Publisher TryHackMe




1) INITIAL ENUMERATION

As usual in this web exploitation challenge, we will start with nmap scan first to see if there are any open ports.

Here we can see ssh and http ports are open. 



As we go to the website, it mention SPIP, a publishing system. You can read the details below or learn it more on google. 


2) DIRECTORY FUZZING

We then enumerate more on the URL, hoping to see if there are any path that we can access.

Below shown spip directory, which is a bit unique. 



As we go around the /spip directory above, there is nothing interesting, so we enumerate the URL once again. 


Go through each of above directory, in this tutorial, I found config.txt inside the /local directory, which might reveal the version used by the website that we cna exploit. 


Here, it used spip version 4.2.0



3) EXPLOIT RESEARCH

use searchsploit 'spip 4.2.0' command to see more info about spip 4.2.0


here we can see the CVE, so we can search more of it on google. 




We then use "search spip" command to see more options that we can use the metasploit to exploit the spip




We use option 12 because it being mentioned when we use the searchsploit just now.

set up the lhost, rhost, and targeturi, and then run



here we finally get into our shell 

Go around a bit and we can see out first flag inside the user.txt


4) PRIVILEGE ESCALATION

from section before, we see there is a ".ssh" directory which might have any credential that can be used,

and yes we found the private key, and then download it. 

open up another terminal, and the file is already there 


The challenge provided an SSH private key file (id_rsa). However, for security reasons, SSH will refuse to use a private key if its permissions are too open. So the first step is to restrict the file permissions so I use command "chmod 600 id_rsa"

Next, I use the pricate key to connect to the target machine:

Once the connection succeeds, I gain access to the remote Ubuntu system, confirming that the private key was valid and the machine is reachable.



I execute command "find / -perm -u=s -type f 2>/dev/null" 

to search the filesystem for SUID binaries to find privilege escalation vectors, and one interesting custom binary which is the /usr/sbin/run_container

why search for SUID? this is because the command is basically saying “Show me all files where the SUID bit is set.”

and what if the SUID bit is set on a certain file? then anyone executing it temporarily gets root privileges in that process.



I executed the SUID program "/usr/sbin/run_container" as a normal user.

The program prints a list of Docker containers and shows a menu with options to start/stop/restart/create a container. The program then prompts for a container ID or blank to create a new one. 

The script produced this error: /opt/run_container.sh: line 16: validate_container_id: command not found. -> the command likely trigger the run_container.sh under the /opt directory -> thus, we can see what is inside the /opt for further investigation. 


I checked permissions and ownership to confirm what the file allows. But here, I am being denied even to see what is inside it. 

Then I listed services and looked for AppArmor using command:

service --status-all | grep '+'

Here there is an apparmor service, AppArmor is a Mandatory Access Control (MAC) system used on Linux that It restricts what files/processes a program can read, write, or execute regardless of standard Linux permissions.


Then I lists the AppArmor profile files in /etc/apparmor.d. AppArmor confines programs, checking these files helps you see whether a binary (like run_container) is restricted by AppArmor.



command:

ps -p $$ -o args=

shows which shell you’re in (e.g., -ash or bash). it is Useful to confirm your shell type and environment.

then I use getent passwd think to confirm the user account details



Then I run 

cat /etc/apparmor.d/usr.sbin.ash 

to see what AppArmor restricts for that program, and to know if a privileged binary can run arbitrary commands or scripts.



Then I run 

cp /bin/bas  /dev/shm

to Copies /bin/bash into /dev/shm (shared memory tmpfs). 

from previous steps above, we can see that /dev/shm is writable. 



after I see that /dev/shm/bash can be executed above, I execute the the copied binary using command "/dev/shm/bash"



I then use command echo 'chmod u+s /bin/bash' > run_container.sh to write the text chmod u+s /bin/bash into a file run_container.sh. The file now contains a command that will set the SUID bit on /bin/bash.

after that I execute the /usr/sbin/run_container command to make the /bin/bash as SUID root.

and use command bash -p to start bash while preserving elevated privileges.

as you can see I'm able to get the root shell in the end



for the final step, as usual I will look around the paths to search for the root.txt

usually s the name suggest, you might want to search inside the root. 

































Comments

Post a Comment

Popular posts from this blog

Data Exfiltrtation Detection (DNS, FTP, HTTP, ICMP)

Image
Learning Objectives In this entry, we will cover the following learning objectives: - Understand the common methods used for data exfiltration. - Learn how to detect exfiltration attempts using network traffic analysis. - Identify signs of exfiltration on endpoint devices. - Correlate logs in a SIEM to uncover hidden exfiltration channels. 1) Data Exfil: Overview Tech, and indicators -> unauthorized data transfer from in to out by adversaries -> can be by insider or malware 1.1) Why they do data exfil?  Reason Description Financial Gain Stolen data (e.g., credit card information, personal records) can be sold on the dark web or used for fraud. Espionage Nation-state actors target intellectual property, trade secrets, or classified information for strategic advantage. Ransomware & Extortion Attackers steal data and threaten to leak it unless a ransom is paid. Disruption & Sabotage Adversaries aim to damage an organization's reputation or operations by exposing sensitiv...
Read more

Firewall, WAF, and VPN manual log Analysis using command line.

Image
Incident Scenario Initech Corp, a mid-sized financial services company, has recently deployed a new firewall and intrusion detection system (IDS) to monitor its network perimeter. Over the past month, security analysts have noticed abnormal traffic patterns, but the SOC team has been overwhelmed and missed deeper analysis. As a new security analyst, you have been tasked with reviewing one month of perimeter logs to determine what techniques the adversary used, and whether they succeeded in breaching the perimeter. You have been given three sets of logs from the time of the incident. The logs can be found in the Perimeter_logs/challenge directory on the Desktop. Firewall Logs:firewall.log WAF Logs:ids_alerts.log  VPN Logs:vpn_auth.log  LOG ANALYSIS Let's start by exploring the logs, as shown below: Commandline: head firewall.log Explore ids logs, as shown below: Commandline: head ids_alerts.log Examine VPN Logs, as shown below: Commandline: head vpn_auth.log Reconnaissance atte...
Read more

Reversing ELF TryHackMe

Image
  1) crackme1 for the first challenge all we need to do is run the file named "crackme1" and we got the flag. 2) crackme2 when we try to run the file, it correct us and say the right usage is ./crackme2 + password, and we need to find this password. As we open the file in ghidra, we can see if we use "super_secret+password" it will give us access granted as the output. and as we suspected, once we use it as the password, it will give us the flag.  3) crackme3 The same case as crackme2, so first let's see if there is any interesting strings that we can see.  here we can see there is a base64 strings as we open the file in ghidra, it says that if we input the base64 strings as the password, then the password is correct.  so we decode the strings first and then use it as the password.  4) crackme4 This launches GDB (GNU Debugger) and loads the executable crackme4. This tells GDB to print all the functions found inside the binary. This lets you identify where the re...
Read more