ADVENTURE TIME

https://tryhackme.com/room/adventuretime

Walkthrough for "Adventure Time"

Operating System: Linux

Recon

nmap-auto $TARGET all

FTP has anonymous login which could provide some material, and there are two web services as well as a common name. Add that common name to the /etc/hosts file and it's off to enumeration.

Enumeration

[FTP]

There were 6 images in the ftp server when logged in as "anonymous" or "ftp".

exiftool *.jpg | grep "XP Comment" | cut -d: -f2

This translated to "you really like to puzzle don't ya" when using a binary to ascii converter. Probably just a troll message, still fun to do!

[Web]

Navigating to https://adventure-time.com/ shows a picture of Finn saying "I've lost Jake, can you help me find him." The source code shows that the alt text for the image says "the magic word". Viewing the SSL certificate shows the following: Email Address: bubblegum@land-of-ooo.com

Let's modify /etc/hosts to include both "adventure-time.com" and "land-of-ooo.com".

Navigating to https://land-of-ooo.com/ shows a picture of Jake saying "You found Finn!! Now we still need to find the resetcode for BMO. I think it's on B's laptop."

I tried playing around with the service on 31337, but couldn't guess the "magic word" (it wasn't "the magic word"). I decided to do a directory search using gobuster to enumerate the sites further and found the following:

Navigating to - shows the following encoded string. It's also written in the source code as a comment so I don't have to type it out and just copy/paste.

I knew it was some form of base encoded string and eventually found it to be Base32 encoded. Unfortunately the clue it gave was something I already checked when going to the site which is Princess Bubblegum's email.

Navigating to https://land-of-ooo.com/yellowdog/ shows the following image of Jake. The source code has the alt text "what is the password?" but doesn't provide much past that.

Doing yet another directory search on the current page leads to another subdirectory at https://land-of-ooo.com/yellowdog/bananastock/ which looks like some puzzle code similar to morse code.

Luckily the source code of the page contains the raw text:

Recognizing this as morese code, I went back to CyberChef and decoded it using the letter delimiter be a forward slash and the word delimiter be a backslash. The output showed "THE BANANAS ARE THE BEST!!!" which should be the password for the banana guard.

Trying out the new password as the magic word did not work. Seeing as directory fuzzing has always been the answer, I decided to do it again and not surprisingly, got another subdirectory at https://land-of-ooo.com/yellowdog/bananastock/princess/. That's a lot of time waiting on directory searching.

Reading the comment by PB made me think I would need to directory fuzz again, but thankfully opening the source code showed the following:

Seeing the presence of an IV and CBC mode, I figured this to be AES. CyberChef has a recipe for "AES Decrypt", so I can go back there to decrypt the secret text.

Awesome, now in plain text, I can see the magic word which is: ricardio. Using the magic word service on port 31337 with nc 10.64.153.6 31337 then gives the following information "The new username is: apple-guards".

Credentials: apple-guards ::: THE BANANAS ARE THE BEST!!!

The first flag is then found at /home/apple-guards/flag1.

flag1: tryhackme{Th1s1sJustTh3St4rt}

Lateral Movement

So it's actually possible to privilege escalate from here due to a vulnerability in exim 4.90.1 shown here https://ine.com/blog/the-return-of-the-wizard-rce-in-exim-cve-201910149. Since exim4 is a SUID binary, it can be used to get root and skip the rest of the challenge. I'll include that method at the bottom in Privilige Escalation.

In the apple-guards home directory, there is also an email containing some valuable information stating that Marceline has hidden a file on the box for better access:

First I wanted to confirm the users on the box, and printing /etc/passwd and looking at the non service users showed the following confirming that Marceline is a user:

  • root

  • finn

  • jake

  • bubblegum

  • marceline

  • peppermint-butler

  • gunter

  • fern

  • apple-guards

Using a find command to search for files owned by marceline gave the following:

Well, thats not normal, the home directory, yes, but the fonts helper file, definitely suspicious. Checking the file shows it's an ELF 64-bit executable. Running it shows an interactive session stating "The key to solve this puzzle is gone . And you need the key to get this readable: Gpnhkse". Single key ciphers are actually not too complicated. Since there was no encoding going on and it lacked the presence of numbers, I knew it was a substition or vignere encoded string. Using CyberChef, I tried the most obvious choice of a key, the string "gone", and I was blessed with the decoding of the encoded text giving the string "Abadeer".

Credentials: marceline ::: My friend Finn

Using the switch user command allowed me to switch to the marceline user. The second flag is then found in her home directory at /home/marceline/flag2.

flag2: tryhackme{N1c30n3Sp0rt}

Lateral Movement 2

Also in her home directory is the file I-got-a-secret.txt which contains the following:

Another puzzle that looks like binary code. Trying a binary decoder produced gibberish, got it, that's not it. By using the hint provided on the challenge page "If stuck do research on cutlery", I was able to use my googling skills to discover this is an esoteric language like BrainF$&k that uses 1's and 0's called "spoon". Why this was used, I have no idea, but it didn't take long to find a useful decoder to handle it.

The output is "The magic word you are looking for is ApplePie". Great, another magic word for BG. Using the service again with the new magic word has BG give the password of peppermint-butler which is "That Black Magic".

Credentials: peppermint-butler ::: That Black Magic

The third flag is located at the path /home/peppermint-butler/flag3.

flag3: tryhackme{N0Bl4ckM4g1cH3r3}

Lateral Movement 3

The only thing in the butler's folder is a picture which I downloaded to my attack box using scp peppermint-butler@10.64.146.248:butler-1.jpg . , opening it shows the following:

Very suspicious to say that nothing is there. There's really nothing else to note in the folder and I still have no sudo capabilities with this user. The exiftool doesn't show anything noteworthy either in the picture's metadata. Trying to use steghide or stegseek to reveal hidden data didn't work, at least not without a password.

After a while trying this and that with all the photos I had collected, I realized ser marceline had some hidden files elsewhere, so I decided to search to see if the same could be said for peppermint-butler with the command:

A file named "steg.txt", clearly an indicator of steganography. Reading the file revealed the password of the butler's secret file "ToKeepASecretSafe". Using it along with steghide revealed a zip filed called secrets.zip. There was also a file named "zip.txt" which revealed the password to the zip file which is "ThisIsReallySave".

The output of "secrets.txt":

Great, gunter is one of the last user's I haven't touched yet. Trying out a few things, I eventually figured out the password: "The Ice King sucks". This could also be done easily through brute force using hydra.

Credentials: gunter ::: The Ice King sucks

The fourth flag is located at /home/gunter/flag4.

flag4: tryhackme{P1ngu1nsRul3!}

Privilige Escalation

I actually did this before all the lateral movements.

So once on the box, I searched for SUID binaries using find / -perm -4000 which showed /usr/sbin/exim4. I can view the settings for exim4 in its configuration file through the following:

Most importantly, I can see exim4 is running on port 60,000. Using "searchsploit", I found an exploit that works locally for that included version as well:

The security post https://ine.com/blog/the-return-of-the-wizard-rce-in-exim-cve-201910149 contains a local privilege escalation script. The main thing that needs to be changed is the default port for exim4 from port 25 to port 60000. I also noticed that the gcc build will fail because the base user isn't allowed to run gcc, so I let it default to the cp and then ran the SUID /bin/bash with the -p symbol for privileged shell (user gunter has the ability to run gcc). Here is the script:

The outcome looks like the following:

flag5: tryhackme{Th1s1s4c0d3F0rBM0}

PreviousNIBBLESNextHACKFINITY

Last updated