---
description: https://tryhackme.com/room/gallery666
---

# Gallery

## Nmap

```
nmap 10.10.40.100 -p- -sS -sV

PORT     STATE    SERVICE VERSION
53/tcp   filtered domain
80/tcp   open     http    Apache httpd 2.4.29 ((Ubuntu))
8080/tcp open     http    Apache httpd 2.4.29 ((Ubuntu))
```

Starting out on port 80 we have the Apache2 Default Page.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2FKsFsYOwLV6bwQHtvL8xr%2Fimage.png?alt=media\&token=1919d341-8733-4bf2-becf-1d33db7ba838)

Running `feroxbuster` against the target web server and we see some results.

```
feroxbuster -u http://10.10.40.100 -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-big.txt
```

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fkb20sBgBvwKl56WUAcL2%2Fimage.png?alt=media\&token=dc582b3a-86d5-42ca-a65f-b568e08a8f87)

Checking the gallery directory we are redirected to `/gallery/login.php`.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2F7f9VYTOG4ez4VBJPAaTg%2Fimage.png?alt=media\&token=d2b0108d-5904-4706-90c3-d3040041dd38)

Attempting a login with a simple set of credentials, we check the request in ZAP web proxy and notice a SQL error code has been returned in response to the logon.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2FJnR0n20YY39E3YX5xwyd%2Fimage.png?alt=media\&token=45e66426-f3fd-4960-9780-1e4d10cc26f7)

Knowing SQL is running on the back end we can try some simple SQL injection on the login page.

Logging in with the SQL injection `' OR 1=1 -- -` for the username and password proves successful.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2F0vGhwrcbKz2DzCyP5L9R%2Fimage.png?alt=media\&token=d0a596d0-601a-41ea-924a-202200e0285d)

**Note:** We can also use `sqlmap` with the raw proxy request to enumerate the database and pull the admin hash.

```
sqlmap -r ~/Desktop/request.raw --batch -D gallery_db -T users --columns username,password --dump
```

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2FCXjRzNFjctY0vzSTkX6q%2Fimage.png?alt=media\&token=7a4fb3c2-537e-470a-bc52-bf2f4f341212)

Back to the logged in page we managed to bypass. We notice we are able to upload a new profile picture to our current administrative user.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2FHWhcFZ9D3vjWYipioA9w%2Fimage.png?alt=media\&token=a65cf9bb-cb81-49e1-bdd9-9093a301e6cd)

As we know PHP is running on the webserver we will ideally upload a PHP reverse shell as the avatar.

**RevShells:** [https://www.revshells.com/](https://www.revshells.com/)

I opted for the PHP PentestMonkey shell.

After uploading the shell we find it triggers our `netcat` receiver instantly.

**Note:** If for anyone reason this does not trigger we can right click where the avatar is supposed to be in the top right and "Open image in a new tab" to trigger.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fk8hFwuPUyX01r3SJ9Gbu%2Fimage.png?alt=media\&token=7f258bac-5bc5-4b90-9749-223cdf9e54af)

Looking through the /var/backups directory we find the directory "mike\_home\_backup".

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2FnArQ5ovHFJv1v2kYIRrO%2Fimage.png?alt=media\&token=62492036-712a-4bc7-9ecd-deecb455a222)

Within the contents we find that `.bash_history` is readable by us which, contains a potential password.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2FnzETxxtVuZXsoVvaFxr6%2Fimage.png?alt=media\&token=b75692af-bb05-40b6-80b5-460987aaf488)

Using the credentials (altered slightly due to a type in the history file) we are able to `su` over to _mike_.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fbc58yBjTH56FGSPbnlcp%2Fimage.png?alt=media\&token=6399bb84-d185-4877-a25a-ac8495ca3c6f)

Where we can then read the `user.txt` flag in Mike's home directory.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2FuMe9YZfdqtdhEpbZSOuC%2Fimage.png?alt=media\&token=94952939-d980-4fee-9399-e2806e865419)

Running `sudo -l` we see mike is able to run bash on `/opt/rootkit.sh` as **root** without requiring a password.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2F38LoWhT7ZoVAL95Say69%2Fimage.png?alt=media\&token=b408061c-830d-470c-8003-304065592b59)

Reading the contents of `/opt/rootkit.sh` we see we will be prompted for commands, read looks to be the most promising due to hit executing `nano`.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2FCeTRQIKRnfxig7FmqKBE%2Fimage.png?alt=media\&token=efe6f0c5-fa74-407d-a0d1-3c8e25ac35b2)

Looking at GTFOBins we see we are able to escape nano to run system commands.

**GTFOBins:** [https://gtfobins.github.io/gtfobins/nano/](https://gtfobins.github.io/gtfobins/nano/)

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2F3QtNewIhcge4RnBWlBxQ%2Fimage.png?alt=media\&token=678ba43b-d581-4b31-b51f-33d6020fbae7)

**Note:** I was unable to complete the privilege escalation initially as the `nc` shell I was currently using was not stable enough to even work over TTY. `Socat` is installed on the target system and is highly recommended to get a reverse shell with `Socat` as the user mike to complete the next steps.

When ready we execute /opt/rootkit.sh as root.

```
sudo -u root /bin/bash /opt/rootkit.sh
```

Then enter "read" into the interactive prompt where we will move over to a root `nano` session. Pressing `CTRL + R and CTRL + X` on the keyboard will prompt for a command to run in nano.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fp4Dfx0golhMtE1pVvicW%2Fimage.png?alt=media\&token=1299f5ac-11d7-4990-9443-7268ceb4df13)

Entering the command below will escape into a root shell and all us to grab the **root** flag.

```
reset; sh 1>&0 2>&0
```

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2FmpXCOJdyRlHlXdm1XsJ9%2Fimage.png?alt=media\&token=0098460e-7440-4d5b-b6b2-b970fb83c7dc)
