Tech_Supp0rt: 1
https://tryhackme.com/room/techsupp0rt1
Nmap
First off we check SMB
for null access and find the share websrv which is readable by anyone.
the file enter.txt
is of interest, we then download it using smbmap
.
Reading the contents of enter.txt
we find this is a to-do list. We can make a note of the information.
The default page on port 80 comes to the default Apache 2
web page.
Running feroxbuster
against the target system we discover a few interesting results.
Under /test/index.html
we find a fake scam web page.
We also find WordPress is installed under /wordpress/
.
I enumerate the Wordpress
site and tried to identify vulnerable plugins with WPScan
and was unable to find any vulnerabilities.
Looking back at the information in the enter.txt
file we are reminded of the presence of Subrion
which is a CMS system.
Attempting to browse to /subrion
redirects us incorrectly. The enter.txt file mentions fixing the issue by using the "panel". A quick Google search shows this normally exists under the directory name /panel.
Browsing to http://<IP>/subrion/panel/
proves successful.
However, we are unable to login to the system. Looking at the admin credentials earlier in enter.txt
we see the remark "Cooked with magic formula".
Taking the hash value and running it through CyberChef's "Magic" options reveals the plain text password for the value.
We are then able to login successfully to the Subrion panel.
Researching vulnerabilities for Subrion 4.2.1 on Google we find the following CVE and exploit on Github.
CVE: https://nvd.nist.gov/vuln/detail/CVE-2018-19422
Description
/panel/uploads in Subrion CMS 4.2.1 allows remote attackers to execute arbitrary PHP code via a .pht or .phar file, because the .htaccess file omits these.
Github: https://github.com/h3v0x/CVE-2018-19422-SubrionCMS-RCE
As per the the Github repository we run the exploit with the following syntax:
Where we receive a shell.
Unfortunately, for various reasons this shell is not ideal for what we need. As such I uploaded a PHP reverse shell and set up a netcat
listener on my attacking system.
I was then able to catch a more reliable shell.
Next, upgrade to a TTY shell.
Enumerating the WordPress install we find some credentials in wp-config.php
.
Looking at /etc/passwd
we see the user scamsite exists on the system. We are then able to switch over to the user with the found credentials.
Checking the sudo permissions for scamsite we see the user is able to run /usr/bin/iconv
as root without specifying a password.
Viewing GTFOBins we see this binary can be used to perform privileged read and writes to the system.
GTFOBins: https://gtfobins.github.io/gtfobins/iconv/
We can go for an easy flag grab
Alternatively we can grab a root SSH
shell.
On the target system copy the contents of /.ssh/id_rsa.pub
into the command below to create the authorized keys files in the /root/.ssh/
directory.
Then login to the target system as root without needing to specify a password.
Last updated