search
Page cover

Cat Pictures (phpBB, Knockd, Docker)

First, we need to enumerate using nmap.

╭─hnl@hnl ~/Desktop/ctf/tryhackme/catpictures  
╰─➤  nmap -A 10.10.68.82 | tee nmap.log
Starting Nmap 7.80 ( https://nmap.org ) at 2022-04-26 21:28 +0630
Nmap scan report for 10.10.68.82
Host is up (0.27s latency).
Not shown: 998 closed ports
PORT     STATE    SERVICE    VERSION
22/tcp   open     ssh        OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 37:43:64:80:d3:5a:74:62:81:b7:80:6b:1a:23:d8:4a (RSA)
|   256 53:c6:82:ef:d2:77:33:ef:c1:3d:9c:15:13:54:0e:b2 (ECDSA)
|_  256 ba:97:c3:23:d4:f2:cc:08:2c:e1:2b:30:06:18:95:41 (ED25519)
8080/tcp filtered http-proxy
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 98.12 seconds

hashtag
Port 8080

You can see some interesting things in php forum.

It can be port knocking. We will knock 1111 2222 3333 4444 sequences and scan again using nmap.

hashtag
Port 21

Connect ftp using anonymous login.

Read the files.

hashtag
Port 4420

Connect port 4420 using sardinethecat password.

You can run any command on this box. For stable shell, we can use bash reverse shell.

In /home/catlover, we can see a file called runme. Transfer it to local.

With string analysis, the correct password is rebecca. We will run it runme file using this password.

Read gibmethesshkey file in tmp. No content. But list the current directory, we can see private ssh key.

Read the key file.

Connect ssh using this private key.

hashtag
User && Root

Read the flag.

We are in docker container. Here is .bash_history in /.

Check the file system.

Hum /opt/clean? What is that?

Abuse it.

In netcat session, we got reverse shell.

Read the flag.

PreviousLockdown (SQLI, FileUpload, Cracking, Yara)NextMagician (ImageTragick, Port Forwarding)

Last updated