> For the complete documentation index, see [llms.txt](https://manav-g-krishna.gitbook.io/tryhackme-writeups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://manav-g-krishna.gitbook.io/tryhackme-writeups/dodge.md).

# Dodge

{% embed url="<https://tryhackme.com/room/dodge>" %}
Room Link
{% endembed %}

This work by Manav G Krishna is licensed under [CC BY-NC 4.0](http://creativecommons.org/licenses/by-nc/4.0/?ref=chooser-v1) <picture><source srcset="/files/4LZCTXtOnNYGloh03n9b" media="(prefers-color-scheme: dark)"><img src="https://chooser-beta.creativecommons.org/img/cc-logo.f0ab4ebe.svg" alt="" data-size="line"></picture><picture><source srcset="/files/NHzDv2ojIX6swyhLnsd3" media="(prefers-color-scheme: dark)"><img src="https://chooser-beta.creativecommons.org/img/cc-by.21b728bb.svg" alt="" data-size="line"></picture>

**`Machine IP`**: 10.10.3.234

**`Nmap Scan`**:

```python
nmap -p- -A -v -oN dodge_thm -Pn 10.10.3.234

Nmap scan report for 10.10.3.234
Host is up (0.50s latency).
Not shown: 65532 filtered tcp ports (no-response)
PORT    STATE SERVICE  VERSION
22/tcp  open  ssh      OpenSSH 8.2p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   3072 a0:ec:76:fa:35:6b:a3:76:c7:37:0a:83:3b:fa:e2:a7 (RSA)
|   256 48:aa:54:67:1c:48:19:5b:94:6d:ca:0a:dc:98:35:13 (ECDSA)
|_  256 2e:7c:9e:71:dc:59:ef:bd:c8:e6:f0:02:59:87:35:fb (ED25519)
80/tcp  open  http     Apache httpd 2.4.41
|_http-title: 403 Forbidden
|_http-server-header: Apache/2.4.41 (Ubuntu)
443/tcp open  ssl/http Apache httpd 2.4.41
|_http-title: 400 Bad Request
| http-methods: 
|_  Supported Methods: GET HEAD POST
| tls-alpn: 
|_  http/1.1
| ssl-cert: Subject: commonName=dodge.thm/organizationName=Dodge Company, Inc./stateOrProvinceName=Tokyo/countryName=JP
| Subject Alternative Name: DNS:dodge.thm, DNS:www.dodge.thm, DNS:blog.dodge.thm, DNS:dev.dodge.thm, DNS:touch-me-not.dodge.thm, DNS:netops-dev.dodge.thm, DNS:ball.dodge.thm
| Issuer: commonName=dodge.thm/organizationName=Dodge Company, Inc./stateOrProvinceName=Tokyo/countryName=JP
| Public Key type: rsa
| Public Key bits: 4096
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2023-06-29T11:46:51
| Not valid after:  2123-06-05T11:46:51
| MD5:   f130:c8c8:576c:7a0c:8adc:2b43:ea0a:4233
|_SHA-1: 8ed2:dbe0:71ed:cf13:c1a0:d02f:b68b:ec34:4ac4:a4aa
|_http-server-header: Apache/2.4.41 (Ubuntu)
|_ssl-date: TLS randomness does not represent time
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: specialized|storage-misc
Running (JUST GUESSING): Crestron 2-Series (86%), HP embedded (85%)
OS CPE: cpe:/o:crestron:2_series cpe:/h:hp:p2000_g3
Aggressive OS guesses: Crestron XPanel control system (86%), HP P2000 G3 NAS device (85%)
No exact OS matches for host (test conditions non-ideal).
Uptime guess: 3.200 days (since Sat Dec 30 08:09:27 2023)
Network Distance: 4 hops
TCP Sequence Prediction: Difficulty=251 (Good luck!)
IP ID Sequence Generation: All zeros
Service Info: Hosts: default, ip-10-10-3-234.eu-west-1.compute.internal; OS: Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE (using port 443/tcp)
HOP RTT       ADDRESS
1   246.05 ms 10.4.0.1
2   ... 3
4   502.33 ms 10.10.3.234

```

We have port **`22`**, **`80`** and **`443`** open. From the **`Subject Alternative Name`** field of the scan we notice that we have the main domain & it's subdomains.&#x20;

An other way to find this out instead of us waiting for the scan to complete is by accessing the site over HTTPS to view the SSL Certificate:

<figure><img src="/files/vyoolC2u7HuhYEhSxArs" alt=""><figcaption></figcaption></figure>

**`SSL Certificate`**:

<figure><img src="/files/l6hYgdBXskVblxUAE2hF" alt=""><figcaption></figcaption></figure>

**`Main domain`**: dodge.thm

**`Subdomains`**: [www.dodge.thm](http://www.dodge.thm), blog.dodge.thm, dev.dodge.thm, touch-me-not.dodge.thm, netops-dev.dodge.thm, ball.dodge.thm

Out of these we could access only: [www.dodge.thm](http://www.dodge.thm), dev.dodge.thm & netops-dev.dodge.thm. The rest were Forbidden.

<figure><img src="/files/VBRYdSDWOwrjXKqTTTrY" alt=""><figcaption><p>www.dodge.thm</p></figcaption></figure>

<figure><img src="/files/T9XpOs5RzH7EfitWsX91" alt=""><figcaption><p>dev.dodge.thm</p></figcaption></figure>

<figure><img src="/files/j3nov7Peayn2YigWlu1L" alt=""><figcaption><p>netops-dev.dodge.thm</p></figcaption></figure>

The [www.dodge.thm](http://www.dodge.thm) did not contain any information in its source code, and there were no specific versions of technologies used on this site that could be vulnerable to something.&#x20;

The dev.dodge.thm had the PHP Info Page.

The netops-dev.dpdge.thm was blank. But the HTTP title said: **`Firewall - Upload Logs`**. Upon checking the source code we find this:

<figure><img src="/files/rYJThfEORESaIT1wUFBD" alt=""><figcaption></figcaption></figure>

Two javascript files: **`cf.js`** & **`firewall.js`** are being referenced in this HTML code.&#x20;

The **`firewall.js`** sounds interesting. Checking this out revealed an endpoint named **`firewall10110.php`**:

<figure><img src="/files/OdaLHkp2DNA29iZm6j8d" alt=""><figcaption></figcaption></figure>

**`Accessing this endpoint`**:

<figure><img src="/files/z3ZvgMUT1D5XpxkFBF09" alt=""><figcaption><p>firewall10110.php</p></figcaption></figure>

In here we have a **`UFW Firewall`** configuration info along with an option that lets us run UFW commands.

**`Explanation of this configuration`**:

```javascript
Status: active: The firewall is currently active.

Logging: on (low): Logging is enabled at a low level, meaning events are being logged.

Default: deny (incoming), allow (outgoing), deny (routed):

Incoming connections are denied by default.
Outgoing connections are allowed by default.
Routed connections are denied by default.
New profiles: skip: New profiles are skipped, which could mean that when new network profiles are detected, they are not automatically configured, and you may need to set rules for them manually.

Rules:

Allow incoming connections on port 80 (HTTP).
Allow incoming connections on port 443 (HTTPS).
Allow incoming connections on port 22 (SSH).
Deny incoming connections on port 21 (FTP).
Deny incoming TCP connections on port 21.
Allow incoming IPv6 connections on ports 80, 443, and 22.
Deny incoming IPv6 connections on ports 21 and 21/tcp.
```

**`Note`**: These rules explicitly allow incoming connections on these ports despite the default policy being to deny incoming connections.

Since we can run commands we can modify these existing rules according to our needs.

**`Finding some blogs on using UFW Firewall commands`**:&#x20;

{% embed url="<https://www.digitalocean.com/community/tutorials/ufw-essentials-common-firewall-rules-and-commands>" %}

From our nmap scan we knew that we had ports 22, 80 & 443 open (due to the UFW rules) but not port 21 - FTP. We can modify this rule: **`21 DENY IN Anywhere`** to allow incoming connections to the FTP port.

**`UFW Command`**: **`sudo ufw allow ftp`**&#x20;

Upon running this command the rules got updated and now the Action is **`ALLOW IN`**  for FTP :

<div align="left"><figure><img src="/files/zpaAOkDjETwO1SA4riit" alt=""><figcaption></figcaption></figure></div>

&#x20;

<figure><img src="/files/vLm5gGBi9zDF9ewi9WMR" alt=""><figcaption></figcaption></figure>

**`Confirming that port 21 is open`**:

<div align="left"><figure><img src="/files/YCEdtL1uPO8SFzYhlDZb" alt=""><figcaption></figcaption></figure></div>

Now we can try to connect to the FTP server. The first thing we can try to do is an **`anonymous`** login, that is both the **`Name`** and the **`Password`** being **`anonymous`**.&#x20;

**`Confirming the same through an Nmap Scan`**:

<div align="left"><figure><img src="/files/XaucAyMtUiSmTIX6in2x" alt=""><figcaption></figcaption></figure></div>

**`Connecting to the server`**:

<div align="left"><figure><img src="/files/sj0P12daLVGxkuFZEJ3N" alt=""><figcaption></figcaption></figure></div>

**`Directory listing`**:

<div align="left"><figure><img src="/files/zSEAPmptrUWCTHIIVddV" alt=""><figcaption></figcaption></figure></div>

We have the contents of a users home directory. Now we can go ahead and get all the possible files from the server on our local machine using the **`get`** command.&#x20;

The **`.ssh`** directory had  these files:

<div align="left"><figure><img src="/files/XGz1zyDKIV9HIg4SSavR" alt=""><figcaption></figcaption></figure></div>

Contents that were successfully transferred from the server: authorized\_keys, id\_rsa\_backup

The public key (authorized\_keys) belonged to a user named **`challenger`**:

<figure><img src="/files/XoySFd93bAbqVmv133Xo" alt=""><figcaption></figcaption></figure>

We can now `SSH` in as **`challenger`** post changing the permission on the private key file (**`chmod 400 id_rsa_backup`**):

<figure><img src="/files/rOU9s0Khk0JRryrf30EK" alt=""><figcaption></figcaption></figure>

Currently we are in the home directory of  **`challenger`** where we get the user flag.

**`Checking users that have a console`**:

<div align="left"><figure><img src="/files/P2kAAcCVDDO4kTZfwSyh" alt=""><figcaption></figcaption></figure></div>

There is a user named **`cobra`** . We can try to find ways to become this user.

**`First way`**: ( This was how I initially got to **`cobra`**)&#x20;

Upon listing out active network connections (**`ss -tulpen`**/**`netstat -tulpn`**) on the machine we notice that there is something running on a couple of high ports on the localhost.

<figure><img src="/files/03OsjSnOgsOEyB05mrWz" alt=""><figcaption></figcaption></figure>

SSH Local Port Forwarding on port **`10000`**:&#x20;

Since we have the **`ssh`** utility on the box/machine we can also **`Remote Port Forward`** . But we'll be going ahead with **`Local Port Forwarding`**.

**`Command for Local Port Forwarding`**:&#x20;

```python
ssh -L 8989:127.0.0.1:10000 challenger@10.10.3.234 -i id_rsa_backup
```

Now we can access the service running on the port **`10000`** on our localhost on port **`8989`**

**`The site`**:

<figure><img src="/files/YzYTN6O63XKnT3YQOCIq" alt=""><figcaption></figcaption></figure>

Since the site had **`Apache`** web server running we could check the **`VHOST`** configuration info (**`apache2ctl -S`**):

<div align="left"><figure><img src="/files/GxcyOiD0KrojHiwaGKfq" alt=""><figcaption></figcaption></figure></div>

<figure><img src="/files/jMh23OIKn9xpLYyWYwcc" alt=""><figcaption></figcaption></figure>

We notice the **`10000`** port on the localhost. This confirms we port forwarded to the correct port.

**`The login page`**:

<figure><img src="/files/ZJNPC8Xq22SXNuZKpq0g" alt=""><figcaption></figcaption></figure>

**`Checking the source code of this login page revealed the creds`**:

<figure><img src="/files/h6me9mTIStFnzTaIBCBE" alt=""><figcaption></figcaption></figure>

**`After successfully logging in we land here`**:

<figure><img src="/files/d95EiivrmGyX4rXjrLJZ" alt=""><figcaption></figcaption></figure>

**`The Dashboard`**:

<figure><img src="/files/3qRWbh46poBgGGMoIq85" alt=""><figcaption></figcaption></figure>

We now have **`cobra's`** creds. It says it is for **`SSH`**.

Trying to **`SSH`** in wasn't working:

<div align="left"><figure><img src="/files/4ox0EgrSxXmcsfGR9fqW" alt=""><figcaption></figcaption></figure></div>

Now let's try to get in as **`cobra`** from the machine itself by using the **`su`** utility:

<div align="left"><figure><img src="/files/0ZoEXJNEbeipPPLcKd8m" alt=""><figcaption></figcaption></figure></div>

We got in!!

**`Second way`**: ( Easier way to get to **`cobra`**):

Navigate to the **`/var/www/notes/api`** directory and we find a **`base64`** content in the **`posts.php`** file ( We find this file upon **`cat`** ing out the **`.bash_history`** file in the home directory of **`challenger`**. In Bash, your command history is stored in a file ( .bash\_history ) in your home directory and in this case the command in the file was - **`cat posts.php`**. Running a simple **`find`** command on the **`posts.php`** will give us the path):

<div align="left"><figure><img src="/files/fga586wZ2fCxOw5RZcEU" alt=""><figcaption></figcaption></figure></div>

<figure><img src="/files/cbYLFapLNnXPXvRY6f3N" alt=""><figcaption></figcaption></figure>

Decoding the same gives us the creds of **`cobra`**:

<figure><img src="/files/ruL3lng9OLVKllSsNAAt" alt=""><figcaption></figcaption></figure>

**`Privilege Escalation`**:\
\
We can now check for **`cobra's`** sudo rights/privs:

<figure><img src="/files/vcqrvmRtcsg6vPRa6Awb" alt=""><figcaption></figcaption></figure>

The **`apt`** binary can be run as any user without us being prompted to enter a password. So we can run it with elevated privs to become **`root`**.

**`Searching in GTFOBins`**:&#x20;

{% embed url="<https://gtfobins.github.io/gtfobins/apt/>" %}

**`Command`**:

```python
sudo apt update -o APT::Update::Pre-Invoke::=/bin/sh
```

Now we are root and can fetch the root flag from **`/root`** directory:

<figure><img src="/files/yEiB5BoNNwhn1zTwEWyt" alt=""><figcaption></figcaption></figure>

Room solved!!

{% embed url="<https://tryhackme.com/p/gravereaper2038>" %}
Profile Link
{% endembed %}