> For the complete documentation index, see [llms.txt](https://notes-95.gitbook.io/documents/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://notes-95.gitbook.io/documents/home/ctf-lab-write-ups/vulnhub/web-exploitation/deathnote-1.md). # DeathNote: 1 {% embed url="" %}
Summary DeathNote: 1 is an easy, Death Note–themed boot-to-root machine. It looks like a straightforward WordPress box on the surface, but it's really a chain of small puzzles, hidden files disguised as images, encoded hints stashed in obscure pages, and layered encoding schemes (Base64, hex, Brainfuck) sitting on top of a fairly standard WordPress-to-shell exploitation path, followed by an SSH key-reuse privilege escalation and a final sudo escalation to root.
**What you'll learn:** * How to spot files that are disguised with a fake extension * Enumerating WordPress users via the REST API * Gaining remote code execution on WordPress by uploading a malicious plugin * Building a stable reverse shell when common one-liners get blocked * Recognizing and decoding multiple layers of obfuscation * Privilege escalation via SSH private key reuse * Using LinPEAS to speed up privilege escalation enumeration * Escalating to root via a discovered sudo password *** ### Reconnaissance #### Passive Enumeration For a VulnHub box like this, there's no real external OSINT surface to work with (it's an isolated lab VM, not a live internet target). So passive recon here is really just knowing what we're working with going in: an "easy"-rated machine from the DeathNote series, described by the author as "straightforward." That framing matters because it's a hint not to overthink early steps.
Why this matters In a real-world engagement, passive recon (WHOIS, subdomain enumeration, LinkedIn/OSINT, and cached pages) would come first and shape your entire approach. On isolated lab VMs, that step collapses to "read the description," but keep the habit for real targets.
#### Active Enumeration First, find the machine on the network. Normally, you would not use vboxnet0. I used it only to find the IP faster: ``` sudo netdiscover -i vboxnet0 -r 192.168.56.0/24 ``` ``` IP At MAC Address Count Len MAC Vendor / Hostname 192.168.56.110 08:00:27:18:50:e9 1 60 PCS Systemtechnik GmbH ``` Run a full TCP port scan to identify every open port, service, and version quickly. ``` nmap -sV -p- -T4 192.168.56.110 ``` ``` PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0) 80/tcp open http Apache httpd 2.4.38 ((Debian)) ``` The scan shows only two open ports. SSH is worth noting if I find credentials or a key later. With nothing else exposed, port 80 is almost certainly where this box lives.
Why this matters `-p-` scans all 65,535 ports instead of just the top 1,000. On a two-port box like this, it does not change the outcome. On a less obvious target, it can reveal an unusual service.
*** #### Enumeration ``` gobuster dir -u http://deathnote.vuln -w /usr/share/seclists/Discovery/Web-Content/common.txt -x php,txt,html ``` ``` =============================================================== Gobuster v3.8.2 by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart) =============================================================== [+] Url: http://deathnote.vuln [+] Method: GET [+] Threads: 10 [+] Wordlist: /usr/share/seclists/Discovery/Web-Content/common.txt [+] Negative Status codes: 404 [+] User Agent: gobuster/3.8.2 [+] Extensions: php,txt,html [+] Timeout: 10s =============================================================== Starting gobuster in directory enumeration mode =============================================================== .hta.txt (Status: 403) [Size: 279] .hta (Status: 403) [Size: 279] .hta.html (Status: 403) [Size: 279] .hta.php (Status: 403) [Size: 279] .htaccess (Status: 403) [Size: 279] .htaccess.txt (Status: 403) [Size: 279] .htaccess.php (Status: 403) [Size: 279] .htaccess.html (Status: 403) [Size: 279] .htpasswd (Status: 403) [Size: 279] .htpasswd.txt (Status: 403) [Size: 279] .htpasswd.html (Status: 403) [Size: 279] .htpasswd.php (Status: 403) [Size: 279] index.html (Status: 200) [Size: 197] index.html (Status: 200) [Size: 197] manual (Status: 301) [Size: 317] [--> http://deathnote.vuln/manual/] robots.txt (Status: 200) [Size: 68] robots.txt (Status: 200) [Size: 68] server-status (Status: 403) [Size: 279] wordpress (Status: 301) [Size: 320] [--> http://deathnote.vuln/wordpress/] Progress: 19000 / 19000 (100.00%) =============================================================== Finished =============================================================== ``` Two things are worth chasing here. robots.txt is always worth checking. It is meant for crawlers, but often leaks paths developers considered "hidden" rather than protected. /wordpress/ also identifies the correct application path. ``` curl http://deathnote.vuln/robots.txt ``` ``` fuck it my dad added hint on /important.jpg ryuk please delete it ``` This in-character text names a specific file. Visiting /important.jpg throws a display error: “The image … cannot be displayed because it contains errors.” That makes the file suspicious. I downloaded it and checked the actual .jpg content. ``` curl -O http://deathnote.vuln/important.jpg # Downloaded the image file important.jpg # Inspected the image ``` ``` important.jpg: ASCII text ``` Confirmed: the extension says .jpg, but file checks the actual content. The file contains plain text. Extensions are only naming conventions. They do not verify the contents. ``` cat important.jpg ``` ``` i am Soichiro Yagami, light's father i have a doubt if L is true about the assumption that light is kira i can only help you by giving something important login username : user.txt i don't know the password. find it by yourself but i think it is in the hint section of site ``` Two leads out of this: a hint section somewhere on the site, and something around "user.txt" possibly a literal filename or could possibly be a username. ``` curl http://deathnote.vuln/wordpress/ ``` I retrieved the website’s HTML and inspected it for anything unusual. The output contained two interesting details: ```