GamingServer CTF — THM Write-Up
It’s been a while since I wrote a write-up because I was busy with school, and explored more in the cyber-security field. I’ve been doing a lot of TryHackMe rooms and Portswigger labs lately because I’ve been stuffed with a lot of information that I had to keep on doing labs in order to solidify what I’ve learned.
Anyways, enough of chatting, let’s start the write-up!
GamingServer
An Easy Boot2Root box for beginners
Not much information, so let’s boot up the machine!
Did a quick nmap scan, it seems like we can only see 2 open ports.
So now, we access the website via it’s ip. The first thing you should always do is to walk the site and look for interesting source code features.
In the Draagan Lore page, I found an interesting button which leads me to the /uploads directory, my initial thought was probably a file upload vulnerability, so I kept that in mind.
It also contained some files, I viewed each one and dict.lst was the most interesting one, so I saved the file.
As I manually explored the site, I didn’t find anything interesting, but in the source, I found this HTML comment.
I assumed that john was probably one of the co-developers of the website, so I took note. Dang you john!
Since we found /upload earlier, I now then looked into using tools for fuzzing.
We found secret, and it contained an rsa key! Now we can assume that we’ll use this key in some way in order to access the server.
I initially assumed that we’ll have to bruteforce the login, but since I tried logging in with the rsa key, it needed a passphrase.
Get Syd’s stories in your inbox
Join Medium for free to get updates from this writer.
Since we have both files, we’ll now have to use john, since logging in the ssh with the rsa private key requires usually requires a passphrase.
We now have the passphrase! Now all we need is the user to log-in to. Remember earlier when we found a possible co-dev? Well, he’s the user we’ll log-in to the ssh!
Now that we have logged-in, let’s now root the machine!
I am not really comfortable yet with linux privesc, so I usually follow around a checklist to see what I can exploit!
Now, john has access to different groups, I used OSINT to look what each group does, and I found 108(lxd) interesting.
According to Ubuntu’s website:
LXC (lex-see) is a program which creates and administers “containers” on a local system.
And also found this!
So I tried the privesc and ran to my first problem.
It had trouble connecting to the cloud-images… I tried it again but it failed, so I thought that we probably have to upload our own image to the shell.
I initially wanted to use ubuntu, but I thought that I’d probably want to use something light like alpine, and so I looked around and got a github repo which guides me to installation.
Now we upload our file from our system to the machine.
And voila! We got root. hehe
With all honesty, I took way longer than expected in completing this room. I had a lot of trial and errors, but still persevered and pushed through! If there’s something I learned that I’d share, it would be reading the documentations through and through!
Connect!
