Earth is an easy box though you will likely find it more challenging than "Mercury" in this series and on the harder side of easy, depending on your experience. There are two flags on the box: a user and root flag which include an md5 hash. This has been tested on VirtualBox so may not work correctly on VMware. Any questions/issues or feedback please email me at: SirFlash at protonmail.com, though it may take a while for me to get back to you.
We can execute commands, so let's get a reverse shell. Get a payload from revshells, like:
The command was unsuccessful, error: Remote connections are forbidden.
/var/www/html didn't have anything interesting, but going up to /var there are few noticeable directories.
Writeup-6.png
Writeup-7.png
User.txt
Writeup-8.png
Flag: user_flag_3353b67d6437f07ba7d34afd7d2fc27d
Writeup-9.png
Reverse Shell
The error which mentions that remote connections are disabled may just be a filter, it's thrown whenever commands like nc, curl, wget are ran.
When can try encrypting the command and test if we get shell:
Run the command:
Catch the shell:
sudo -l fails because we need password for account. Then we list available suid binaries to escalate privileges.
/usr/bin/reset_root program seems out of the ordinary.
It's an ELF binary, meaning some Reverse Engineering will be required. strings isn't that helpful, strace or ltrace doesn't exist on remote server, so we should dissect the file locally.
Looks like "trigger" conditions to be met 3 files need to be present on system.
└─$ feroxbuster -u http://terratest.earth.local -w /usr/share/seclists/Discovery/Web-Content/common.txt -k -d 1
by Ben "epi" Risher 🤓 ver: 2.10.3
──────────────────────────────────────────────────
404 GET 10l 21w 179c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter
301 GET 0l 0w 0c http://terratest.earth.local/admin => http://terratest.earth.local/admin/
403 GET 7l 20w 199c http://terratest.earth.local/cgi-bin/
200 GET 23131l 117709w 12023247c http://terratest.earth.local/static/earth1.jpg
200 GET 0l 0w 248c http://terratest.earth.local/static/styles.css
200 GET 35l 77w 2614c http://terratest.earth.local/
[####################] - 45s 4731/4731 0s found:5 errors:0
[####################] - 45s 4728/4728 106/s http://terratest.earth.local/
└─$ feroxbuster -u https://terratest.earth.local -w /usr/share/seclists/Discovery/Web-Content/common.txt -k -d 1
──────────────────────────────────────────────────
404 GET 7l 23w 196c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter
403 GET 7l 20w 199c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter
200 GET 1l 4w 26c https://terratest.earth.local/
200 GET 1l 4w 26c https://terratest.earth.local/index.html
200 GET 30l 60w 521c https://terratest.earth.local/robots.txt
[####################] - 9s 4728/4728 0s found:3 errors:3
[####################] - 9s 4728/4728 554/s https://terratest.earth.local/
└─$ curl https://terratest.earth.local/robots.txt -k
User-Agent: *
Disallow: /*.asp
Disallow: /*.aspx
Disallow: /*.bat
Disallow: /*.c
Disallow: /*.cfm
Disallow: /*.cgi
Disallow: /*.com
Disallow: /*.dll
Disallow: /*.exe
Disallow: /*.htm
Disallow: /*.html
Disallow: /*.inc
Disallow: /*.jhtml
Disallow: /*.jsa
Disallow: /*.json
Disallow: /*.jsp
Disallow: /*.log
Disallow: /*.mdb
Disallow: /*.nsf
Disallow: /*.php
Disallow: /*.phtml
Disallow: /*.pl
Disallow: /*.reg
Disallow: /*.sh
Disallow: /*.shtml
Disallow: /*.sql
Disallow: /*.txt
Disallow: /*.xml
Disallow: /testingnotes.*
└─$ curl https://terratest.earth.local/testingnotes.txt -k
Testing secure messaging system notes:
*Using XOR encryption as the algorithm, should be safe as used in RSA.
*Earth has confirmed they have received our sent messages.
*testdata.txt was used to test encryption.
*terra used as username for admin portal.
Todo:
*How do we send our monthly keys to Earth securely? Or should we change keys weekly?
*Need to test different key lengths to protect against bruteforce. How long should the key be?
*Need to improve the interface of the messaging interface and the admin panel, it's currently very basic.
└─$ curl https://terratest.earth.local/testdata.txt -k
According to radiometric dating estimation and other evidence, Earth formed over 4.5 billion years ago. Within the first billion years of Earth's history, life appeared in the oceans and began to affect Earth's atmosphere and surface, leading to the proliferation of anaerobic and, later, aerobic organisms. Some geological evidence indicates that life may have arisen as early as 4.1 billion years ago.
