{"id":2929,"date":"2026-05-03T23:55:00","date_gmt":"2026-05-03T23:55:00","guid":{"rendered":"https:\/\/zombierollz.blog\/?p=2929"},"modified":"2026-05-03T23:55:00","modified_gmt":"2026-05-03T23:55:00","slug":"brains","status":"publish","type":"post","link":"https:\/\/zombierollz.blog\/?p=2929","title":{"rendered":"Brains"},"content":{"rendered":"\n

https:\/\/tryhackme.com\/room\/brains<\/a>
Created by: tryhackme, Dex01, strategos<\/p>\n\n\n\n

I start on the red team side of things. I’ll admit I am a bit rusty and need to start getting back on the pentest side of things lol. I echo the IP to target.thm. Once I do this, I use nmap and see 4 open services.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

I run another nmap scan to get more details.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Now opening the firefox browser, I was unable to get anything going to the IP itself. However, adding :50000 and we get to the login page.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Time to run gobuster against this and see what I get.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

It looks like I need to check out favicon.ico with that 200 status! I use curl and md5sum to obtain the hash.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

I got excited too early with this, as it led me nowhere. I ended up looking for that md5sum on shodan.io, but nothing came up. I also used Burp Suite and found a few things, but still nowhere. Instead, I looked into the website and the version build # and came across this nice little article that breaks down the attack:

https:\/\/www.kroll.com\/en\/publications\/cyber\/jetbrains-teamcity-vulnerabilities
<\/a>
Which led to this awesome article by rapid7:

https:\/\/www.rapid7.com\/blog\/post\/2024\/03\/04\/etr-cve-2024-27198-and-cve-2024-27199-jetbrains-teamcity-multiple-authentication-bypass-vulnerabilities-fixed\/<\/a>

Below is the same snippet from above, which shows the version build #. <\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

The Rapid7 article provides the commands we need to use. <\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n

In the above command, I make an admin account for the website with hax0r as the username, password, and email as well. Now, I am able to login to the website. <\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Took me a bit to maze the website but I came across this!<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

I was able to access the administrator account directly and then changed the password of my choice. <\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

I navigated the site with admin user and was hoping to land on some things. I ended up trying to run a build but hit another brick wall. <\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

However, I did some more digging and was able to find the information about the ubuntu path seen here. This helped later on!<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

After being stuck on this I went back to the rapid7 website and came across this command:

exploit\/multi\/http\/jetbrains_teamcity_rce_cve_2024_27198<\/p>\n\n\n\n

I ended up returning back to this lab later in the day, so I’m using a different target IP and my target.thm is not on the VM. I start Metasploit and use the command above. <\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n

Ended up having to change the LPORT as 53 was not working.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

And I get in!<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Remember that ubuntu path I mentioned earlier? Now is the time to apply it here! A lot of running around in circles, but I learned a lot from part of the room! It was fun getting back on the red side, as I have most recently been focusing on blue side.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

“What is the content of flag.txt in the user’s home folder?”

THM{faa9bac345709b6620a6200b484c7594}<\/p>\n\n\n\n

I ended up doing the next parts out of order. Such is the way of Splunk sometimes. I ended up getting the zip file and noticing that 4\/07 is the date that you know what hit the fan. So I focused on that date for the other questions.<\/p>\n\n\n\n

“What is the name of the backdoor user that was created on the server after exploitation?”<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

“What is the name of the malicious-looking package installed on the server?”

I ended up limiting the date\/time to limit the search. You can see all the finds with this filter!<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

I filter again to make it even easier.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n

“What is the name of the plugin installed on the server after successful exploitation?”<\/p>\n\n\n\n

I actually found this first off the bat cause I saw the sourcetype show teamcity_activities and thought that would show some interesting things. Notice the date too! That made the previous answers easier to get \ud83d\ude42<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n","protected":false},"excerpt":{"rendered":"

https:\/\/tryhackme.com\/room\/brainsCreated by: tryhackme, Dex01, strategos I start on the red team side of things. I’ll admit I am a bit rusty and need to start getting back on the pentest side of things lol. I echo the IP to target.thm. Once I do this, I use nmap and see 4 open services. I run another […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-2929","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"blocksy_meta":{"styles_descriptor":{"styles":{"desktop":"","tablet":"","mobile":""},"google_fonts":[],"version":8}},"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/zombierollz.blog\/index.php?rest_route=\/wp\/v2\/posts\/2929","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/zombierollz.blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/zombierollz.blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/zombierollz.blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/zombierollz.blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2929"}],"version-history":[{"count":6,"href":"https:\/\/zombierollz.blog\/index.php?rest_route=\/wp\/v2\/posts\/2929\/revisions"}],"predecessor-version":[{"id":2962,"href":"https:\/\/zombierollz.blog\/index.php?rest_route=\/wp\/v2\/posts\/2929\/revisions\/2962"}],"wp:attachment":[{"href":"https:\/\/zombierollz.blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2929"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/zombierollz.blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2929"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/zombierollz.blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2929"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}