Agent Sudo // TryHackMe Walkthrough

Agent Sudo // TryHackMe Walkthrough – powered by Happy Scribe

Welcome back to anothertry hack me walk through.

Today we’re focusing on agent pseudo

and we are going throughthis easy box together.

So let’s have some fun,let’s hack and let’s learn.

So I’ve already set up the box and we justmake sure that it is indeed live and we

can see it if someone’s ping packetingis allowed, which in this case we are.

So we’re on the VPN,we have a little welcome message.

Beautiful, thank you.

Good to be here.

So let’s enumerate, as we always do,

we want to go ahead and seewhat’s running on the system.

So I’m just going BV verbosity orverbosity see the output of our results.

And I am in the habit of just going to runall scripts and other things against it.

So we have three open here,so we can go ahead and check that in.

Next up, how you redirectyourself to a secret page.

So page like web pages.

We can see here we’ve got SSH,or is that yes, 21 FTP SSH and then 80.

Right?

So yeah, we can confirmthat once it’s done.

So we have 21 FTP SSH ison 22 and then 84 http.

Yes.Always got to remember our protocols.

They’ll eventually sink into my brain.

Let’s go with our roomand what it’s directing us to.

Let’s go to and here we go.

Dear agents, use our own code nameas user agents to access the site.

Sorry, how do we redirect ourselves?

And this is sort of showingus the way we need to go.

And that’s why I really like this box is

it sort of has these great checkins telling us which way to go.

So user agent is what we’re after.

What is a user agent?

So this is how the actual site knows whattype of device is visiting the site.

It’s probably a very simplified wayof explaining it,

but we’re currently in the browser,so it has a user agent of a browser.

If we were on a phone,we have a user agent of a phone.

So we need to essentiallychange our user agents.

What we can do is inspect to get our web,develop tools up and over.

On the right here we’ve gotthree dot icon.

We go to more tools and wego to network conditions.

Here we have what user agents we’re using.

So if I go by default,

we’ve got different browser user agent,we’ve got all different user agents.

But what we need to do here is actuallyhave ours as something unique.

So we can uncheck use defaultand then we can just put in our own.

So it took me a little bit of figuring

out, but if you go to this,it actually tells us here on the hint.

So yeah, cool.

If we hit that and then we can hitrefresh, we can see here agents

underscore attentionPHP has now popped up.

Attention Chris do youstill remember our deal?

Please tell me Agent J aboutthe stuff as soon as possible.

Also change your goddamn password.

It’s a week from Agent Doneand numerous the machine.

Time to brute your way out FTP.

All right, so let’s goback to our results.

Usually I do spend a little bit of timegoing through here, but since I have done

this box, I didn’t spend too much timein the video, so I apologize for that.

So the tool we want to useis going to be Hydra.

Okay?This is a tool so we can run that and we

can see a bit more information here,a bit of a help menu,

and we want to specify a fewconditions to break in via FTP.

At the moment,

if we were to FTP into this, we have Chrisusername, but we don’t have his password.

The hint here is brute forcing.It’s not really a hint.

They’re telling us how to get in.

So our hydro tool, we need a few things.

So first we need to specify our user,

which is Chris,and then we need to specify our password

list that we’re goingto pass through to it.

And I’m just going to go like this.

And then we want to make sure we go

v uppercase v to see the output,just like an N map, which is VV.

And then we can specify the IP that we’re

going to, and then the typeof protocol that we’re going through.

So the last thing is the amount.

I think this is tasks or threads,how fast essentially we can do it.

I think by default it’s at 16,

and we’ll actually see the output of this,but we can go much faster at 32, 64.

And I don’t really know if this is likehow limited this is for the tool,

or it just comes down to hardware,but I’ll go 64.

Okay, I didn’t actually get it.I had an error.

So I’m going to run it and I’m going

to change the task number and thenturn it back down to 32 this time.

All right.

And there we have it, our host, our login,and our password, so we can save that off.

And now we can go ahead and go into FTP asChris and type in our password of crystal.

Great.And now we’re in.

So we can list out everythinghere and we can see a few files.

So what we can do is run Mget to grab

everything, say yes three times,get everything, and then we can go ahead

and exit out of that and see what we’vegot and what we are working with.

Great.

So when it listed out,I like to run a file star.

So for all just to have a quicklook at what we’re going with.

So we have a JPEG image, we havea PNG image, and we have a text file.

So lowest hanging fruit.

Here is our text file.

Let’s go ahead and print that out.

Just remember to put crystal in here.

So we have a zip file password.

Zip file password.Interesting.

So what we’ve copied, we don’tactually have any zip files.

So this is, I guess, a clue.

There should be something in here, right?

So let’s read our message.

Dear Agent J,all these alien look photos are fake.

Agent R store the real picturesinside your directory.

Your login password is somehowstored in the fake images.

It shouldn’t be a problem for you.

All right, so next up is somehowwe need to examine our images.

So if we go over to what they actuallylook like, we can see them here.

We need a tool to look at them properly.

So this is where I needed to cheat a bit

and find a tool because Icouldn’t find one straight away.

So bin walk was what I found.

This is able to walkthe binary of our files.

So we can see here by runningthat we have our help menu.

So we can have bin walk options and thenfiles if we just write bin walk.

And then we’ve got our two files.

So we got a JPEG and a PNG.

So if we go to that JPEG for one,

we can see here that thisholds no other information.

It’s just the image.

Okay, so let’s try again,this time looking at the PNG.

Okay, first we see our image.

But next, well, look whatis indeed hidden in here.

So we can see a zip archive file thatlooks like there’s a text file in there.

Crazy.

So if we go through the man page orthe Help page again, we can find,

I believe it’s E for extract,and we can run that.

Okay, let’s just see ifwe indeed got anything.

So running LS again does giveus underscore PNG extracted.

So let’s go.That is a directory so we can CD into it

and we can see here,indeed, we have our files.

So let’s see if there’sanything else hidden in there.

Let’s run file against everything.

So we’ve got our Z lib compressed,our zip archive data at least.

So this really got me for a while.

I was like, okay,we see that there’s nothing in the zero

bits of information in our textile,which is pretty interesting.

So our focus is here.

We can try and cap this stuff out,but it’s all encrypted or compressed,

or we can’t actuallymake anything out of it.

So we need to do something else.

We can indeed, if we lookat a hint, we see Mr.

John.Mr.

John being a great tool.

So we can actually run zip to John, and wecan run that against a zip file there.

And what that’s going to do is actuallypull out the hashes that we need to crack.

If we actually run that,but then output it into a new file.

So we can just call this, like, hash.

If we go and look at that hash filehere’s, everything in that zip format,

then it’s as simple as just runningJohn against that hash file.

So you’ll see something different, becauseI’ve already actually cracked this.

It’s already saved.

And you will indeed see on your screenthe zip file password that is alien.

So, great.

Now we’ve got our password that wecan actually get into our file.

So if we run and you mightneed to download seven zip.

So if you pseudo apt install and then go

seven zip, and this is how we’reactually going to look at the file.

And then we can run sevenZ and E for extract.

And we actually run itagainst our 3650 lib.

And we go, yes.

What’s our password?

Well, we just cracked it.

We can type that in, which was alien,and then we get something interesting.

If we look at our file all again,

we’ll notice that our text file,which had no data that was indeed empty,

this was zero bits, and this wasjust no data, now has 86 bits in it.

We actually have some ASCII text.

So if we go and cut that out here,we have agency.

We need to send the pictureto something as soon as possible.

All right, so this is our next clue.

We need to do something with this so we

can actually throw this into a hash valueand we can find that this is base 64.

So what we can do is echo that and pipe itthrough a base 64 Tool and then decode it.

And here, indeed, we have our Area 51.

Great.

So what do we do now?

Well, we have a password.

And if we remember that,we had another image.

So if we can see here,let’s go back to that image,

let’s CD back, and let’s actually unlockthe password using something for stag.

So after a bit of research,

I found Steg Hide was the toolthat we were looking for.

So we want to extract from this JPEG image

the data that’s hidden in here,so we can run it using SF.

So it’s just specifying the filethat we want to open, which is our Jpg.

And then we want the password,which, as we just got, was Area 51.

Look at that rate.Extracted data to message TXT.

So we list out our files here.

We have our message TXT.

Let’s go ahead and run that.

And indeed, we get our second name, James.

All right, glad you found you.Find this message.

Your login password is hackerrulls.

SSH password.

Don’t ask me why the password look cheesy.

Ask Agent R to set this passwordfor you, your buddy, Chris.

Okay, so now it’s telling us where to go,which in this case is SSH.

And we are going to be loggingin as James with our new password.

That we found of hackerrulls explanation.

Mark all right, it’s task four,capture the user flag.

You know the drill.

So we’ve successfully SSHedinto and we have two things.

The user flag.Great, that’s easy.

Let’s go and cut that out and grab that.

Next, what is the incidentof the photo called?

So, in order to get this photo and open it

up, I’m not sure how to do itwhen we’re SSH if we can do it.

So what we can do in turn is wecan actually just copy this over.

So if we go back to our terminal,we can run secure copy,

we can use the R and we can log into Jamesand we can log in at our IP address.

And we need to specify usually we go like

home James because this is wherethe file is that we want to get.

But in this case,if you just leave it blank,

it’s the directory, and then this isthe directory that we want to copy it to.

Password is hacker rules.Cool.

So that’s copied over everything,including the images, what we’re after.

I had a bunch of trouble with this.

So this is the recursive switch that I’ve

just used because this is the onlyway I could get it to work.

But hey, it does the trick.

So now we’ve copied over our JPEG,

we can just navigate thereand we get this creepy image.

Now, this image didlook a little familiar.

I’m like.I swear I’ve seen this.

And if we look at our hints,it says to reverse image and Fox News.

So I’m like, okay,this is an article somewhere.

So I was recently just watchingand posting video on David Bumble’s

channel, and they actuallyrecommend Bing search.

So there is some use for Bing.

So if we plug in this image,we can start to see some similar results.

And it’s a pretty common image.

So the first thing I saw herewas most famous UFO hoax.

I was like, okay, that’sprobably where I’ve seen it.

So if we look up Fox News alien hoax,

we can see here we havethe Roswell alien autopsy.

So this is the Fox News articlethat they’re referring to.

Great.So that’s just a little bit of fun.

That doesn’t actuallylead anywhere further.

So next up, we’ve got taskfive privilege escalation.

Time to get real.

So CVE number for escalation.

So this really stumped me.

I had no idea what to do,

but I remembered from the last capturethe flag I did running

L with the pseudo command willshow up indeed what we can run.

And when we run that,we can actually run bin bash.

So with a bit of a search of exploit bin

bash, we can find indeed,we have a security bypass for Sudo 1827.

Now, I only knew this because I’vedone other capture the flags.

I’m not sure how else to discover this.

And we can indeed confirmthat this is the right one.

It says here that we can take advantage ofit by simply running the exploit of this.

So if you copy that into a terminalthat indeed switches us over to root

change directories into our route,we can indeed see our root text.

So if we go and cat that out, we have to.Mr.

Hacker, congratulationson reading this box.

This was hackney, blah, blah, blah.

Your flag is this.

We can submit that and we have indeed

the creator of the boxHell as our last bonus.

So there we go.There was agent pseudo trihack me room.

I hope you enjoyed this, I hope youlearnt something along the way.

This was actually one of my favorite CTFsbecause I did cheap and I really

tried to get through it and I foundthe flow of this room to be really good.

I enjoyed the hints.

They didn’t give too much away.

They also weren’t too mysterious that you

didn’t quite understandwhat you needed to do.

So there was a good balance betweenbeing challenging and enjoying.

So I’m excited to go on to more tria rooms

that are of this sort of qualityin this sort of format.

So, yeah, if you like this sort of thing,please let me know

if you have any questions or any issues,anything did make sense, please ask.

I’ll do my best to answer.

Otherwise, if you would like to subscribe,that would be awesome.

I have a monthly newsletter if you’d like

to subscribe to that, which I talk aboutcybersecurity and my learning path.

So there’s some good info there.

Otherwise, please reach out overTwitter if you would like to chat more.

Always keen to get to know otherpeople learning inside security.

So, with all that being said,

have a wonderful day and Iwill see you in the next one.

Bye.