TomGhost(CTF)

Ahengjnr

7 min readJan 12, 2024

Well today I’m going to try to pwn the Tomghost(CTF) on tryhackme

WISH ME LUCK!!!!

so lets start the box ….

well it looks like we have to find user.txt and obtain root.txt from this machine lets start ..

recon

first lets start with recon ill scan the IP with nmap to see the possible services running on the target .

after the scan we see that 5 ports on the machine is opened and in the second scan port 8080 is running a web-server , so lets visit the web page

we can see that the server is running Apache Tomcat/9.0.30

lets do a quick google search to see if this version of tomcat is vulnerable

when i used searchsploit there wasn't any vulnerability for this specific version of tomcat

so lets try exploit db or lemme just stick to my initial plan of using a simple google search

well when i do a google search it shows that the version is susceptible to an exploit so i go to exploit db and search for the Apache tomcat version

so it turns of the exploit is related to metasploit or its metasploitable

I then start the postgresql service

and start metasploit

then with the “show options” command i checked for the required options

NB: I’m unfamiliar with the “/WEB-INF/web.xml” so i asked chat gpt for some help here

so then after the explanation chat gpt gives i have a fair explanation of what the XML file is used for its basically a deployment descriptor which is used to configure settings for a web application server and it also provides metadata about the web app to the container or application server during deployment.

now back to business..

I set the RHOST variable to my remote host and then run the exploit

and as you can see in the <description> section of the XML file there there are some credentials and we can attempt to SSH into the machine with these credentials

and we are in !!

time to look for the user.txt flag

we can simply look for it manually or just use the find command

we can use this command:

sudo find / -type f -name “user.txt” 2>/dev/null

okay that didn't work seems there isn't any file on the system called user.txt

but then theres “credential.pgp” and “ tryhackme.asc“

i have no idea what these extensions are used for

so im going to ask AI again

so turns out these extensions have something to do with some sort of digital encryption.

WAIT!

turns out i made a mistake with the prompt “instead of “pgp” i typed in “gpg” which is wrong

gotta ask the big boss again (“CHAT-GPT”)

so even tho the prompt was wrong the AI gave close to the real response

since “.pgp” basically pretty good privacy and also has to do with digital encryption

right now how to decrypt these files is the hassle we need to do a bit of research into this

So ..

we need to install a tool called GnuPG

Or hopefully the compromised machine has the tool built in already since the tool is used to do the encryption

so then i figure out my way around the whole GnuPG tool

but then i ran into a part where I’m supposed to input a password a password ..that i dont have so then i think id have to crack the key one way or another because as you can see from the screen shot above i tried to decrypt it using the tool but then no key appeared

so now im trying do transfer the files onto my machine and crack this thing

first start a python webserver in the directory and then downloading the files to my machine

we need to get the key out of the “tryhackme.asc” file (ASCII-armored) we can use

gpg2john tryhackme.asc > hash

so we can see that its turned into a hash now we can crack it

oh wait i forgot to show the previous format before using “gpg2john”

this is how it looked

now that we have a better format we can attempt to crack the hash using johntheripper

john — wordlist=<location of prefered wordlist> hashh

and now we have the username and password

now lets import the key again and try our cracked password when the prompt appears again

okay it worked !!!!

we have a user called merlin and another hash we need to crack

guys so guess what that wasnt a hash it was the password but looked like a hash wasted a couple minutes to try to crack the password that looked like a hash

we are in !

and we've found the first flag !!

nowwww

onto the next challenge

GAINING ROOT ACCESS TO THE MACHINE

so from teh image above we can see that the user merlin isnt allowed to run /bin/su as root but can ran /usr/bin/zip as root meaning he has SUID permission now how to use this to gain root access

if you dont know SUID is you can read on it here

https://securiumsolutions.com/privilege-escalation-with-suid-in-linux/

and following the steps in the image below we have escalated to root

how does this work ?

If the binary is allowed to run as superuser by sudo, it does not drop the elevated privileges and may be used to access the file system, escalate or maintain privileged access.

and can be abused using these commands

TF=$(mktemp -u)
sudo zip $TF /etc/hosts -T -TT 'sh #'
sudo rm $TF

now to find the root.txt flag

using the find command we can use

sudo find / -type f -name "root.txt" 2>/dev/null

As you can see we used the find command to get the root.txt and we got the second flag.

the end !!!

we pwned the box!!

TomGhost(CTF)

Written by Ahengjnr