---
description: https://tryhackme.com/room/takedown
---

# Takedown

## <img src="https://3936681470-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FnIgZXZIzELG3uuesvgXc%2Fuploads%2F9nEGBXBZvgWK8iANjbPs%2Fimage.png?alt=media&#x26;token=12eb361f-7867-4ab4-893d-96c13784f4f4" alt="" data-size="line">TAKEDOWN WRITEUP

_By Jacvbtaylor_

```
       Used openvpn and Kali Linux 
                 https://tryhackme.com/room/takedown
         completed Oct 2, 2022
```

{% embed url="https://youtu.be/PwNNomQEApU" %}

**SITUATION** \
Cyber Criminal operations cell RISOTTO GROUP is suspected to be active in Area of Operations (AO). 501st operators are tasked with intercepting RISOTTO GROUP, regaining control of a target webserver, and removing opposing force from target infrastructure.

**MISSION**\
Identify indicators of compromise of the INFINITY webserver Regain positive control of the INFINITY webserver Prosecute and deny RISOTTO GROUP operators Produce proof of positive control of the target webserver (user.txt and root.txt)

### STEP 1: Recon

Using my [nmap ](https://github.com/jacvb/nmapscript)script, I located 2 open ports:

<figure><img src="https://3936681470-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FnIgZXZIzELG3uuesvgXc%2Fuploads%2FkiD2Tc1Qz21RvvfUzIcf%2Fimage.png?alt=media&#x26;token=dabb9246-1db2-4366-bf1b-e80becf63036" alt=""><figcaption><p>nmap</p></figcaption></figure>

I pulled up the webpage and started an enumeration scan to look for interesting files and folders. using `gobuster dir -u http://takedown.thm.local/ -w /usr/share/dirbuster/wordlists/directory-list-2.3-medium.txt`

Almost immediately I was able to locate what may be an interesting file:

<figure><img src="https://3936681470-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FnIgZXZIzELG3uuesvgXc%2Fuploads%2FpyWmm5qzYDTNX53XnqX4%2Fimage.png?alt=media&#x26;token=d6129935-b48f-4055-913a-f6b41b3e2917" alt=""><figcaption><p>email.php</p></figcaption></figure>

This led to to find http://takedown.thm.local/js/main.js which referenced mailchimp. This won't be useful to me I discover a database set up for the site, or possibly an email address hiding inside some of the code which could lead me into a better direction.&#x20;

With some help from local file inclusion in the `/images` directory, I was able to find an ELF file called shutterbug.jpg.bak on the server. This is one of the malware samples from the debriefing PDF we were given before starting the CTF.&#x20;

<figure><img src="https://3936681470-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FnIgZXZIzELG3uuesvgXc%2Fuploads%2FEpcqaaB4NRyp68l8AOA2%2Fimage.png?alt=media&#x26;token=9e895ee4-7da6-451b-93c8-132e9bbd1f3d" alt=""><figcaption><p>LFI</p></figcaption></figure>

<figure><img src="https://3936681470-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FnIgZXZIzELG3uuesvgXc%2Fuploads%2F8GqBTDeW6v4YWgo7jUDD%2Fimage.png?alt=media&#x26;token=b100e645-d180-4090-99a5-8dd0605c7bcf" alt=""><figcaption><p>malware</p></figcaption></figure>

I uploaded the file to Virus Total and analyze.intezer.com and got confirmation that the file was malicious

<figure><img src="https://3936681470-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FnIgZXZIzELG3uuesvgXc%2Fuploads%2F0cA7KIaelO77cinyRgq0%2Fimage.png?alt=media&#x26;token=d8737735-659e-4533-a990-61a0ddec2553" alt=""><figcaption><p>virus total</p></figcaption></figure>

I ran the file in my VM and some emojis spewed out

<figure><img src="https://3936681470-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FnIgZXZIzELG3uuesvgXc%2Fuploads%2FOZ4MLQV9nHsrJgPP0DZZ%2Fimage.png?alt=media&#x26;token=1225e59f-16f8-441d-974c-742c012ade66" alt=""><figcaption><p>shutterbug</p></figcaption></figure>

<figure><img src="https://3936681470-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FnIgZXZIzELG3uuesvgXc%2Fuploads%2Fd9VwAQvW4jiNDew2Sgk5%2Fimage.png?alt=media&#x26;token=712741be-f07f-4ef8-bdb4-3096ca75e585" alt=""><figcaption><p>options</p></figcaption></figure>

I chose to examine that file a little further and found some human readable text inside referencing exe files in windows and kali and leaves me a little curious as to what else this may be used for.&#x20;

<figure><img src="https://3936681470-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FnIgZXZIzELG3uuesvgXc%2Fuploads%2FaKgKL43ZXcb95dHQ83TW%2Fimage.png?alt=media&#x26;token=4f8bc378-39cc-446e-b61b-89e71ff0718c" alt=""><figcaption><p>exe</p></figcaption></figure>

I started gathering more information on the file to see if I could figure out what its purpose was

<figure><img src="https://3936681470-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FnIgZXZIzELG3uuesvgXc%2Fuploads%2FjtV413MhAFT5kSC1mjlA%2Fimage.png?alt=media&#x26;token=e4b7339e-a1f7-4fc4-866a-c279ccb61cbb" alt=""><figcaption><p>readelf column</p></figcaption></figure>

Looking at the strings I noticed something interesting:&#x20;

<figure><img src="https://3936681470-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FnIgZXZIzELG3uuesvgXc%2Fuploads%2FJfUqlyCmGdtCV9XGom2d%2Fimage.png?alt=media&#x26;token=5ffda888-cc42-439f-b2f5-bd037e47a2b6" alt=""><figcaption><p>C2</p></figcaption></figure>

The URL `http://takedown.thm.local/api` is referenced but the server doesn't respond back with that directory when I request it. The 5th line in the screenshot above references `/api/ag[*]` which didn't mean much to me at first, but later I noticed another string

<div align="center"><figure><img src="https://3936681470-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FnIgZXZIzELG3uuesvgXc%2Fuploads%2FemtDwIGCMXBikWTpC41j%2Fimage.png?alt=media&#x26;token=af948036-b0ce-45be-bbf9-7c9fe7c47b77" alt=""><figcaption><p>agents</p></figcaption></figure></div>

first being `user-agent`, `agent source/destination` as well as the `/agents/` directory. The robots.txt file wasn't disallowing certain user agents, but that doesn't mean some other form of code isn't set up to do so.&#x20;

<figure><img src="https://3936681470-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FnIgZXZIzELG3uuesvgXc%2Fuploads%2FCR5LieN1K0MGqIcQo8HC%2Fimage.png?alt=media&#x26;token=0eb8edb9-f59f-4f33-b86e-0b241e26c943" alt=""><figcaption><p>mozilla</p></figcaption></figure>

### STEP 2: User-Agent Exploit

My current user agent references my Linux VM, and the remote server response with a 404 error

<figure><img src="https://3936681470-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FnIgZXZIzELG3uuesvgXc%2Fuploads%2FeQPRhvbkkbAF02GMkwMt%2Fimage.png?alt=media&#x26;token=7f9b0c8e-2775-4abb-aebb-4534028c8b36" alt=""><figcaption><p>404</p></figcaption></figure>

If I edit this to the UA I found in the ELF file and send that packet to the server, I get server code 200

<figure><img src="https://3936681470-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FnIgZXZIzELG3uuesvgXc%2Fuploads%2FACFFq40vrzdZsbBueR70%2Fimage.png?alt=media&#x26;token=d25cde91-3e66-4523-b04c-c349bd81c3a3" alt=""><figcaption><p>200</p></figcaption></figure>

When I forward my packet with the modified UA, I am now able to see the receive `/register` page, or at least some form of it.&#x20;

<div><figure><img src="https://3936681470-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FnIgZXZIzELG3uuesvgXc%2Fuploads%2FrO9BiSKeyT0RaO23qZbb%2Fimage.png?alt=media&#x26;token=3e32e28d-94d4-4460-a6a9-f6004d4d028b" alt=""><figcaption><p>register</p></figcaption></figure> <figure><img src="https://3936681470-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FnIgZXZIzELG3uuesvgXc%2Fuploads%2FCmtv5USWcU5DsdxmLN3h%2Fimage.png?alt=media&#x26;token=00491f2d-0ba7-4772-9db4-fe93382887df" alt=""><figcaption><p>live agent</p></figcaption></figure></div>

The source code doesn't reveal anything so I intercepted the web traffic with Wireshark, but nothing seemed helpful there. Instead of going back and forth with Burpsuite to edit my user agent, I installed a[ firefox extension ](https://addons.mozilla.org/en-US/firefox/addon/user-agent-switcher-revived/)to spoof it for me and starting playing around with my URL from the browser. I really wanted to fuzz for files and directories but wasn't sure how to go about this while needing the custom UA, so manually changing the URL was my only current option.&#x20;

<figure><img src="https://3936681470-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FnIgZXZIzELG3uuesvgXc%2Fuploads%2FmeC3TRDqnFWrWR9AN7cu%2Fimage.png?alt=media&#x26;token=b85de78c-b3ee-4067-954d-d904c4c94d04" alt=""><figcaption><p>/agent</p></figcaption></figure>

when treating `agents` like an endpoint or file inside the `api` folder, the server responds with more information. A UID and hostname.&#x20;

<figure><img src="https://3936681470-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FnIgZXZIzELG3uuesvgXc%2Fuploads%2FUZwM41cKVNm3JWVfwURR%2Fimage.png?alt=media&#x26;token=77ecca69-3646-42cf-8504-7e8d02abf39c" alt=""><figcaption><p>dqpk</p></figcaption></figure>

<figure><img src="https://3936681470-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FnIgZXZIzELG3uuesvgXc%2Fuploads%2FtakC5GpJGTznZhCTSrJc%2Fimage.png?alt=media&#x26;token=61707447-dada-47b0-807a-36d327cf9af4" alt=""><figcaption><p>www</p></figcaption></figure>

I wasn't sure where to move from here, so I stepped back and thought about what else I was possibly missing. I found the user agent from the shutterbug file, but that isn't granting me as much access as I would like. User agent wasn't disallowed from the robots.txt file but favicon.ico was.. and the PDF debriefing mentioned the favicon file as Gunrunner malware. Can I get that file as well?  I ran `wget http://takedown.thm.local/favicon.ico` and it downloaded successfully.&#x20;

<figure><img src="https://3936681470-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FnIgZXZIzELG3uuesvgXc%2Fuploads%2FhmQ9NvBbPrNXxD29fj8L%2Fimage.png?alt=media&#x26;token=8a1a2dfb-09a6-491f-a2be-eb7025160cf7" alt=""><figcaption><p>favicon</p></figcaption></figure>

### STEP 3: Exploring Favicon

The favicon file appears to be a windows executable. I may be able to get all of the information I need from it, similar to how I extracted information from the shutterbug file.&#x20;

<figure><img src="https://3936681470-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FnIgZXZIzELG3uuesvgXc%2Fuploads%2FO2KKWEn8OI6loMDlVLgs%2Fimage.png?alt=media&#x26;token=7fbb3764-d2ca-4147-8bfe-568a3578333a" alt=""><figcaption><p>strings</p></figcaption></figure>

So far it seemed to interact very similar, if not the same, to the shutterbug file. It was giving me seemingly the same information. Both of these files appear to work as some sort of proxy. This file was easier to read though and seemed to lay out what seem to be commands&#x20;

<figure><img src="https://3936681470-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FnIgZXZIzELG3uuesvgXc%2Fuploads%2FprQ2CjwyO0cj2xmFv6A4%2Fimage.png?alt=media&#x26;token=4f4eefde-bbab-4a50-b440-7c1edfd4c9c5" alt=""><figcaption><p>commands</p></figcaption></figure>

I requested the commands file and was actually served the commands I could use

<figure><img src="https://3936681470-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FnIgZXZIzELG3uuesvgXc%2Fuploads%2FNCgHeV4mSESS05yXe9aq%2Fimage.png?alt=media&#x26;token=e5ce4214-c5bc-40f6-b8ba-014317384340" alt=""><figcaption><p>/commands</p></figcaption></figure>

This confirms l should be able to access or interact with the following directories:&#x20;

* /commands
* /upload
* /download

### STEP 4: Access Webserver

I made various attempts at running these commands, trying to get a different output from the server, but wasn't having any success. I went back to Burpsuite to see if I could further manipulate my packet.&#x20;

I found that each time I was served "You're not a live agent" I was actually being served 401 unauthorized. My aim was to stay within the status 200 bounds. What I hadn't tried yet was changing my type of request. If I want to tell the server what to do, I need to escape my GET requests.\
\
&#x20;I looked at an example of a [POST ](https://developer.mozilla.org/en-US/docs/Web/HTTP/Methods/POST)request and edited mine appropriately inside Burpsuite's repeater, or so I thought. I wasn't getting a response back from the server, so I canceled my request and looked into what I could try. This is when I came across[ json content-type](https://reqbin.com/req/zvtstmpb/post-request-example). This seemed promising since I could enter my own text into a field using brackets.  As long as I can figure out the right URL path and/or content to send to the server, I should get a proper response.&#x20;

After reading up on json a bit, I saw syntax examples such as {"name":"john"} and tried to see how I could play with this.  Mostly of my attempts got status 400 responses:

<figure><img src="https://3936681470-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FnIgZXZIzELG3uuesvgXc%2Fuploads%2FcXhpUTNUfYzMtDJOADMJ%2Fimage.png?alt=media&#x26;token=9af38d34-dd0e-48bf-a14f-e22d21119d2e" alt=""><figcaption><p>bad request</p></figcaption></figure>

I requested /api/agents/upload and wasn't having any luck. I tried user the UID I found earlier in my URL before upload and referencing the command layout in the favicon file, I saw upload and file. &#x20;

`@/upload` \
`@/api/agents/` \
`@file` \
`@ from C2 server` \
`@[*] Ready to receive`

Since I was already requesting the upload in my URL, I added file in my json syntax and tried requesting all of the files.

`{"file":"*"}` This was making the server timeout and give me a 500 error. Does this mean it worked? Did I overload the request? I tried a known Linux file `/etc/hosts` instead&#x20;

<figure><img src="https://3936681470-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FnIgZXZIzELG3uuesvgXc%2Fuploads%2FhqGSVX3l8xsU7pzUEBIU%2Fimage.png?alt=media&#x26;token=08a7f404-1350-4534-90a6-d68599aee66f" alt=""><figcaption><p>*</p></figcaption></figure>

This worked! I noticed `172.20.0.7 c2-shrike-1` inside the host file. Not sure if I'll need this information, but I kept note of it. I used this opportunity to try and get as much information as I could before ultimately attempting to use the download and exec command&#x20;

<div><figure><img src="https://3936681470-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FnIgZXZIzELG3uuesvgXc%2Fuploads%2FqAC0P53QhEPp45sDzupO%2Fimage.png?alt=media&#x26;token=854158a8-e104-4b87-adbb-2f61f61e8500" alt=""><figcaption><p>hosts</p></figcaption></figure> <figure><img src="https://3936681470-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FnIgZXZIzELG3uuesvgXc%2Fuploads%2FFVVNx7pn61c1f5FYmZvw%2Fimage.png?alt=media&#x26;token=62c82855-c210-40cd-8b58-791a6bd78359" alt=""><figcaption><p>users</p></figcaption></figure></div>

I wanted a shell to the machine, so I decided to try and use the exec command through the URL.

`/api/agents/tupc-jfpa-jfqb-zlri/exec` &#x20;

<figure><img src="https://3936681470-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FnIgZXZIzELG3uuesvgXc%2Fuploads%2FpmOToRDQttjck6AwyXKS%2Fimage.png?alt=media&#x26;token=78636b43-e385-4c88-842b-94de816485b3" alt=""><figcaption><p>burpsuite</p></figcaption></figure>

_(It is worth noting that each time this VM is rebooted, you are assigned a new UID and IP that you need to update in the `/etc/hosts` and get from the `/agents` "file" in order to process your POST request properly)_

After many failed attempts, I eventually got in:

<figure><img src="https://3936681470-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FnIgZXZIzELG3uuesvgXc%2Fuploads%2FxJBYN7K2WIYK1zr1Aqih%2Fimage.png?alt=media&#x26;token=67b20825-8c95-477e-ad87-204f9ac47d42" alt=""><figcaption><p>exec command</p></figcaption></figure>

With this server access, I was able to reach and read the first flag

<figure><img src="https://3936681470-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FnIgZXZIzELG3uuesvgXc%2Fuploads%2FV8JKtwsYInO8dif8HFmQ%2Fimage.png?alt=media&#x26;token=334979ef-1ee7-4538-aa74-740c05834706" alt=""><figcaption><p>user.txt</p></figcaption></figure>

### STEP 5: Become root

My user doesn't seem to have sudo privileges so escalating privileges may be just as much of a challenge as it was getting into the C2 server as this low level user

<figure><img src="https://3936681470-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FnIgZXZIzELG3uuesvgXc%2Fuploads%2FHY5oYYKd0Sml0r11KaFS%2Fimage.png?alt=media&#x26;token=33468ae6-34b7-42ab-939f-1c5b80be3008" alt=""><figcaption><p>sudo</p></figcaption></figure>

I started off by running `find / -perm -u=s -type f 2>/dev/null` to see if there was any SUID privilege escalation I could attempt, but nothing was going to work without having sudo. I was not sure how I was going to get escalated privilege yet. I navigated through the file structure and could not find anything that I could use. I knew there was a Docker container running from the directory enumeration I had done previously but was denied access to list the docker containers, but can I list the regular processes running?&#x20;

I ran `ps aux` and saw the name of the docker container, but I also noticed an interesting folder in `/usr/share/`&#x20;

<figure><img src="https://3936681470-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FnIgZXZIzELG3uuesvgXc%2Fuploads%2FEv07KLTmKwIiBY6u1nKS%2Fimage.png?alt=media&#x26;token=6d09d223-b33d-4211-8eba-f75355cddc56" alt=""><figcaption><p>ps aux</p></figcaption></figure>

It took me a second to navigate into this folder:&#x20;

<figure><img src="https://3936681470-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FnIgZXZIzELG3uuesvgXc%2Fuploads%2FHVLwGtf5MHRMPyA5eMSS%2Fimage.png?alt=media&#x26;token=a4c01850-8344-41f1-927a-a43a9f65b243" alt=""><figcaption><p>svcgh0st</p></figcaption></figure>

svcgh0st is an ELF file, but I am not sure I can interact with it while stuck in this reverse shell. Since this odd file was currently running, I attempted to kill all of the processes associated with the `diamorphine_secret` folder but was stuck with one still running. This folder wasn't shown in the /usr/share/ folder, but I was able to navigate to it once I knew the name. This wasn't adding up too much, so I searched the name and came up with a [GitHub ](https://github.com/m0nad/Diamorphine)page referencing this:\


<figure><img src="https://3936681470-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FnIgZXZIzELG3uuesvgXc%2Fuploads%2Fqv8ETM50tBKbrc5SEB7t%2Fimage.png?alt=media&#x26;token=3754e037-cbbb-4a1a-9d77-8c85d0ea75d3" alt=""><figcaption><p>kill command</p></figcaption></figure>

I was not use to killing signals as opposed to processes, so what I was doing wasn't working at first. I briefly referenced this page [here ](https://www.educba.com/linux-kill-signals/)for some basic information and then another one [here ](https://man7.org/linux/man-pages/man7/signal.7.html)that says the signals go up to 64. \


<figure><img src="https://3936681470-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FnIgZXZIzELG3uuesvgXc%2Fuploads%2FNf2j9oUqKQ82jmclyPDW%2Fimage.png?alt=media&#x26;token=cf4fc976-90d1-49c3-8aff-a3406aa80f94" alt=""><figcaption><p>signal 64</p></figcaption></figure>

I referenced the GitHub page one more time and read the following:

_"Diamorphine is a LKM rootkit for Linux Kernels 2.6.x/3.x/4.x/5.x and ARM64_

### _Features_

* _When loaded, the module starts invisible;_
* _Hide/unhide any process by sending a signal 31;_
* _Sending a signal 63(to any pid) makes the module become (in)visible;_
* _Sending a signal 64(to any pid) makes the given user become root;_
* _Files or directories starting with the MAGIC\_PREFIX become invisible;"_

So I killed that signal, and I was root.&#x20;

<figure><img src="https://3936681470-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FnIgZXZIzELG3uuesvgXc%2Fuploads%2FIBPkpe99TqSHnctd22hx%2Fimage.png?alt=media&#x26;token=758492b5-3f3f-4bd5-a215-ad511c929a69" alt=""><figcaption><p>root</p></figcaption></figure>

