmod +x linuxpriv
to make that program can be executed.
Finally, transfer the file to the ssh machine using scp
scp linuxpriv baksteen@<ip>:/tmp/
Enter the ssh password above and cd to tmp to run your file!
Now i’m root!
The end.
HAPPY HACKING
