AGENT SUDO (CTF {THM} )

You found a secret server located under the deep sea. Your task is to hack inside the server and reveal the truth.

Reconnaissance is very important when you are on hunt!!!

So first I started with my nmap scan….

Since when directed to http://tryhackme_machineip.com, I found the note as

THM gave the hint about user agent so i fired up burp and before forwarding I changed the user-agent to C .

Now redirect to the results of the burp and then i bruteforce the FTP with our cutie, yes!! it’s hydra.

After successful login into the FTP, you know the drill right!!!!

Secret text explaining nothing but Steganography, so I inspected all the file captured from FTP, and found coded file.

Yes!! you got it right, i hop over to Mr.John

Hmmm… Looks like encrypted Base64 text.

As per the task, I just got the SSH Password!!!!

Oh, their’s a flag, finally ;-) . That’s not enough, i just then checked the sudo permission with its version. Little of google showed that this is a critical vulnerability. I recommend you to google this vulnerability and gothrough it.

That was a super fun room and a lot more learning i got during this room, I hope you’ll too :-)

This room conveys the message that to keep your device up to date, older version may lead to priv esc. BE SAFE!!!

That’s all for know,

Until next time,

cyberbreath signing off!!!!