search

Sweettooth Inc.

https://tryhackme.com/room/sweettoothinc

hashtag
User Flag

Let's start with an nmap scan

Googling about InfluxDB we found something interesting in the following blog:

LogoWhen all else fails - find a 0-dayKomodoSecchevron-right

If we go to the /debug/requests path we can find an username for the database

Now we have to generate a JWT token (https://jwt.io/arrow-up-right). The exp field is the token expiration date in epoch format.

Let's see if the token works:

It works.

No we have to extract the data we are asked

Let's ssh into the machine using the creds we found and grab the flag.

hashtag
Root Flag

Looking around the machine we found a script named "initializeandquery.sh" in the / folder. If we cat the file we see this output:

We can do a port forward and access that 8080 port from our machine.

Let's upload chisel in the victim machine.

Let's set up a chisel listener in our machine:

In the victim machine:

Now we can list the docker images

We can escape the docker

Let's upgrade the shell and grab the flag

hashtag
Root Flag (Docker)

For the docker root flag we listed the containers

And then executed the following command to get the root flag from the docker container

PreviousMetamorphosisNextChronicle

Last updated