Advent of Cyber 3 - Day 14

Learning Objectives

Understanding the CI/CD concept Overview of risks associated with CI/CD Having a basic understanding of CI/CD exploitation vectors

---

First thing I did was to get the IP and export it to make it easier, like so:

export ip=[targetIP]

I checked the website to find some clues… ‘nothing’ but The Grinch.

Next, I ran gobuster on the website to check for directories, found some interesting ones:

gobuster dir -u 10.10.65.172 -w /usr/share/seclists/Discovery/Web-Content/common.txt -t 50

Results:

As follows I checked both admin and warez.

admin	warez

Nothing interesting on warez other than the “The loot folder on this target is where I send all date I collect. I’ve made page that updates regularly and prints the contents of the loof folder”, nice. So let’s move on to admin. Looks promising. Looks like it’s ls’ing some files.

Checked for the source-page and it has a file named /ls.html.

Connected to SSH using:

username: mcskidy
password: Password1

Upon connecting, we find a few folders, /home/thegrinch/loot and /home/thegrinch/scripts being the most important.

The contents of loot.sh script gives us a base to understand the ls.html file from earlier.

Using ls -la to check for the files permissions, we find out that loot.sh has written access which we can use to change the code inside to our needs and its owned by root.

What if we use the contents of the file to execute a command towards /etc/shadow?

I then used cat /etc/shadow and reloaded the /admin page on my browser to check if it worked.

Checking the page………… and boom. It works.

The code	Admin Page with the contents of /etc/shadow

This means that any command we execute it’ll be run as root.

We now change /etc/shadow to the path of check.sh to read its content.

We wait a few minutes and reload /admin again to check its contents.

This script checks the existence of a file called “remindme.txt” in the /loot folder. It will print the password of the grinch in a html file called /pass.html.

Checking the html file we can confirm the password is ELFSareFAST. Maybe we could use it for something?

I tried to login into SSH again but now as thegrinch.

Once connected, to find the flag I used the following:

find / -name flag.txt 2>/dev/null

and cat the flag.

BOOM! Done!