search
HomeGitHubPortfolio Twitter/X Medium Cont@ct

RootMe

tryhackme.com - © TryHackMe

hashtag
🔗 RootMearrow-up-right

hashtag
Task 1 - Deploy the machine

🎯 Target IP: 10.10.55.36

Create a directory for machine on the Desktop and a directory containing the scans with nmap.

hashtag
Task 2 - Reconnaissance

I prefer to start recon by pinging the target, this allows us to check connectivity and get OS info.

Sending these three ICMP packets, we see that the Time To Live (TTL) is ~64 secs. this indicates that the target is a *nix system (probably Linux), while Windows systems usually have a TTL of 128 secs.

hashtag
2.1 - Scan the machine, how many ports are open?

2 ports open

hashtag
2.2 - What version of Apache is running?

Apache httpd 2.4.29 ((Ubuntu))

rootme.thm:80

hashtag
2.3 - What service is running on port 22?

SSH service is running on port 22

hashtag
2.4 - Find directories on the web server using the GoBuster tool.

The website (port 80) does not have much functionality. Next, we can run a gobuster scan to look for hidden files and directories using the dirb/common.txt wordlist.

hashtag
2.5 - What is the hidden directory?

/panel/

hashtag
Task 3 - Getting a shell

hashtag
3.1 - Find a form to upload and get a reverse shell, and find the flag (user.txt).

rootme.thm/panel/

During an offensive engagement, upload forms present excellent opportunities to exploit potential vulnerabilities. One of the first things to try is uploading a reverse shell. Uploading a reverse shell requires a few steps:

  1. Successfully upload a reverse shell script

  2. Start a listener

  3. Get the reverse shell script to run (note that the /uploads directory was found by the gobuster scan)

Apache servers use PHP, so we can search google for an Apache or PHP reverse shell script in order to progress. The first result I got was the Pentest Monkey PHP reverse shell:

https://github.com/pentestmonkey/php-reverse-arrow-up-rightshellarrow-up-right

You can get the shell script in any manner of your choosing. One easy way is to copy the raw data, paste it into a text editor, and save it.

In order for the reverse shell to work, you need change the IP address to that of your attacker machine (the AttackBox IP address if you’re using it). The port also needs to be specified and needs to be the same as the port that we set on the listener (in the next step):

Modify php code with our IP target and port (value at our choice).

Next, return to a terminal and start a netcat listener using the nc command:

Make sure that the port number you specify for the listener is the same as the one in the PHP reverse shell:

Running a NetCat listener.

Now that the listener is active, let’s try uploading a shell. I saved it as ‘reverse_shell.php’ and tried uploading it as is, but this was denied:

Looks like PHP is ‘not permitted’. We’ll have to bypass the restrictions that have been set.

The first primary strategy for identifying a file upload vulnerability is by manipulating the file extension. There is a good list at hacktricks (https://book.hacktricks.xyz/pentesting-web/file-uploadarrow-up-right). I used the following list: php php2 php3 php4 php5 php6 php7 phps phps pht phtm phtml pgif shtml htaccess phar inc hphp ctp modulea

Add list in payload options.

We can set file with .php5 extension and upload it.

Now navigate to path /uploads and we will see our payload there now click on it to execute it, and we have our shell in our Netcat listener

Navigate to /var/www/user.txt

chevron-right🚩 user.txt [Flag]hashtag

THM{y0u_g0t_a_sh3ll}

hashtag
Task 4 - Privilege escalation

hashtag
4.1 - Search for files with SUID permission, which file is weird?

Now that we are on the target machine, we need to look for ways to escalate our privileges. Using our next question as a hint we need to search for files with SUID permissions. To do this we can run the command:

/usr/bin/python

hashtag
4.2 - Find a form to escalate your privileges.

Now here we will search our gtfobins to search for any binary and I found this: https://gtfobins.github.io/gtfobins/python/arrow-up-right

Write this code in your shell:

hashtag
4.3 - root.txt [flag]

Navigate to the root directory and we will find our root flag.

chevron-right🚩 root.txt [Flag]hashtag

THM{pr1v1l3g3_3sc4l4t10n}

PreviousSimple CTFNextEternal Blue

Last updated