Home Brooklyn Nine Nine
Post
Cancel

Brooklyn Nine Nine

img-description From the famous comedy show Brooklyn Nine-Nine comes a very sweet challenge dubbed by the same name. This is a beginner level CTF at TryHackMe that aims to improve the basic pentesting skills.

Here comes my walkthrough.
Go ahead and start the Machine.
img-description
Starting from the basics, hit that CTRL + U and view the source code. As highlighted, we see our first hint. Steganography!

Steganography is the art of concealing information within non-text data like images.

That being discovered, let’s save the background photo and see if there’s more within it.
img-description

Let us now do some Nmap scanning and see what ports are open and ideally the services running on them.
A very basic scan gives us three ports and their services, 21 - FTP, 22 - SSH, 80 - HTTP img-description
Interestingly, anonymous login is allowed on port 21 and there is a note to Jake.
Let us go for the hanging fruits first. FTP!
img-description
The fruits are indeed sweet, we already know that a weak password is in use.
Time for Hydra? Well, Not yet. Let us focus on the hint we found.
Another tool - Stegcracker comes in handy. Using this tool we are able to extract any information embedded within the image.
This is not straight forward as the information is password protected. We have to put in some work and bruteforce using the wordlist rockyou.txt img-description
That was successful. We have creds.

It is time to explore port 22. SSH. img-description We have our user flag 💪

Now we have a foothold and we need to escalate the privileges inorder to retrieve the root’s flag.
Issuing the command sudo -l shows that Holt can run /bin/nano without a password.
GTFO Bin comes in handy here.
img-description

Running the payload lands us in root’s paradise. Syntax:

1
2
3
 nano
 ^R^X
 rest; sh 1>&0 2>&0

img-description

To make the shell more interactive, we use the payload python3 -c 'import pty; pty.spawn("/bin/bash")'. This gives us a bash shell.

The flag is in the root’s directory

That was fun!

This post is licensed under CC BY 4.0 by the author.