Warzone2 Vulnhub Writeup

Enumeration, Flask, Port Forwarding, GTFObins

Created and Tested in Virtual box (NAT network)

Hint : lowercase letters

• NMAP
  • Port 21 files
    • password.png
    • username.png
    • token.png
• Semaphore flagging:
• Token Creation based off token.png psuedo code
  • Credentials Gathered
• Connection with netcat on 1337 with new creds
  • flagman creds found in flagman warzone2-socket-server
• flagman
  • SSH as flagman with new creds (Bronze)
    • flagman has sudo access to run wrz2-app.py as admiral
  • Results from starting the 5000 port
  • Set up ssh tunnel to port 5000
• admiral
  • Reverse shell as admiral (Silver)
• ROOT
  • admiral has sudo rights with less (GOLD)
    • sudo -l gtfobins less

NMAP #

Warzone 2 NMAP Scan

Port 21 files #

password.png #

• SIGNALPERSON

username.png #

• SEMAPHORE

token.png #

Semaphore flagging: #

• http://www.anbg.gov.au/flags/semaphore.html#:~:text=The%20Semaphore%20flag%20signaling%20system,portion%20in%20the%20upper%20hoist.
• https://dotnetfiddle.net/QbsKTc

Token Creation based off token.png psuedo code #

using System;
using System.Security.Cryptography;
using System.Text;

public class Program
{
	public static void Main()
	{
		Console.WriteLine(SHA256HexHashString("semaphoresignalperson"));
	}

	private static string ToHex(byte[] bytes, bool upperCase)
	{
		StringBuilder result = new StringBuilder(bytes.Length * 2);
		for (int i = 0; i < bytes.Length; i++)
			result.Append(bytes[i].ToString(upperCase ? "X2" : "x2"));
		return result.ToString();
	}

	private static string SHA256HexHashString(string StringIn)
	{
		string hashString;
		using (var sha256 = SHA256Managed.Create())
		{
			var hash = sha256.ComputeHash(Encoding.Default.GetBytes(StringIn));
			hashString = ToHex(hash, false);
		}

		return hashString;
	}
}

From <https://dotnetfiddle.net/QbsKTc>

Credentials Gathered #

• semaphore
• signalperson
• 833ad488464de1a27d512f104b639258e77901f14eab706163063d34054a7b26

Connection with netcat on 1337 with new creds #

flagman creds found in flagman warzone2-socket-server #

• flagman:i_hate_signals!

flagman #

SSH as flagman with new creds (Bronze) #

flagman has sudo access to run wrz2-app.py as admiral #

Results from starting the 5000 port #

• Generated Pin: 104-779-675

Set up ssh tunnel to port 5000 #

• ssh -L 5000:localhost:5000 flagman@warzone2.local

admiral #

Reverse shell as admiral (Silver) #

• Navigate to localhost:5000 to reveal pin input prompt to run python commands.
• Send python reverse shell back to attacker machine

ROOT #

admiral has sudo rights with less (GOLD) #

sudo -l gtfobins less #

• https://gtfobins.github.io/gtfobins/less/

sudo /usr/bin/less /var/public/warzone-rules.txt
!/bin/sh