Plotted-TMS
https://tryhackme.com/room/plottedtms
Nmap
Starting out on port 80 we find the Apache2 default page.
Directory enumeration with feroxbuster
produces a few interesting results.
Both passwd and shadow pages have the same base64
encoded value.
After decoding...
We also find id_rsa
under the /admin directory. This again, contains a base64
encoded string that is not of any use...
After thoroughly going through port 80 we can then move onto port 445. Port 445 is normally reversed for SMB, however on this system it is dedicated to HTTP.
Again, the root page points back to the Apache default page.
Browsing to the management directory brings us to the page shown below.
Before attempting any login attempts on the target system we perform further directory enumeration and find some interesting results.
Downloading the db.sql
files we find some account hashes within the file.
We can then crack both hashes with Hashcat
against the rockyou.txt
word list.
However, we are unable to proceed with our cracked credentials.
Inspecting the responses through ZAP web proxy we find a SQL statement error has been shown on logon failure.
Saving the original request file we can then utilize sqlmap
to see if the target is vulnerable to SQL injection.
Enumerating available information with sqlmap
I was able to build the command below.
Whilst the hashes are the same we do have some new information. We have a username of puser for the credentials we cracked earlier.
Testing the credentials against the login page proves successful.
Looking at the account settings in the top right of the screen we see we can change our profile picture. As we know PHP is running on the target web server we can upload a reverse shell.
RevShells was then used to generate a PHP PentestMonkey reverse shell.
RevShells: https://www.revshells.com/
Next, set up a netcat
listener then open the user profile image in a new tab to execute the PHP shell.
Which should result in a shell.
We now have access as www-data and can begin to enumerate the internal system.
After going through some of the PHP files we find initialize.php
contains sensitive information.
Logging into Mysql
with the credentials from initialize.php
we are unable to pull any new information that we did not know already.
Further enumeration with linpeas.sh
shows the script below is executed every minute by the user plot_admin.
Following the command below we can replace backup.sh with our own which will contain a netcat
reverse shell.
A short wait later we receive a reverse shell on our attacking system.
Enumerating with linpeas.sh
shows the doas
binary is on the system which, essentially acts as an alternative to sudo
.
GTFOBins provides relevant information on how to abuse the openssl
binary.
GTFOBins: https://gtfobins.github.io/gtfobins/openssl/#sudo
We could quite easily grab the root flag using the method below:
A more destructive method; we can echo a new root user into /etc/passwd
. This will wipe the contents of /etc/passwd
, however we will have a root shell.
then su
to switch user and enter the password Password123
.
Last updated