Lian_Yu – TryHackMe
Arrowverse themed CTF Box
First running the nmap on the matchine
#2 What is the Web Directory you found?
finding hidden web directory running gobuster
we got a island , after checking this page out. found this there
The Code Word is: </p><h2 style="color:white"> vigilante</style></h2>
saw the hint it says , numbers, so tried all 4 digit numbers on home page didn’t get anything, then tried that on our island page , got something 🙂
after inspecting the page we got the extension .ticket
run the dirbuster on this extension with dirbuster small wordlist
visiting to this page got
In the next hint it says it looks like the base , i checked base 64 but not , then i check every base and it was a base58
#4 what is the FTP Password?
After decoding the above got the ftp password
logged into ftp with the user name we got a while back
and the ftp password we just got
#5 what is the file name with SSH password?
After logging in we got 3 image files, as the tag of the challenge says stegnography, so I used stegcracker on the image files and got the files on aa.jpg.
In those files we got the ssh password, file name is shado
we got the username when we login to the ftp and we have the ssh password from the shado file – M3tahuman
so login to ssh and got the user.txt
there is a .Important file here , open got need to find Secret_mission , used the locate to get the file , But there is just the bunch of text in there , first i thought i need to find the file name mirakuru , that was in the text ,
But no file with that name , than back to old school just searched sudo -l , to get the files i have permission to run as root got the file
sudo ./pkexec cat /root/root.txt
got it 🙂