DEV Community

Frank A
Frank A

Posted on

TryHackMe Brains Challenge Walkthrough

#cybersecurity #tutorial

So this is the Brains room on TryHackMe. Its a two part challenge, you hack into a box (red team) and then you investigate what happened (blue team). Pretty cool combo actually.

Here's my video walkthrough if you wanna follow along:

Part 1: Hacking the Box

First thing, start the machine and grab the IP address. Then open a terminal and run nmap to see whats available:

nmap <target-ip>
Enter fullscreen mode Exit fullscreen mode

You'll see three things open:

  • Port 22 (SSH)
  • Port 80 (HTTP)
  • Port 50000 (something weird, looks like a database but its not)

If you go to port 80 in the browser its just a blank page, nothing there. You can run gobuster to discover hidden folders and files on it but trust me, waste of time, there's nothing.

The interesting one is port 50000. Try connecting with telnet:

telnet <target-ip> 50000
Enter fullscreen mode Exit fullscreen mode

Hit enter a few times and you'll see it returns HTML. So its actually a web server not a database. Open it in Firefox:

<target-ip>:50000
Enter fullscreen mode Exit fullscreen mode

You'll see TeamCity running. Note the version number, in this case 2023.11.3.

Finding the Exploit

Go to exploit-db.com and search for "TeamCity". You'll find a bunch of vulnerabilities, the one we want is the authentication bypass / remote code execution one. Note the CVE number and search for it on GitHub.

I used the exploit from wolf hacker. Copy the code, save it as a .py file. When you run it you might get a missing module error:

pip install faker
Enter fullscreen mode Exit fullscreen mode

Then run the exploit pointing at your target:

python exploit.py -t <target-ip>
Enter fullscreen mode Exit fullscreen mode

If it works youll get a shell. Test it:

whoami
Enter fullscreen mode Exit fullscreen mode

You should see something like "ubuntu". Then check the home folder:

ls /home/ubuntu
Enter fullscreen mode Exit fullscreen mode

Youll find a flag.txt, cat it out:

cat /home/ubuntu/flag.txt
Enter fullscreen mode Exit fullscreen mode

Thats your first flag, machine hacked.

Privilege Escalation

While your in there check what you can run as sudo:

sudo -l
Enter fullscreen mode Exit fullscreen mode

In this case everything is allowed which means you can just do:

sudo whoami
Enter fullscreen mode Exit fullscreen mode

And youll see root. Thats it, full privilege escalation. Pretty easy one but good to practice the concept.

Part 2: Investigation with Splunk

Now close that machine and start the second one (the blue team box). Put the new IP in your browser and youll see the Splunk interface.

Go to Search and Reporting. Start with a broad search to see everything:

index=*
Enter fullscreen mode Exit fullscreen mode

Set the time to "All Time" and search. Youll see around 4000 events.

Question 1: What plugin was installed after exploitation?

Just search:

index=* plugin
Enter fullscreen mode Exit fullscreen mode

Youll see an event about a plugin being uploaded. The full name is right there in the log, copy it.

Question 2: What malicious package was installed?

Search for:

dpkg
Enter fullscreen mode Exit fullscreen mode

Then filter to look through installed packages. Youll see loads of normal Linux stuff, lib this, lib that. Keep going through the pages and youll spot one called "data-collector". Thats the dodgy one, nothing legit should be called that.

Question 3: What is the backdoor user?

Search for:

useradd
Enter fullscreen mode Exit fullscreen mode

Youll find an entry where useradd was run with the username "evil-user" and a home folder to match. Yeah not subtle lol. Thats your answer.

Done

Thats the full Brains room. Red team side you exploited a TeamCity auth bypass to get a shell and escalated to root. Blue team side you used Splunk to find the plugin, the malicious package and the backdoor user that the attacker left behind.

If you want to practice the Linux commands used in this walkthrough check out https://practicelinux.com

Top comments (0)