tomghost TryHackMe :- Walkthrough / Writeup

TryHackMe tomghost ctf room walkthrough ::

[embed]TryHackMe | tomghost Identify recent vulnerabilities to try exploit the system or read files that you should not have access to.tryhackme.com

— — — — — — — — — — — — — — — Here We Go — — — — — — — — — — — — — — — —

→ as usual first we gonna do a nmap scan

nmap 10.10.36.181

→ we found some ports open and some interesting services running like tomcat and version is 9.0.30

→ Lets visit the port 8080

just a default tomcat page

→ i run metasploit and search for tomcat 9.0 and found something interesting module

→ so i run this modules and found something interesting in it ..likely some credential

→ you can also try manual method

https://github.com/00theway/Ghostcat-CNVD-2020-10487.git

→ but ..we are gonna do it metasploit way

        skyfuck:8730281lkjlkjdqlksalks

→ out doubt is correct..i tried it on ssh and got

ssh shell

→ i found two file in the directory

→ i search for user.txt and found it

find . -type f -name user.txt 2>/dev/null

→ User.txt == THM{GhostCat_1s_so_cr4sy}

→ i just started a python server and downloaded those two file we saw previously in our system

→ We can try and brute force the tryhackme.asc file but first we have to convert this file using gpg2john.

gpg2john tryhackme.asc > hash

→we will use the rockyou.txt wordlist for the brute force attack..so we can get the password

john --wordlist=/usr/share/wordlists/rockyou.txt hash

→ here is the password for .pgp file …..here how we extract data from file …we gonna use these two commands

pgp --import tryhackme.asc
gpg --decrypt credentials.pgp

→ and i found Merlin credentials

merlin:asuyusdoiuqoilkda312j31k2j123j1g23g12k3g12kj3gk12jg3k12j3kj123j

→ lets login in the Merlin account

su merlin

→ its time to get root privilege access ..to i tried sudo -l command ..and found we can run zip as sudo ..so

→ so i utilize the gtfo bins to get root access

https://gtfobins.github.io/gtfobins/zip/

→ and we can read the root flag …as we become root

→ root flag = THM{Z1P_1S_FAKE}

THM{Z1P_1S_FAKE}

— — — — If it helps you ..give it a clap and follow me on social media — — — —

Twitter :- https://twitter.com/Archtrmntor

Linkedin :- https://www.linkedin.com/in/hitesh-sharma-413862245/