Ringzer0CTF – Linux – Level2
Objective:
Get the flag…… I don’t know what else to put here
Find architect password
User: morpheus
Password: VNZDDLq2x9qXCzVdABbR1HOtz
Solution:
Ok so we login with the same user/pass of the last level and
now need to find another password
So this one took a bit of time for a refresher for me.
First I tried the same process we did for the last level to
see if we could find a command running with the password like we did for trinity….
Nope
Ok so Let’s just search the entire files system for “architect”
Lets get to /
Cd ../
morpheus@lxc-sysadmin:/$ ls
backup bin boot
dev etc home
lib lib64 media
mnt nohup.out opt
proc root run
sbin srv sys
tmp usr var
ok now my first iteration here was just grep -r “architect”
That gave me way to many things….
Ok how do we filter out permission denied lets start
there.
We can use 2> /dev/null
This redirects all stderr ( standard error output) to /dev/nul
therefor it doesn’t show up for our grep
Ok that did get rid of all the permission denied std error
messages but we are still getting way to may results.
The grep command we are using is also hitting on words that
contain architect like architecture, which shows up a whole lot in the results
Lets reformat the grep search to only include architect and
not anything more than that
Here is the MAN for grep
I think we might have some luck with -w
-w, --word-regexp
Select
only those lines containing matches that form whole words. The test is that the
matching substring must either be at the beginning of the line, or preceded by
a non-word constituent character. Similarly, it must be either at the end of
the line or followed by a non-word constituent character. Word-constituent
characters are letters, digits, and the underscore.
So this will filter out anything where architect is not the whole
word it needs a non-word character either directly before or after archichect
morpheus@lxc-sysadmin:/$ grep -r -w "architect"
2> /dev/null
etc/fstab:#//TheMAtrix/phone
/media/Matrix cifs username=architect,password=$(base64 -d
"RkxBRy0yMzJmOTliNDE3OGJkYzdmZWY3ZWIxZjBmNzg4MzFmOQ=="),iocharset=utf8,sec=ntlm 0 0
etc/group:challenger:x:1000:morpheus,trinity,architect,oracle,neo,cypher
etc/group:architect:x:1003:
etc/passwd:architect:x:1002:1003::/home/architect:/bin/bash
etc/subgid:architect:231072:65536
etc/subuid:architect:231072:65536
Cool looks like we found something
etc/fstab:#//TheMAtrix/phone /media/Matrix cifs username=architect,password=$(base64 -d "RkxBRy0yMzJmOTliNDE3OGJkYzdmZWY3ZWIxZjBmNzg4MzFmOQ=="),iocharset=utf8,sec=ntlm 0 0
looks like this has a user/pass set but the pass is base64
encoded.
Lets flip it out and see what we get
morpheus@lxc-sysadmin:/$ echo
'RkxBRy0yMzJmOTliNDE3OGJkYzdmZWY3ZWIxZjBmNzg4MzFmOQ==' | base64 -d
FLAG-232f99b4178bdc7fef7eb1f0f78831f9
morpheus@lxc-sysadmin:/$
another flag, cool
morpheus@lxc-sysadmin:/$ grep -r
"\<architect\>" 2> /dev/null
Comments
Post a Comment