Tr0ll: 2 CTF Walkthrough

Meet the VM here: https://www.vulnhub.com/entry/tr0ll-2,107/

Hey there!

This is the way I followed to find the flag in Tr0ll 2 VM. It is not a difficult thing. As I guess, anyone can do it. Let's move on.....

• Finding the IP address of the Tr0ll VM.

• Running nmap tool to get an idea about open ports and running services on the machine.

According to the nmap result, the target machine runs 3 services.

-21 ftp
-22 ssh
-80 http

• Finding the common paths on the http web service.

• Check the robots.txt file to get all the paths.

• Add all the paths in robots.txt into a text file and run dirb again using it as a dictionary (troll_paths.txt).

Four working directories found. There is an image in each one. Nothing else.

• Get these four images and check md5 values.

There is only one image having some different hash value.

• Run strings command on the image which has a different hash.

Browsed to the /y0ur_self page and found answer.txt file. It looks like a password dictionary encoded with base64.

• Save the decoded answer.txt file for later use (answer_decoded.txt).

• Connect to the target machine using ftp service.

In this case the server asks for username and password. We can get into it by simply guessing the username and password as Tr0ll. Then we can find a zip file called lmao.zip and it is locked.

• Crack the zip file using the password file previously found.

After extracting the zip file, we can see there is a file called noob. It is a file that contains RSA private key.

• Check ssh with the given private key to log into the system.

• Gain access using Shellshock vulnerability.

• Get a low privileged shell and find the paths.

There are three door files. In each door, we can see a file called r00t. 2 of them are wrong files. Exploiting a wrong file will give some troubles. After several tries, I could find the correct one which has a segmentation fault.

• Exploit r00t binary file.

• Create a pattern string to find the buffer size.

• Debugging the target file using gdb.

• Find the offset value.

• Generate a shellcode payload.

• Exploit the target r00t binary using the payload to get the root access.

• Finally, get the flag.

That's it. hope you get the way of doing it.

Thank You!

~CS