TryHackMe — Exploit Vulnerabilities writeup

Task 1 — Introduction

In this room, we are going to be going over some means of identifying vulnerabilities and coupling our research skills to learn how these can be abused.

Additionally, you will find some publicly available resources that are essential additions to your skill set and tools when performing vulnerability research and exploitation. You will then get to apply all of this into a practical challenge at the end of the room.

Questions:

Let’s proceed.

No answer needed

Task 2 — Automated Vs. Manual Vulnerability Research

There is a myriad of tools and services available in cybersecurity for vulnerability scanning. Ranging from being commercial (and footing a heavy bill) to open-source and free, vulnerability scanners are convenient means of quickly canvassing an application for flaws.

For example, the vulnerability scanner Nessus has both a free (community) edition and commercial. The commercial version costing thousands of pounds for a year’s license will likely be used in organisations providing penetration testing services or audits. If you’d like to know more about Nessus, check out the TryHackMe room dedicated to it.

Questions:

You are working close to a deadline for your penetration test and need to scan a web application quickly. Would you use an automated scanner? (Yay/Nay)

yay

You are testing a web application and find that you are able to input and retrieve data in a database. What vulnerability is this?

injection

You manage to impersonate another user. What vulnerability is this?

broken access control

Task 3 — Finding Manual Exploits

Rapid7

Much like other services such as Exploit DB and NVD, Rapid7 is a vulnerability research database. The only difference being that this database also acts as an exploit database. Using this service, you can filter by type of vulnerability (I.e. application and operating system).

GitHub

GitHub is a popular web service designed for software developers. The site is used to host and share the source code of applications to allow a collaborative effort. However, security researchers have taken to this platform because of the aforementioned reasons as well. Security researchers store & share PoC’s (Proof of Concept) on GitHub, turning it into an exploit database in this context.

Searchsploit

Searchsploit is a tool that is available on popular pentesting distributions such as Kali Linux. It is also available on the TryHackMe AttackBox. This tool is an offline copy of Exploit-DB, containing copies of exploits on your system.

Questions:

What website would you use as a security researcher if you wanted to upload a Proof of Concept?

Github

You are performing a penetration test at a site with no internet connection. What tool could you use to find exploits to use?

searchsploit

Task 4 — Example of Manual Exploitation

We can use the information gathered from task 2 in this room to exploit the vulnerable service. Ultimately, one of the most effective vulnerabilities that we can exploit is the ability to execute commands on the target that is running the vulnerable application or service.

With this information in mind, we are now ready to use this exploit on the vulnerable machine. We are going to do the following:

1. Use the exploit to upload a malicious file to the vulnerable application containing whatever command we wish to execute, where the web server will run this malicious file to execute the code.
2. The file will first contain a basic command that we will use to verify that the exploit has worked.
3. Then we are going to read the contents of a file located on the vulnerable machine.

Questions:

What type of vulnerability was used in this attack?

remote code execution

Task 5 — Practical: Manual Exploitation

Deploy the machine attached to this task and wait a minimum of five minutes for it to be fully set up. After five minutes, visit the webserver running on the machine by navigating to <IP Address>in the browser of the device connected to the THM network (your own or the AttackBox).

Questions:

Find out the version of the application that is running. What are the name and version number of the application?

This one is pretty easy luckily, just open firefox on the AttackBox and navigate to the IP Address. Scroll down and in the bottom right corner the version will be listed.

Get Jaeden Samia’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

online book store v1.0

Now use the resources and skills from this module to find an exploit that will allow you to gain remote access to the vulnerable machine.

To find the needed exploit navigate to https://www.exploit-db.com/ in Firefox. In the search box type “online book store”, there should be 6 results.

No answer needed.

Use this exploit against the vulnerable machine. What is the value of the flag located in a web directory?

I will be using the verified one here, which will be by the author Tib3rius, published 2020–01–08. If you’d like to use the same one, click on it then we will download it.

We will now open up a console, you can verify you are in the same directory as it if you type in “ls” and you see it there. It should be named 47887.py

Next we are going to run it so we will use the command:

python3 47887.py http://<IP Address>

Please make sure to add http:// before the IP address otherwise you will get an error. It is also a python file so we have to use python3 to run it.

If it is successful we will be asked if we want to launch a shell in this terminal, type “y” for yes here.

Congrats! You ran the exploit, now we just have to find the flag, for this we will first start with a simple “ls” to see what files are in the current directory.

To our luck we see flag.txt is located right there, all there is left to do is open it with:

cat flag.txt

THM{BOOK_KEEPING}

Conclusion

That is all for this room, hopefully the write up helped some of you solve through this and learn something! Do remember to follow along and not just copy and paste the answers, it’s all about learning after all.