Troll 1 is an intentionally vulnerable Linux VM that is said to have been inspired by the constant trolling
of the OCP labs.
The goal with this.
As with all of the other intentionally vulnerable beams to gain root access to the system.
This was a really fun challenge for me and it's excellent to help prepare for the relentless trolling
of the OCP and similar CTF challenges.
That being said I've converted troll 1 2 over a format so you can download it from a google drive double
click the overlay and import it to virtual box.
Make sure that you have host only network configured and hop on Kelly Linux and we'll get started with
enumeration
as with all the others let's find the ip address with net discover
IP address and handlers run our IMAP scared
as you can see from the map scan output.
We have FTB over port twenty one SSA age over port twenty two and Apache web server over port 80.
Now the first thing I want to check is FTB because I see anonymous log in is allowed and we have access
to this file.
Ella will not peak at so I'm just going to clear this out.
And since this is a new Kelly box we're going to have to install FTB so apt get install FCP
okay once the installation is done we can FTB using the IP troll 1 and the user name of Anonymous and
password of Anonymous.
OK there there's the ELO about pick out file and was going to type.
Get a little peek at.
Here we go.
Downloaded it to kelly quit exit at TV.
Now I'm going to use teh CPD dump to analyze the cap TCB dump is the command line only protocol analyzer
and sniffer.
Similar to wire shark but it does not have the graphical user interface or gooey as they call it.
So I prefer to use TCB dump because it's faster does not rely on the gooey.
It is built into most Linux OS is by default and I like grep and command line you can use wire shark
if you want but this how I'm going to look at it.
So TCB dump hyphen and empty DDT eh.
Ah well not pea cap type the less.
So what this does it it tells TCB dump not to resolve ports to names changes the time format prints
ASCII payload and reads the ELO all not P can't file typing it to less the hyphen s our switch cleans
up any non ASCII characters
okay we see FTB traffic it's using the default port for a DP which is twenty one looks like we have
a version of BSF TBD.
Three point zero point two.
We have a log in that occurred with user anonymous password of password
a directory listening.
Looks like a password secret underscore stuff out text.
They use the retrieved command to download that so for those that are familiar riff with FCP it's plain
text.
So if something is downloaded the contents of the text file will be present within the payload during
the file transfer.
Let's go down a little bit
okay.
Here is the contents of the text file secret underscore stuff not text.
Here it is.
It says you almost found the super secret durable well.
So perhaps that's an accessible Web directory.
We know that port 80 is open so let's just copy that and go to Firefox and try to access that directory.
If it does exist game just going to open up Firefox and I will type in the IP address of troll 1.
Just put in that string that we recovered from the cat file.
OK.
We have some sort of file here.
Take a look at it.
So binary file so I'm just going to save that
go to our terminal suppose out of that.
And I'm going to take a look at that file we just downloaded and the downloads folder.
There it is.
I'm just going to type file in the name of this file here.
OK.
It's a Linux executable so I'm just going to give it executable permission for a quick would see each
mod plus X and just execute that to see what happens.
OK.
Prince and message find.
Address
0 0 8 5 6 B F to proceed.
OK we'll see if that is also a web directory.
I'm just going to copy that.
Go back to Firefox
OK.
So I have two folders here
Kay.
I have a file here.
Looks like the list of user names.
Possibly scores just copy those I'm going to go
create a file usernames
space those are
OK.
This folder contains the password.
We have a file name named pass DOT text and contents.
Good underscore job underscore.
OK
so now that I have this information I'm going to try using Hydra which is a brute forcing tool to try
to brute force SSD because I remember that port twenty two is open from analysing the results of the
IMAP scan.
So let's just go here to a terminal
I'm going to type Hydra hive an L usernames it's going to utilize that usernames password that I just
created.
And if you paid close attention to the wording it says this folder contains the password not the file.
So I'm going to use the file name as the password instead of the contents of the file.
So that would be passed up text which was the name of the file.
OK.
Also the IP address of troll 1 specify SS H and only use one thread
okay.
And fortunately Hydra has failed.
So we are going to try a different tool named habit war which appears to be better for brute forcing
as a sage in my experience.
So I'll show you where to get that now.
She's going to hop over to Firefox and go to this github page.
Copy this.
Your well here a clone it.
So get clone just paste that you URL
just change to that directory.
There it is.
Python script
now I'm going to run this command where it's going to do is launch pad a tour ignoring Python warnings.
It will set the target to the IP address of troll 1.
Set the user name as a word list which was brute user names a file that we just created and the password
is passed on text.
So let's give that a shot.
OK so every user name has responded with a message of authentication failed except for the user overflow.
This tells me that I should be able to SSA in with the user name overflow and password of past text.
So let's just go ahead and put that to the test.
As the sage overflow at IP address of troll 1.
The password was pass DOT text.
Very good we're at
OK.
Now I'm going to check out.
We have
Jay kernel is three point 1 3 0 says time's up Elwell.
So I guess it disconnects us what it feels like.
So just reconnect to that.
OK.
So we have to move fast.
OK.
So we have the version 14 0 4 and the kernel is three point one three.
So I'm going to check for any privilege escalation exploits related to that kernel and version of a
boot to Linux.
So back to Google search we're going to search for food to 14 0 4 privilege escalation three point 1
3
k.
We have found one that fits all of that criteria.
Here it is going to just click on that one and view raw copy all this text here.
I'm going to open a new window.
I'm going to go to your Web root and Kelly Linux because we need to use WD get.
So I'm just going to name that file 3 2 3 7 2 9 2 dot C. paste all that text.
Now let's start Apache so service Apache to start
that war has a.
And we will go to the temp directory if you get IP address of Kelly Linux and the name of that file
is
like want to use DCC to compile it.
So GCSE its file name output file name.
Just name it.
3 7 2 9 to give it executable permissions.
C H My plus x 3 7 2 9 2.
Now we should be able to execute that hopefully get root privileges.
All right.
Very good.
Looks like it work.
Just go to the root directory here.
Got our flag.
All right privilege escalation is pretty easy on this one.
We've got root privileges and we can now move on to the next challenge.