---
description: https://tryhackme.com/jr/compromisedcomms
---

# Compromised Comms

## <img src="https://2369203658-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFz2xPX14rAGJLwFTxqBy%2Fuploads%2F7T1QaI6EI3YXmU5krygr%2F5021023.png?alt=media&#x26;token=b00fef08-2a9b-40c7-bb64-1f616a149767" alt="" data-size="line"> COMPROMISED COMMS WRITEUP

_By Jacvbtaylor_

```
       Used openvpn and Kali Linux 
                 https://tryhackme.com/jr/compromisedcomms
         completed Jan 27, 2023
```

_"You will take on the role of a top-level agent tasked with uncovering a mole within your organization. The stakes are high, as a recent report has revealed that Agent Brian was found dead with a mysterious note reading "**921645**" in his jacket. To make matters worse, it has been leaked that he has been communicating with his Agent Handler through a seemingly innocent website, MACHINE\_IP. Your mission, should you choose to accept it, is to use your skills in forensic analysis, cryptography, and penetration testing to track down the mole who is responsible for taking down our Agents and how he potentially gained full server access. Good luck, agents!"_



### STEP 1: Recon

<figure><img src="https://2369203658-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFz2xPX14rAGJLwFTxqBy%2Fuploads%2F1QKShrCGghdQLMYYHr7a%2Fimage.png?alt=media&#x26;token=1dcf9e3a-e61c-40df-ba6c-db36131a9ffb" alt=""><figcaption><p>nmap</p></figcaption></figure>

With the information from the report, it is clear what the website is and that it is disguised for the Agent communication between the Assets, Agent, and the Agent Handler. Before viewing the website, running a scan to see additional services open will be important. \
\
From nmap, it is clear that there is a Webserver and Secure Socket Shell (SSH) access. Knowing SSH is open infers remote command line execution is allowed with the proper user credentials.

<figure><img src="https://2369203658-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFz2xPX14rAGJLwFTxqBy%2Fuploads%2FW23SNWFdooIYhSFPjs8u%2Fimage.png?alt=media&#x26;token=9c2ef807-981c-4a8c-8c6b-474f29f81956" alt=""><figcaption><p>Website</p></figcaption></figure>

Viewing the website running on the server shows nothing out of the ordinary. Most, if not all, of the buttons do not seem to work but the site functions smoothly and doesn't seem to have an CMS login - not one that stands out at least. \
\
Further investigation using a directory enumeration scanner, dirsearch, shows some directories and files worth taking note of.&#x20;

<figure><img src="https://2369203658-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFz2xPX14rAGJLwFTxqBy%2Fuploads%2F9oY3tt5nnsFYcBEkdwje%2Fimage.png?alt=media&#x26;token=fa51a3eb-b008-424e-ba56-eddcd33cc8e6" alt=""><figcaption><p>dirsearch</p></figcaption></figure>

The robots.txt file indicates a file that cannot be crawled, but this doesn't mean it cannot be viewed manually. It is clearly seen that there is a high chance of a secret.html file.

<figure><img src="https://2369203658-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFz2xPX14rAGJLwFTxqBy%2Fuploads%2FNbVoKFlF5jhzekfjqzgW%2Fimage.png?alt=media&#x26;token=3e27a803-f735-46de-ae2b-43b456e312fd" alt=""><figcaption><p>robots.txt</p></figcaption></figure>

As suspected, the secret.html file exists and has some interesting information. Why is this here and who's flight receipt is this?&#x20;

It will be beneficial to take note of this PII, or personal identifiable information.

<figure><img src="https://2369203658-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFz2xPX14rAGJLwFTxqBy%2Fuploads%2FNdwJ8QAlkIrBukUQ7hXu%2Fimage.png?alt=media&#x26;token=3d306fe9-5077-49bb-a82f-14e87b419eed" alt=""><figcaption><p>Flight Info</p></figcaption></figure>

Next up, the images directory does not have index browsing disabled and it is shown to have a random directory, DGI.

<figure><img src="https://2369203658-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFz2xPX14rAGJLwFTxqBy%2Fuploads%2FrE3rrK3Wt4OinrCSpXmG%2Fimage.png?alt=media&#x26;token=700d3052-c709-4baf-a914-1942e095007d" alt=""><figcaption><p>DGI</p></figcaption></figure>

Navigating to this directory shows more file inclusion, but specifically a random image.&#x20;

<figure><img src="https://2369203658-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFz2xPX14rAGJLwFTxqBy%2Fuploads%2FEGTM9spXTgBnlAUXiMGM%2Fimage.png?alt=media&#x26;token=ba32c2f3-dd7f-4a5d-9cbd-1b19ff54a0ed" alt=""><figcaption><p>NASA.jpg</p></figcaption></figure>

This image doesn't have anything to do with the website and seems very out of place. This is enough motive to investigate and is downloaded to the local machine using `wget`.

<figure><img src="https://2369203658-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFz2xPX14rAGJLwFTxqBy%2Fuploads%2F1mwIiGCyOmm8bVj5dS1r%2Fimage.png?alt=media&#x26;token=023b2ac7-d59b-4ef2-bbc0-6600f2271727" alt=""><figcaption><p>wget</p></figcaption></figure>

Inspecting the file, it is clear to be an image. Is it possible this image was placed here for a reason? Is it hiding crucial information? Only one way to find out.

### STEP 2: Attack

A common tactic used on images is steganography. Steganography allows for embedding text into an image by placing it in the least important bits in the photo. Viewing the photo, it is unclear there is a message because the change to that bit, or bits, isn't enough to change the image's appearance to the human eye, but there are tools that can be used to extract this information - assuming it exists.

Using _stegseek_ and _rockyou.txt_, the image spewed out a message after the passcode was discovered.&#x20;

<figure><img src="https://2369203658-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFz2xPX14rAGJLwFTxqBy%2Fuploads%2FyeDyfz1Io9b2FbJlxgOY%2Fimage.png?alt=media&#x26;token=a555ffe6-e757-4dfa-b768-ebfd01f2b365" alt=""><figcaption><p>stegseek</p></figcaption></figure>

This text looks like complete gibberish though. Was this a waste of time or is it an encrypted message?&#x20;

<figure><img src="https://2369203658-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFz2xPX14rAGJLwFTxqBy%2Fuploads%2FSPquJzmAqFImYec8jtZ0%2Fimage.png?alt=media&#x26;token=1b96cf60-d689-47ee-b04e-10de94329090" alt=""><figcaption><p>cyberchef</p></figcaption></figure>

Using Cyberchef, it becomes clear that this was in fact a hidden, encrypted message that had been encoded twice - once with Base85 and once with Base64. \
\
Seeing the message now in plaintext, it displays a file path. After adding the file path in the URL, the server now shows a login. \
\
There is not clear answer what the Username and Password are, but Agent Brian was using this channel and was found with a note. Using this information, it is worth trying his name and that message he left behind for the login..

<figure><img src="https://2369203658-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFz2xPX14rAGJLwFTxqBy%2Fuploads%2FQw7SpVjJWvBuCaXT5osj%2Fimage.png?alt=media&#x26;token=c51150e4-adf6-455d-96de-d41b524139bd" alt=""><figcaption><p>login</p></figcaption></figure>

Sure enough, it worked. There seems to be an old chat log now, with another possible encrypted message.&#x20;

<figure><img src="https://2369203658-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFz2xPX14rAGJLwFTxqBy%2Fuploads%2F9HhyNAX2D0RrUniy7mAD%2Fimage.png?alt=media&#x26;token=47db252d-ec00-4f20-8d8e-cc695b96937b" alt=""><figcaption><p>chat log</p></figcaption></figure>

Viewing the source code via the browsers allows for the encrypted message to be more accessible.&#x20;

<figure><img src="https://2369203658-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFz2xPX14rAGJLwFTxqBy%2Fuploads%2FdzUJFAV9rQeF8tdBLkj2%2Fimage.png?alt=media&#x26;token=b6c5383b-102d-4edd-bbef-63117b1976ed" alt=""><figcaption><p>source code</p></figcaption></figure>

Taking this message and using Cyberchef once more, there is more critical information that has been discovered using Base32 decryption - a password list and a username for SSH.

<figure><img src="https://2369203658-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFz2xPX14rAGJLwFTxqBy%2Fuploads%2FtFqOMLbHqhYVbRL2m6Do%2Fimage.png?alt=media&#x26;token=161fed5e-74f8-499b-a4d9-2ff387a80d00" alt=""><figcaption><p>Cyberchef</p></figcaption></figure>

Saving the password list and using Hydra to bruteforce, the password is discovered.

<figure><img src="https://2369203658-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFz2xPX14rAGJLwFTxqBy%2Fuploads%2FomvnquYnwegF9QbumIGL%2Fimage.png?alt=media&#x26;token=5afb0876-626c-4c74-98b1-826b4eef1a6e" alt=""><figcaption></figcaption></figure>

To ensure this is not a false positive, the login is attempted - and it works.

<figure><img src="https://2369203658-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFz2xPX14rAGJLwFTxqBy%2Fuploads%2FxGG8zHJAJ1wxLo73Jiuq%2Fimage.png?alt=media&#x26;token=15fe0a75-61ee-44dd-8f65-e35930c06626" alt=""><figcaption><p>SSH</p></figcaption></figure>

Inside the user's directory, a zip file is found: _Music.zip_

<figure><img src="https://2369203658-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFz2xPX14rAGJLwFTxqBy%2Fuploads%2FsSsx0xmBLPtRInPKPzZt%2Fimage.png?alt=media&#x26;token=ada531fb-98be-4444-ad01-5e14fd52ed86" alt=""><figcaption><p>Music.zip</p></figcaption></figure>

It is also password protected but the contents are displayed after an incorrect password is used. This appears to be information needed for the investigation.&#x20;

<figure><img src="https://2369203658-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFz2xPX14rAGJLwFTxqBy%2Fuploads%2FxIIR9Z38P3sp4kuM1TXV%2Fimage.png?alt=media&#x26;token=6e33fa19-765b-43ac-b1f5-7e76f6264dcf" alt=""><figcaption><p>incorrect password</p></figcaption></figure>

Since this low level user has to live off the land in this Linux environment, the only way to bruteforce the zip file is by creating a script:

<figure><img src="https://2369203658-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFz2xPX14rAGJLwFTxqBy%2Fuploads%2F0HjIQscpA3cBNXfdhqpV%2Fimage.png?alt=media&#x26;token=455dd114-10dc-420a-b871-bf7e1d14df0b" alt=""><figcaption><p>crack.sh</p></figcaption></figure>

After creating the script and changing its mode to be executable, it is then ran and the password is found almost instantly.

<figure><img src="https://2369203658-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFz2xPX14rAGJLwFTxqBy%2Fuploads%2FFQdYZgJYzbizlY4wwUWo%2Fimage.png?alt=media&#x26;token=07fb32ef-dcce-4703-a8e8-8f2675125470" alt=""><figcaption><p>Password found</p></figcaption></figure>

The contents are now freed but are unable to be concatenated. What does seem to work though is the _less_ command.

<figure><img src="https://2369203658-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFz2xPX14rAGJLwFTxqBy%2Fuploads%2FJmkEdAdbVyT8vBTFHz13%2Fimage.png?alt=media&#x26;token=e050fde8-b71c-489c-95c4-1f0f7648e05f" alt=""><figcaption></figcaption></figure>

After going through these files, more important information is found that will allow for cracking down on the Agency's mole.&#x20;

<figure><img src="https://2369203658-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFz2xPX14rAGJLwFTxqBy%2Fuploads%2F4QvjrhBMmwAHQdKmiZHS%2Fimage.png?alt=media&#x26;token=1d7cb560-754a-4229-9b69-5f2a180aff06" alt=""><figcaption><p>Email</p></figcaption></figure>

### STEP 3: Privilege Escalation

There is nothing else that can be done from this user, and it becomes clear that sudo will not be on our side.

<figure><img src="https://2369203658-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFz2xPX14rAGJLwFTxqBy%2Fuploads%2FxRtlDLRYMSuIwEvlzpPK%2Fimage.png?alt=media&#x26;token=cc4a65c7-722a-4a2d-acf1-bf79e6764552" alt=""><figcaption><p>Sudo</p></figcaption></figure>

Using the following command, this user is able to browse programs, or executables, that may have shared privileges with root

`find / -user root -perm -4000 -exec ls -l {} \; 2>/dev/null | awk '{print $9}'`

Once program stands out as it is not a standard Linux program.&#x20;

<figure><img src="https://2369203658-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFz2xPX14rAGJLwFTxqBy%2Fuploads%2F1JsbFvKbrzqSXehoiDpR%2Fimage.png?alt=media&#x26;token=5dba154c-6476-44c6-aef2-84ce8395a4d6" alt=""><figcaption><p>find suid</p></figcaption></figure>

The suid file sets the user and group ID of the running process to 0 (i.e., root) when the command '/bin/bash' is run at the same time.&#x20;

<figure><img src="https://2369203658-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFz2xPX14rAGJLwFTxqBy%2Fuploads%2FKolc2UxcVmyNP3qlffFg%2Fimage.png?alt=media&#x26;token=865abf25-cec1-4e0d-88e1-96c4a6f90c07" alt=""><figcaption><p>suid</p></figcaption></figure>

Once it is executed, the low privilege user is able to be root, with out a password or sudo privileges. This indicates the vulnerability the mole would have used to gain full server access.&#x20;
