|You are here|
[Task 5] Stage 5
Stage 5 is now ready to be brute in. Deploy the machine and start capturing the flag. Please terminate the previous VM before deploying a new one. The theme for this stage is the Apache2 strike back and OSINT.
Prerequisite: Complete stage 4 and obtain the hostname.
Here are some of the tips:
- You are going to need a network scanning tool (Nmap). Just do a fast scan with ping skip (
nmap -Pn -p- -v -T5).
- Brute your way in.
- Find someone on social media(s)
- Do forensic
- Stay calm and have fun
Refer to the hints if you are stuck or DM me in my discord channel if you are really stuck. Once again, good luck with the challenge.
Stage 6 challenge will be released on 11/11/2019, UTC time. Stage 6 is now up!.
#1 - Flag 61
A nmap scan reveals that ports 80 and 9999 are opened. Connecting to port 9999 will need nowhere as we haven’t been provided with a port knocking sequence at the previous level. Let’s start with port 80.
Connecting with http://10.10.12.221/ shows the genuine Ubuntu Apache2 welcome page, there is no robots.txt and dirsearch discovers some hidden resources, but all in 403 (forbidden).
Let’s try the virtual server host name found at stage 4 (
# echo "10.10.12.221 roadtoroot.com" >> /etc/hosts $ curl -s http://roadtoroot.com/ <p>Welcome to my second hidden server</p> <p>Enjoy the stego? I Guess yes</p> <p>Take this as my personal reward</p> flag61: 73a0u8asqeeki7ashcv2
#2 - Flag 62
There is a
robots.txt file that reveals hidden locations and a flag, but we will keep that for later flags. For now, let’s perform a scan.
$ gobuster dir -w /data/src/wordlists/directory-list-2.3-medium.txt -u http://roadtoroot.com/ =============================================================== Gobuster v3.0.1 by OJ Reeves (@TheColonial) & Christian Mehlmauer (@_FireFart_) =============================================================== [+] Url: http://roadtoroot.com/ [+] Threads: 10 [+] Wordlist: /data/src/wordlists/directory-list-2.3-medium.txt [+] Status codes: 200,204,301,302,307,401,403 [+] User Agent: gobuster/3.0.1 [+] Timeout: 10s =============================================================== 2020/05/25 11:52:32 Starting gobuster =============================================================== /.htaccess (Status: 403) /.htpasswd (Status: 403) /.hta (Status: 403) /execute (Status: 301) /PI (Status: 301) /TW (Status: 301) /grasshopper (Status: 301) /server-status (Status: 403) /TB (Status: 301) =============================================================== 2020/05/25 12:13:06 Finished ===============================================================
There is an interesting
/grasshoper/ directory that reveals SSH credentials:
$ curl -s http://roadtoroot.com/grasshopper/ <p>Are you ready to root the machine?</p> <p> SSH username:</p><br> <img src="user.png"/><br><br> <p> SSH password</p><br> <img src="pass.png"/><br><br> <p>Where is the SSH port?</p> $ wget http://roadtoroot.com/grasshopper/user.png $ wget http://roadtoroot.com/grasshopper/pass.png
These symbols are Pig Pen that we can decode with https://www.dcode.fr/chiffre-pig-pen-francs-macons:
/execute/ directory reveals our flag:
$ curl -s http://roadtoroot.com/execute/ <p>Bruteforce...bruteforce.....bruteforce......never end</p> <p>tired of bruteforce? How about we play something new</p> flag 62: mylug980r9axzn6fvrl0 <a href=hello></a>
#3 - Flag 63
There was an interesting empty link found previously (hello). Let’s find out what this is:
$ curl -s http://roadtoroot.com/execute/hello $ wget http://roadtoroot.com/execute/hello $ file hello hello: ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=d60d036bb75aaecb6abb396eb02d30558daaaa36, for GNU/Linux 3.2.0, not stripped $ chmod +x hello [email protected]:/data/documents/challenges/TryHackMe/CTF_100/files$ ./hello I'm noob in C Take this flag63: mubxspokswhcqr8aj6e5
#4 - Flag 64
Time now to analyze the
$ curl -s http://roadtoroot.com/robots.txt | html2text Disallow:* /TB /PI /TW flag 64: ekvtyrcwshbl3hkwkzsh
Several locations are found, that we will analyze just after, but flag64 is revealed here.
#5 - Flag 65
Hint: A cipher name starts with B
We have found the
/TW directory in the
robots.txt file. Let’s check it:
$ curl -s http://roadtoroot.com/TW/ <p>This is a social networking site that relies on micro-blogging for communication<p> <p>user: @65_6f</p> <p>flag65: aqvdsfiaphmynifgjylz</p> <!-- The flag is encrypted, the cipher name starts with B and the key is flag -->
The hint (
This is a social networking site that relies on micro-blogging for communication) and the username (
@65_6f) relates to Twitter. There should be a Twitter account for this user, but we keep this for the flag 67.
Cipher starting with B (https://en.wikipedia.org/wiki/Category:Classical_ciphers):
- Bacon’s cipher
- Beaufort cipher
- Bifid cipher
- Book cipher
- Thomas Brierley grave cipher
Use https://cryptii.com/pipes/beaufort-cipher to decrypt it with
flag as key.
#6 - Flag 66
Hint: A cipher name starts with A
$ curl -s http://roadtoroot.com/PI/ <p>Pins are visual bookmarks that you collect on boards</p> <p>user: gsnwpwp_</p> <p>flag 66: gfpi7hadqleilk4ycb58</p> <!-- the username is encrypted, the cipher name starts with a -->
Ciphers beginning with A:
- ADFGVX cipher
- Affine cipher
- Alberti cipher
- The Alphabet Cipher
- Alphabetum Kaldeorum
- Arnold Cipher
- Āryabhaṭa numeration
- Autokey cipher
It was Atbash cipher. Use CyberChef to decrypt the username:
#7 - Flag 67
Googling for the decrypted username (
thmdkdk_) leads to https://www.pinterest.fr/thmdkdk_/, likely an account created for this puzzle (0 followers). It discloses several directories with 1 picture for each:
|Places to Visit||Just an ordinary number: 28817|
These pictures will be used for later flags.
Just take note of the number disclosed by “Places to Visit”:
28817. This is one of the sequence number for the final question.
#8 - Flag 68
Remember that we discovered a Twitter acount (
@65_6f) at question 65. Time to check what we can find there: https://twitter.com/search?q=%4065_6f&src=typed_query.
There are several posts:
6d 65 6d 65 20 6c 6f 72 64 @65_6f · Oct 4, 2019 Solve this, I dare you AVGFCTSWPDUNRKQELMBQEGUWZK ----------------------------------------------------- 6d 65 6d 65 20 6c 6f 72 64 @65_6f · Oct 4, 2019 I got a number from the creator. 44414 Well, what the hell is this? ----------------------------------------------------- 6d 65 6d 65 20 6c 6f 72 64 @65_6f · Oct 4, 2019 Not bad, you found me. The ultimate meme lord. REEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE flag 68: o0no5s3qmo7wymnagnwv ----------------------------------------------------- 6d 65 6d 65 20 6c 6f 72 64 @65_6f · Oct 4, 2019 mode: CBC size: 128 VI: youcomingthisfar SK: thisisroadstossh Type: hex16
- The 1st post is an encrypted string that we will use for the next question
- Take note of the number disclosed on the 2nd post (
44414). This will be used for the final question.
- The 3rd post is our flag
- The last post refers to AES, we’ll keep this for the final question.
One of the post reveals flag 68:
#9 - Flag 69
Hint: Get the four square image to solve the cipher text
Putting the other pictures together makes a four square. Decrypt the flag with https://www.dcode.fr/four-squares-cipher:
#10 - Flag 70
Hint: A cipher name starts with C
robots.txt file was also revealing another location, which reveals flag 70:
$ curl -s http://roadtoroot.com/TB/ <p>This is a micro blogging site. In addition, you can have your own domain.</p> <p>user: vnvnuxammt</p> <p>flag 70:rqi51dlh6b67q0v7qhmc</p> <!-- The username is encrypted, the cipher name starts with C -->
Ciphers beginning with C:
- Caesar cipher
- Copiale cipher
Using brute force, we find that the user
vnvnuxammt decodes to
memelorddk with an offset of +9. We will use this username for the next flag.
#11 - Flag 71
Notice that the
robots.txt file disclosed 3 directories, and each name is a reference to a social media website:
- TW: Twitter (
6d 65 6d 65 20 6c 6f 72 64which decodes to
- PI: Pinterest (
- TB: ???
TB refers to Tumblr. Linked with the username found previously (
memelorddk), we can find the following page with the same avatar: https://memelorddk.tumblr.com/
There are 2 posts, 1 of which being the flag.
Secure or unsecure? 22B16ABDFBF26BB880807FEF53CEF1017936EE5309A85B2AD1E9D99B2E6F8BCE96BFA11061AA4D26E79B7A9DA72AD58F ----------------------------------------------------- Good job OSINT is the way to go flag 71: r9yu4uhd013misdl058q
#12 - Port to stage 6 (Format: PORT PORT PORT …)
We already gathered 2 ports:
For the last port, let’s use the information found on Twitter to decode the hex string. You can use https://www.devglan.com/online-tools/aes-encryption-decryption:
Encrypted: 22B16ABDFBF26BB880807FEF53CEF1017936EE5309A85B2AD1E9D99B2E6F8BCE96BFA11061AA4D26E79B7A9DA72AD58F mode: CBC size: 128 VI: youcomingthisfar SK: thisisroadstossh Type: hex16
The last port is
The full sequence is:
28817 44414 39914.
NOTES * Note 1: the order will be
39914 28817 44414 for for the next stage, as suggested by the hint Note 2: no idea at this stage what the SSH credentials are for (the ones found with the gobuster scan) * Note 3: don’t forget to remove the entry
roadtoroot.com from your