# [[Peak Hill]] --- ## Port Scanning and Enumeration (Nmap, FTP) ```nmap nmap -sV -sC -oN nmap/initial -T4 ``` ![nmao.png](27ef73dd6fd34faaab49aebb5c14746c.png) FTP and SSH. Looks like FTP has anonymous login. Let's start with that. ![ftp.png](b74c9bd136dc4b16919c7cb1cc2657b3.png) Logging in with the user: anonymous and password: anonymous, we browse the system and see a couple files: .creds (hidden) and test.txt Grab them using the command: get --- ## Pythonian Pickles served by the Cyber Chef So we have this .creds file, catting it out we're flooded with '1's and '0's. Binary? Bacon? Probably binary. Let's check with Cyber Chef. ![cyberchef.png](96087810d32948e7beaa184933bd5b32.png) Note: *Download* the output as a file, do not copy and paste it. …ssh_pass …ssh_user That sounds really interesting. Now is the time to click the link above 'Python Pickle Module'. This is definitely a pickled object. Let's write a script to handle this. ![script.png](a715e2b7b4db453d855753a15f307015.png) Script I wrote to handle unpickling and formatting the text so that it's readable. ![3u56rh.png](5692d25f2e264c69b6d57b36e3a868c3.png) Output of the script --- ## Little Pickle: Gherkin So now that we're on the box, let's capture the user fl - -…? ![initial access.png](c75af8a4b5194f37bc2523df1b60e7b0.png) or… maybe not Okay, so that's out. But we did notice a random file owned by root in our directory. We can't execute it, but we can transfer it to our machine and decompile it using Uncompyle6 ![bigscript.png](54189dc173ea4430a47e8042f787c502.png) I outlined the important parts I see.. this creates a service on port 7321. Once connected, it asks for a username and password. If successful, it runs commands. Nice. We see the username and password stored at the top. Let's use the remote machine to grab those really quick. ![73273247.png](d0cc5dd4f9524d0eada73ff72a9a9f81.png) Alright, now we'll try to connect to that service ![763457yeyregrg.png](4652d9225d89489886d78ed05d377827.png) Now that we have command execution, what can we find? ![commandthingy2.png](2c4d6b817a2140ce99a722f22573a7a4.png) Ooooh. SSH directory ![sshkey.png](c48d1ecfeb9342d189cc74442189e34d.png) I spy a private ssh key ![sshkey2.png](6ded10154b74415399db9ede13d0e1b1.png) Let's copy that down, save it, and give it the right permissions `chmod 600 dill_id_rsa` `ssh -i dill_id_rsa [email protected]` --- ## Big Pickle: Dill Now that we're on Dill's account, let's finally capture that user flag! ![userflag.png](59965a604d344674b8b6adbf17e8709c.png) Now let's set our eyes on the biggest pickle of them all: root sudo -l ![secondaccountsudo.png](dd493a62293f417a8af35354f7c304ce.png) Oh hey! We can run… whatever that is as root without requiring a password! Let's see what it does! ![firsterror.png](ce1814a47f6342c7bb242b95838bd5e0.png) failed to decode base64? Well, what if we gave it some base64? ![seconderror.png](dfc08823032143a68eb29f0d29c08a97.png) ![thirderror.png](1e536fc5d53147b6a76ceb553df27e10.png) After browsing the internet for a while and learning all I can about the pickle module, I stumbled across this paper: https://media.blackhat.com/bh-us-11/Slaviero/BH_US_11_Slaviero_Sour_Pickles_WP.pdf Which lead me to this object, which I like to call.. PICKLES GONE BAD ![picklesgonebad.png](ccf04fe3556946ea92c137dded87d4fa.png) Pickles don't *usually* have shells. But this one, this one has GONE BAD ![picklesgonebadb64.png](b3afeb4d812043b1b101b889fb2fd36f.png) base64 encoding that bad, bad pickle ![rootacquired.png](9045fb3cfbfb481d842c118f432707b1.png) And just like that, we get root! Let's capture the root fla - oh come on now. ![trollflag.png](424e171666034017bcfd7caf9e39d2d9.png) but it's right there! Turns out, there's like, a space or something in front of it. Oh well. CAT ALL THE THINGS ![rootflag.png](1f7c12d0b33e4f7180c06e17e4b84f58.png) Congratulations on rooting this box! --- Back to [[TryHackMe Index|TryHackMe Index]] Tags: #thm #box_writeups #ftp #deserialization #pickle #ctf #python #scripting Related: [[Jellyspotters - Python Pickle RCE - DawgCTF 2021]]