🤤Dreaming TryHackMe Writeup CTF
While the king of dreams was imprisoned, his home fell into ruins. Can you help Sandman restore his kingdom?
Table of Contents
Recon
First let's use rustscan to check for live ports on the target
Seems, like only 2 ports are open.
When visiting the ip address on port 80, it's just a default apache page. Nothing interesting.
Let's use directory bruteforcing.
We now have an interesting endpoint /app let's take a look!
Hmmm, interesting.... once we visit the directory of pluck we get a welcome page along with a login page link. Please note that the version of pluck is 4.7.13
Since we don't know the password, neither do we have any breadcrumbs for password, we can try to use bruteforce to get the password, via burpsuite intruder.
I am using the rockyou.txt for buteforcing, Look out for response length 1464, you should have the password.
Once we have the correct password, lets checkout for some exsisting vulnerabilites on this particular version of Pluck.
Initial Foothold
You may now copy the exploit code and run with following command!
If you successfully did that, you will be provided a link to webshell
Exploitation
Once we visit the page, you have webshell waiting for your commands. now what you can do is get a revershell back that way it will be much easier to control the system. Use the revshells.com
Now get a reverse shell
One thing to note is that you may need to use base64 encoding/decoding to inject a revershell via the web shell
Once we get inside, we need to find the first flag, but its read protected
Intended Path - Hacking Lucien
We can look into /opt directory for usefull scripts that maybe helpful
Interesting files!, lets check test.py
we get the password for Lucien!, lets login using ssh and get our flag
Get Lucien Flag
Intended Path - Hacking Death
Check if there is any program that can be run as root to get an easy hack.
So we can run a python script without any password using sudo!
Now let's check the other file in the /opt folder!
As per the code, we don't have the password for the user death, but if you look closely there is a for loop from line 37-42 which prints the data from the database, we need to hijack the process there.
What we can simply do is use a bash payload in the library database, itself so when it prints the data, it will terminate the line and execute our payload.
But first we need to get the password for the database! the best place to look for is the .bash_history file.
As you can see, after the -p argument there is a password, lets use that to connect to the library database.
Now execute the script like this
As you can see along with the data, we can execute our bash payloads!
Time to pivot, use the revshells.com to generate a reverse shell payload, select the encoding as base64.
Now do the same like previously, login to database and insert the payload like the following
And open the netcat listener in your own machine and execute the script again to get the shell!
Get the flag!
Intended Path - Hack Morpheus
Let's get back to /home/morpheus check for files that we can read or write to.
As you can see, there is restore.py python script, let's investigate!
The program makes a backup copy of a file, but uses a library shutil.
We can check if we have any read or write privileges on that library itself.
Let's check the first file
The user death is in group, so we can write into the file.
The best way to do it using the revshells.com again and generate a python payload! only copy the selected part of the payload like the following.
Go to this website : https://www.base64encode.org/
And encode our payload to generate the base64 payload.
Then insert the payload to shutil.py.
Open your netcat/pwncat listner, and wait for the shell.
Get the Flag!
Unintended Path - Get Root and other flags! ( Patched!!!! ) 😭
Since I didn't want this writeup to be long, let's try to get root and leave the rest of the users and other enumeration.
If we use id command we can see that our user lucien is in lxd group, we are in luck!
Use the following command on your own machine, to create an alpine image!
Then, upload to the vulnerable server the files lxd.tar.xz and rootfs.squashfs
Add the image:
Once done, if you see your image listed we are good to go for the next few steps!
If you find this error Error: No storage pool found. Please create a new storage pool
Run lxd init and repeat the previous chunk of commands
Execute the container:
Get Death Flag
Since you have the root permission you have the freedom to read any files of any users!
Get Morpheus Flag
Thank you for reading! 😎 Keep Learning & Happy Hunting! ❤️
Last updated
Was this helpful?