So this is the Brains room on TryHackMe. Its a two part challenge, you hack into a box (red team) and then you investigate what happened (blue team). Pretty cool combo actually.

Here's my video walkthrough if you wanna follow along:

Part 1: Hacking the Box

First thing, start the machine and grab the IP address. Then open a terminal and run nmap to see whats available:

nmap <target-ip>

You'll see three things open:

• Port 22 (SSH)
• Port 80 (HTTP)
• Port 50000 (something weird, looks like a database but its not)

If you go to port 80 in the browser its just a blank page, nothing there. You can run gobuster to discover hidden folders and files on it but trust me, waste of time, there's nothing.

The interesting one is port 50000. Try connecting with telnet:

telnet <target-ip> 50000

Hit enter a few times and you'll see it returns HTML. So its actually a web server not a database. Open it in Firefox:

<target-ip>:50000

You'll see TeamCity running. Note the version number, in this case 2023.11.3.

Finding the Exploit

Go to exploit-db.com and search for "TeamCity". You'll find a bunch of vulnerabilities, the one we want is the authentication bypass / remote code execution one. Note the CVE number and search for it on GitHub.

I used the exploit from wolf hacker. Copy the code, save it as a .py file. When you run it you might get a missing module error:

pip install faker

Then run the exploit pointing at your target:

python exploit.py -t <target-ip>

If it works youll get a shell. Test it:

whoami

You should see something like "ubuntu". Then check the home folder:

ls /home/ubuntu

Youll find a flag.txt, cat it out:

cat /home/ubuntu/flag.txt

Thats your first flag, machine hacked.

Privilege Escalation

While your in there check what you can run as sudo:

sudo -l

In this case everything is allowed which means you can just do:

sudo whoami

And youll see root. Thats it, full privilege escalation. Pretty easy one but good to practice the concept.

Part 2: Investigation with Splunk

Now close that machine and start the second one (the blue team box). Put the new IP in your browser and youll see the Splunk interface.

Go to Search and Reporting. Start with a broad search to see everything:

index=*

Set the time to "All Time" and search. Youll see around 4000 events.

Question 1: What plugin was installed after exploitation?

Just search:

index=* plugin

Youll see an event about a plugin being uploaded. The full name is right there in the log, copy it.

Question 2: What malicious package was installed?

Search for:

dpkg

Then filter to look through installed packages. Youll see loads of normal Linux stuff, lib this, lib that. Keep going through the pages and youll spot one called "data-collector". Thats the dodgy one, nothing legit should be called that.

Question 3: What is the backdoor user?

Search for:

useradd

Youll find an entry where useradd was run with the username "evil-user" and a home folder to match. Yeah not subtle lol. Thats your answer.

Done

Thats the full Brains room. Red team side you exploited a TeamCity auth bypass to get a shell and escalated to root. Blue team side you used Splunk to find the plugin, the malicious package and the backdoor user that the attacker left behind.

If you want to practice the Linux commands used in this walkthrough check out https://practicelinux.com