WhyHackMe
Dive into the depths of security and analysis with WhyHackMe.
Recon
First we start with nmap scans.
We can see see Anonymous FTP login is allowed. Let's try logging in.
We find the file update.txt.
This seems interesting, should be useful later.
Upon visiting the website we are met with this page.
The blog.php opens a blog with random text and at the bottom there is a link for a login page.
admin:admin does not work.
Dirbuster shows that there is a registration page called register.php
We can access this registration page.
It is not possible to get admin access by creating an account with the same name as Admin.
After creating an account and logging in, We are able to post comments. But as you can see while trying for XXS nothing works. Upon inspecting the element we find out comments under <h2> HTML tag but closing the tag first and then trying scrip did not work either.
Initial Access
Since even the name is displayed, let's try creating a new user with <script>alert("2");</script> as the name.
Here we have stored XXS. Let's try accessing 127.0.0.1/dir/pass.txt.
After alot of trial and error. This walkthrough helped me in getting the content pass.txt. It is important you delete all your previous comments. If even that does not work then it would be better to reset the machine and then try it. This solved it for me.
We see the content of pass.txt in base64 encoded we just need to decode it.
We have a username called jack and a password. Let's SSH with the details.
Here we have our first flag.
Privelege Esclation
With little moving around we find urget.txt which tells us there are some files in /usr/lib/cgi-bin/ and that we can use iptables as root. Upon trying to access the said files in the location we get Permission denied.
There is also a pcap file, which is encrypted.
After quite some time and trial and error, Referring back to the earlier walkthrough. We can decrypt this as follows:
Decrypting SSL/TLS traffic using Wireshark and private keys
Open the Preferences window by navigation to Edit > Preferences.
Expand Protocols and click TLS.
To specify the RSA private key, click Edit > New and enter the following information:
IP address: The IP address of the SSL server. (10.133.71.33 here)
Port: The port number. (41312 here)
Protocol: A protocol name for the decrypted network data. (tcp here)
Key File: Path to the RSA private key.
Click Close.
To find the Key file, the 000-default.conf can be examined. The key can be found in /etc/apache2/certs/
We can setup a python server and request the key and add it to wireshark. We can apply http as a filter and browse through the .pcap.
We know the port to focus on is 41312. But the initial nmap scans did not show this port as open. Checking again confirmed it.
Using iptables we can check what's allowed and what's blocked.It is port 41312. Ok.
sudo /usr/sbin/iptables -L --line-numbers
We can see that there is a rule to drop tcp on port 41312.
Let's delete this rule and add a rule to accept traffic.
sudo /usr/sbin/iptables -D INPUT 1
This will delete rule 1. i.e 1 DROP tcp -- anywhere anywhere tcp dpt:41312.
sudo /usr/sbin/iptables -I INPUT -p tcp --dport 41312 -j ACCEPT
This will add the new rule to accept traffic. We can confirm with nmap
We can see that it open.
When trying to access, it tells us to use HTTPS instead.
But that just tells us we don't have permission. However from the wireshark details earlier we know we can access this port
Checking sudo -l
We can see that we can run everything as sudo, let's see if we can access root flag.
This gives us the flag. Although I am sure this was not the intended way to get the flag.
Let's try getting a shell as root. Setup a listner with nc -lvnp 1337.
Execute the above command as jack.
We have root. We can directly get our flag now
Last updated
Was this helpful?