HomeTeamHall of FameRegister

Micky Mouse Writeup

YCTF – Weekly Micky Mouse VM Challenge Writeup.

Room name: Micky Mouse

Room link: https://tryhackme.com/jr/yctfweekly

Description:

When did Micky Mouse completed it's half-century? Micky mouse event was the best event in the world 😁Can you find the flag of YCTF `event?

Hint 1: Have you tried nmap -Pn

(Direct/straight hint)

Hint 2: Micky's 50 Mouse year might help! It's the way to get inside!

(A small google search gave us 1978 as a Micky's 50)

Let's begin with the exploitation!

First we try to ping the machine, but no response, as the ICMP packets are blocked.

So, Let's scan the target using rustscan

We can see above, that the port 1978 and 3389 are open.

But using nmap, we got the output as host is down

To bypass this issue, we can try this -Pn, We get the response as host is up and port scan begins!

So, we used Nmap flags -Pn (No ping scan) -O (OS detection) -sV (Service version detection), to scan only port 1978 and 3389.

We found out the service and OS running on the target. Then, simple search for the port 1978 unisql leads to this first exploit Wifi Mouse 1.7.8.5 - Remote Code Execution.

Download the exploit https://www.exploit-db.com/exploits/49601

Before running it, create a MSF payload by specifying LHOST and LPORT

Now in one tab, run the python http server

In the second tab, listen using netcat

In the third tab, run the exploit!!

Holaa!! You got the shell!

Now, read the description and Question again! what does it say?

It says, Can you find the flag of YCTF `event?

It was the biggest hint, the word EVENT was repeated in the description and in the question.

Now it makes sense to look into the Windows events

Using the command wevtutil qe Application we can list all the Application events on windows.

Now scrolling just little down, we get the fake flag.

So, I copied the whole log file into my machine and searched for the Base64 strings manually. By searching for the string == we got one string

ZGlkIHlvdSBjaGVjayBldmVudCBpZCA2OSBodWg/Cg==

Using cyberchef to decode the base64 string, we get another hint which says,

did you check event id 69 huh?

So I Tried looking for the event id 69

Now, If you look closely in the 69th event, we can see some strange string

594354467b5230306d5f667531315f30665f6d307535337d0a

which then uploading to Cyberchef and using Hex decode, gives us the actual flag!

Flag: YCTF{R00m_fu11_0f_m0u53}

Challenge Credits: Munazir

Hope you enjoyed the machine and learned new things from the challenge! 🌟📚

Previous🚩YCTF0x01Next🚩YCTF0x02

Last updated

Was this helpful?