Link:	https://tryhackme.com/r/room/valleype
Difficulty	Easy
Machine	Linux

---

This is an easy challenge of THM rated at 120 minute.

Enumeration

#

So I started the box I first scanned with NMAP.

NMAP

#

Found two services running on most common default port.

On website this was the interface I was greeted with:

So then I started enumerating the directory

Found an unusual directory so I checked it!

Hmm seems like a hint remove /dev123.... Lets check it out

Woah! a login page with client side authentication lets see where it redirects to.

Hmm a interesting note.

• stop reusing credential hmm… remember those client side authenticated user and pass?
• hm and it says change ftp port to normal

Scanning All Ports

#

Lets start scanning the all the possible port using Nmap. we can use -p- option to check all the possible port which is 0 to 65535

Hmm~ This must be it the ftp server he mentioned in abnormal port.

Lets try to login with the creds that we got in JS file.

:) Logged In!

Analaysing PCAP File

#

Lets download those files and see what it contains!

So after digging up the PCAP file one by one I found another interesting creds.

I am using this website called apacket.com which nicely shows the http connections and other connections in a good friendly UI.

So lets try to use that cred in SSH!

Ok we logged in and we got our user flag. yay!!! Noice ~

Now Lets see what we got more in this machine lets try to enumerate so we can get a privilege access. I find there is a strange file named valleyAuthentication

Lets pull that bad boy in our machine and analyse.

Scan it up !

Reversing The Binary

#

Hmm UPX compressed elf binary huh! lets decompress it :D

Ok now its ready to be analysed!

Found some hash its a md5 hash (I know it cause the binary contained md5 string)

Lets decrypt it

So we now know username: valley password: liberty123

Privillege Escalation

#

Lets login into SSH!

Logged in! I tried sudo -l but it didn’t have any permission so I started basic enumeration searching for cron Found it! Lets check crontab.

Interesting file photosEncrypt hmm! Lets see what it got!

oh a b64encode encryption wow :) (actually its a encoding scheme :nerdemoji: )

Lets try to modify the python package and inject our own code shall we :)

We can find the base64.py package in that directory now lets modify it to get a root shell! Lets start listening for connection in port 1337 using our NCAT.

Bomb has been planted

Lets wait :D!

Well well well now that was easy ( jk )

THE END!

HEHE

#