Aster THM Room write-up

Medium room write-up

This is a medium-level CTF challenge where weʼre basically trying to hack into a server running a communications framework. As usual, the first move is to run an Nmap scan.

We found 4 open ports. I noted the service versions because even when it feels useless, it randomly becomes very useful later. Collect everything. Treat every little detail like itʼs a potential plot twist. Next, I checked port 80 to see what weʼre dealing with.

The site lets you download something, and when I hit download, I got a Python bytecode file: output.pyc . So yeah… we have to decompile it to see whatʼs inside.

Real talk: I didnʼt understand most of what I was seeing at first. But after decompiling, it looked like the code only prints a nice little HELLO banner. Except… the file also had some hex data that never gets printed. Good job, user “admin” the open source framework for building communications, installed in the server.] That line was the biggest clue I pulled out of the mess. The rest felt like “good work reverser three timesˮ energy. The condition if 0 is never true, so some parts just never execute. But that first hex chunk clearly meant something. At that point I switched tactics and decided to do some directory brute forcing with Gobuster to see if the web server was hiding anything juicy.

I found something interesting… so I decided to check /assets . Plot twist: it was a honeypot. So I ran another nmap scan on all ports and found something way more useful

Asterisk is running on port 5038. Thatʼs a solid way forward. To confirm it was real, I did a quick banner grab with: nc <ip address> 5038 …and got a response.

That confirmed the service was up and accepting connections. Now the mission was simple: log in. After some research, I learned Asterisk AMI is text-based, and you can talk to it with telnet or netcat. The version here was old, so I started with the classics common credentials. Also, remember the .pyc file literally leaked a username: admin.

The fails pushed me into brute force mode. So I wrote a quick Python script.

Donʼt forget to change the IP address.

After a short while, I got the password. Having the username already made life way easier.

Now the future was brighter. I needed a shell eventually, so first I checked what privileges I actually had. For AMI commands, I used an online cheatsheet (cheatsheets are basically legal superpowers). There were a lot of commands, but I wanted to find what I could run. I used core show help , and I found something very interesting.

These commands could reveal user details. When I ran the first one, I got a list of available users… and a password. Yeah…… That password helped me grab the user flag.

Not gonna lie… things were looking up. Using those creds, I got the first flag. One more to go. After logging in with what I found, there was another file waiting for me.

It was a Java archive. I unzipped it, and inside was a [.class] file (Java bytecode). You canʼt just open bytecode and expect it to confess, so I used an online decompiler. Nothing fancy, just decompile and read. Hereʼs the code I got:

The two most important parts here: *- It writes to /home/harry/root.txt

• It checks for /tmp/flag.dat* The condition is basically: “If /tmp/flag.dat exists, then write to root.txt **.ˮ Thatʼs it. No other validation. No sanity checks. Nothing. And since root.txt is something root controls, this becomes a logic flaw + privilege escalation opportunity. So the next move was simple: create /tmp/flag.dat , then run the code.

Yeah, donʼt mind the error. But when I checked the file afterward… we had control over root.txt . And inside was the flag I was looking for. This room was genuinely interesting. I learned a lot, especially about the Asterisk AMI service. I knew almost nothing going in, and now I at least know enough to be dangerous. Hope you enjoyed this.Aster THM Room write-up9