Task 2 Enumerate
How many open ports?
How you redirect yourself to a secret page?
Main page shows that “use your Codename as User-agent”. One of the use’s Code name is Agent R therefore let’s assume all the Agent’s code name represent 26 letters of Alphabet.
So the Answer is user-agent
What is the agent name?
hint-You might face problem on using Firefox. Try ‘user agent switcher’ plugin with user agent: C
The given hint shows that changing the User-Agent in the request must redirect to another webpage.
First step is to capture the request via Burp and send it to the intruder to further investigation.
Then select the User-Agent and create a brute force attack which contain full English Alphabet
When its running Letter C, status code is Change to 302 which mean redirect
to another URL.
In the Response request has a variable call Location it has a URL
This is the message that shows in that URL
Task 3 Hash cracking and brute-force
In the above task we got the username and now we need run Brute force attack using Hydra to get the Password
Command → hydra -l Chris -P /usr/share/wordlists/rockyou.txt ftp://10.10.117.53
So The Password is crystal
Zip file password
Now we Have the username and the password.
Lets now login to the ftp server.
There are 3 file to download Run the Command Get <FILE_NAME>
In Hint it mention that Password is Hidden in the Image files.
Let’s use Binwalk to extract the images
After extraction of the image. There will be a Zip file protected by password.
Let’s use Zip2john to get the Hash of the Zip and using that we can crack the password.
Now we know the Password lets run the command 7z e <zip_file> to unzip the file
when it is unzip there will be a file call To_agentR.txt
When it is open you can see there is message for agent C a.k.a Chris
To_agentR.txt file had some encoded password. Using Cyberchef we can get the password for that.
Who is the other agent (in full name)?
We can use the password we obtain from the previous step to get the SSH password. Password hid inside the image. Using steghide secret massage can be extract.
Password is Hackerrules!
Task 4 Capture the user flag
Now Lets login to the system using SSH
there are 2 files in the James home DIR one is USER.TXT and another one is Alien_autospy.jpg
FLAG — b03d975e8c92a7c04146cfa7a5a317
Now let’s Download the that image using below command
scp username@<IP>:<FILE_NAME> <DOWNLAOD_PATH>
To find out the name of the Image article. we need to upload it to Google’s image search engine. This is the article that mention in the internet
What is the incident of the photo called?
Roswell Alien autopsy
Task 5 Privilege escalation
Lets Run sudo -l to find out what type of programs that James can run with SUDO privileges
The Sudo version That run in the James machine is 1.8.21p2. It’s a old version of sudo. lets try to find an exploit for this vulnerability
Doing some research in the google I was able to find an exploit for this, link is provided here
To get the root access need to run this command
sudo -u#-1 /bin/bash
CVE number for the escalation
What is the root flag?
(Bonus) Who is Agent R?