TryHackMe: DX1: Liberty Island

Nmap scan resulting 4 open ports.

See that nmap result for port 80 showing that there is robots.txt, let's check the web first and read the robots.txt. After exploring the web with available link there is no useful information and then accessing the robots.txt and got another path named /datacubes and user named Alex.

Accessing /datacubes and i got redirect to /datacubes/0000.

Notice the path named /0000, usually on CTF we enumerate path like this because there is a chance another path named 0075, 0731, etc. We can create the word list from number 0000 to 9999 using seq command.

Then let's enumerate this using ffuf.

See, we got another path! The interesting part is on 0451, it says the password using for logs in VNC is 'smashthestate' hmac'ed with a username and using md5 hashing algorithm.

Since the note ended with the initials of the author's name, -JL, I searched for names in the list of bad actors that contained J and L. Then i found name jlebedev and decide to try it first.

We got in! and there is our flag on file named user.txt, let's read it.

Since the VNC viewer is so laggy let's connect it with our terminal. First we need to set up our netcat listener and then run payload below from VNC.

On the Desktop folder there is executable file named badactors-list, let's download it to our local machine.

Running the file and we got this pop up below.

It's tried to connect UNATCO at port 23023, let's add this domain to our hosts then let's see the request using wireshark.

Select tun0 interface and filter it with tcp.port == 23023 && http, then re-run the file.

Following the request and found interesting things. There is header field called clearance-code and i think it's like token or key, and another interesting field is on body called directive and i think it's receiving a command, from the request, directive is receiving command cat /var/www/html/badactors.txt and the content are printed out below.

So i tried make a request with Clearance-Code with body directive and got this:

We are root!