Funbox: Lunchbreaker is one of the machines from the Funbox series. It’s a series about cracking passwords only. I personally don’t prefer bruteforcing password, however it’s a good point for starters. “Lunchbreaker Walkthrough – Vulnhub – Writeup”
Link to the machine: https://www.vulnhub.com/entry/funbox-lunchbreaker,700/
Identify the target
As usual, I started the challenge with the identification of the IP address of the target machine.
sudo netdiscover -i eth0 -r 10.0.2.0/24
Scan open ports
Next, I ran nmap scan to get the information of open ports in the target.
sudo nmap -v -T4 -A -p- -oN nmap.log 10.0.2.35
Here, we can see that anonymous ftp login is allowed. Hence, I decided to download the files to my local machine.
Getting FTP credentials
To login to the FTP server, the following command works.
get .s3cr3t get supers3cr3t
There is another directory wordpress that doesn’t have any information that we require for this box.
The file contained the following information.
So, I decoded the bas64 encoded text.
cat .s3cr3t | base64 -d
It gave the following output.
If the radiance of a thousand suns / were to burst at once into the sky / that would be like / the splendor of the Mighty One and I am become Death, the shatterer of worlds
The file has the following text.
We can see the brainf*ck code which I decoded online to get the following output.
Look deep into nature and then you will understand everything better.
Up to now, I didn’t get anything.
Enumerate web server
Since there is nothing much on the FTP server, I moved towards the webserver. The default page had a beautiful picture of lavender.
While looking at the comments, I found the possible usernames and hostname of the target.
At first glance, we got the possible usernames, jane, miller, j.miller. Likewise, we got the hostname of the target. So, I added the hostname to my hosts file.
sudo vi /etc/hosts
Furthermore, when I looked at the robots.txt, I got a hint to not use any directory bruteforcing tool. It rather says to do what you see.
Bruteforce – Jane
Next, I decided to bruteforce the logins of two possible servers – ftp and ssh.
hydra -V -l jane -P /home/kali/rockyou.txt funbox8.ctf ftp
Since we found the password to log in as jane to the FTP server, I proceeded with the login.
We only have read access to the directory. Likewise, there is a directory called backups which has a file called keys.txt. That didn’t give me anything.
cd backups get keys.txt
I once again logged into the FTP server and found out that the current directory is /home/jane of the target. That means, the root of the target is served in the FTP server.
Hence, I could look at the users of the machine by simply switching directory one previous level.
cd /home ls -al
Now that I have the usernames, I could proceed to further bruteforcing.
Bruteforce – other users
I placed the other usernames than jane into a file (users) like as follows.
Then, I did the bruteforcing using the users’ list and the password.
hydra -V -L users -P /home/kali/rockyou.txt funbox8.ctf ftp -u # -u will revolve around users not passwords
I logged in as jim but didn’t get anything.
However, after a while, I got credentials of another user as well.
Then, I decided to check if the user had reused the password to log into SSH.
Bruteforce – John
In the directory of john, I saw a file called .backups.
ls -al ls -al .backups
The directory contained files that have wordlists. Two of the files are empty as well. However, I decided to copy the directory to my local directory suing scp (secure copy). If you can SSH to the server, you can copy file securely to and from the server.
scp -r firstname.lastname@example.org:~/.backups .
Now that we have the passwords list, I could bruteforce using this list. Since john is the only user whose password I haven’t found, I changed the previous command.
hydra -l john -P .backups/.bad-passwds funbox8.ctf ftp
I got the password for the ftp server. Hence, I tried reusing the password to the SSH server.
Root privilege escalation
When I listed the files of the box, I saw a directory.
Then, I got the content of the directory.
cd .todo ls -al cat todo.list
It looks like the user had reused the password. Using the password of the user john, I got the access to the root.
su root cd /root ls -al cat root.flag
This is a machine that only revolves are bruteforcing which I didn’t like. Since the purpose of doing CTF is learning something, it would have been great if other simple exploits were present on the machine than the bruteforcing.