TryHackMe | Lian_YU Walkthrough
Introduction
TryHackMe room Lian_Yu is based on the Arrow TV show. This room involves steganography, enumeration, and Privilege escalation. You can access this room here.
Reconnaissance
Scanning the IP address with nmap
nmap -sS -sV -A <THM-ip>
As we see there are 4 ports open on the target machine (21,22,80,111) as there is port 80 open so checked out the webpage.
Scanning
Running gobuster against the target to discover web directories
gobuster dir -u <THM-IP> -w /usr/share/wordlists/Seclists/Discovery/DNS/subdomains-top1million-20000.txt
The results showed a web directory /island. Seclists GitHub linked below.
Checking /island directory
There is much useful information here so checking the source code.
Found a hint vigilante which might be helpful in later stages.
Again ran gobuster brute forcing on /island directory
gobuster dir -u <THM-IP/island> -w /usr/share/wordlists/Seclists/Discovery/DNS/subdomains-top1million-20000.txt
The results showed a directory by the name /2100. Checking the IP/island/2100 directory.
Nothing useful here so let's look at the source code.
Here is a hint that there might be a hidden directory .ticket
Running gobuster again but now with specific parameters i.e. -x to specify the file extension.
gobuster dir -u <THM-IP> -w /usr/share/wordlists/Seclists/Discovery/DNS/subdomains-top1million-20000.txt -x .ticket
this showed that there is a directory by the name of /green_arrow.ticket. This showed some random text.
This was a BASE58 encoded string. On decoding it resulted in something can potentially be used a password.
!#th3h00d
We saw that there was a FTP service on port 21. So let,s try to login using the credentials we have found.
ftp <IP> 21
username -vigilante
password- !#th3hood
looking around found some images that could have some data hidden within them.
Downloading the images to the host computer.
looking around we see that there is another user Slade
Steganography
using steghide to extract the hidden data within the image.
steghide extract -sf aa.jpg
It needs a passphrase so used the stegcracker tool Bruteforce the password
stegcracker aa.jpg /usr/share/wordlists/rockyou.txt
Successfully cracked the password
Using the password extract the hidden data and checking the files.
Looks like shado file data is a password.
As we have an ssh service also, let's try to login into that with username — slade and password — M3tahuman
And Voila!!!! we logged in successfully
Privilege Escalation
Now we need to escalate our privileges to the root user to get the final flag.
Checking what commands we can run with root privileges
sudo -l
Here we see we can run the pkexec command with root privileges . checking GTFObins for priv-esc command.
sudo psexec /bin/sh
AND finally, we have the flag.
If you found this helpful consider leaving some claps :)
