← CTF archive

· Earliest timestamped screenshot

[TryHackMe] WhiteRose

Credentials

Olivia Cortez:olivi8
Gayle Bev:p~]P@5!6;rs558:q

Attack and enumeration notes

80
22 (creds)

Nmap scan

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.6p1 Ubuntu 4ubuntu0.7 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
|   2048 b9:07:96:0d:c4:b6:0c:d6:22:1a:e4:6c:8e:ac:6f:7d (RSA)
|   256 ba:ff:92:3e:0f:03:7e:da:30:ca:e3:52:8d:47:d9:6c (ECDSA)
|_  256 5d:e4:14:39:ca:06:17:47:93:53:86:de:2b:77:09:7d (ED25519)
80/tcp open  http    nginx 1.14.0 (Ubuntu)
|_http-title: Site doesn't have a title (text/html).
|_http-server-header: nginx/1.14.0 (Ubuntu)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Web service enumeration

SUBDOMAINS :

Screenshot

www.cyprusbank.thm admin.cyprusbank.thm

Directories:

/login

Screenshot

Valid creds: [ Olivia Cortez:olivi8 ]

Vulnerability research

IDOR exposing chat history

http://admin.cyprusbank.thm/messages/?c=1500 (Increment number)

Screenshot

Credential : Gayle Bev:p~]P@5!6;rs558:q

Recovered Tyrell Wellick’s phone number from Gayle’s account:

Screenshot

Phone : 842-029-5701

Changing Tyrell Wellick’s password to test.

Screenshot

Privilege escalation

* Check service
* Check network (everything running under 127.0.0.1)
* Check cronjob (maybe upload pspy)
* Check the versions of package of the services running under 127.0.0.1 (dmesg |grep -i 'mysql' --color=auto)
* getcap -r / 2>/dev/null
    if capabilities for python just 'import os;os.system("/bin/dash")' and RUN ROOT ~#