search

πŸ‘ΊMustacchio

hashtag
License

The following post by anthonyjsaab is licensed under CC BY 4.0arrow-up-right

hashtag
0 - Introduction

Link to room: https://tryhackme.com/r/room/mustacchioarrow-up-right

Machine version: Mustacchio V2

This writeup walks you through a room on TryHackMe created by zyeinnarrow-up-right

hashtag
1 - Port Scans

hashtag
1a - Discovery

β”Œβ”€β”€(kaliγ‰Ώkali)-[~]
└─$ sudo nmap -sS -T4 -p- -Pn mustacchio.thm
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-05-21 18:56 EEST
Nmap scan report for mustacchio.thm (10.10.75.137)
Host is up (0.100s latency).
Not shown: 65532 filtered tcp ports (no-response)
PORT     STATE SERVICE
22/tcp   open  ssh
80/tcp   open  http
8765/tcp open  ultraseek-http

Nmap done: 1 IP address (1 host up) scanned in 111.50 seconds

hashtag
1b - Versioning and OS fingerprinting

hashtag
1c - Vulners

hashtag
2 - Port 80

hashtag
2a - Dirbusting

After going though the files and folders shown above, we can find a file named users.bak here:

hashtag
2b - Opening users.bak

The file extension .bak is a generic suffix used to designated a backup file. Thus, it does not tell us what kind of file we have and how to open it. The first tool to use is exiftool:

It did not help us. Next, we try to opening it using Mousepad:

Bingo! It seems we have an SQLite3 database

After some searching for a login portal, we find that the port 8765 has one.

hashtag
3 - Port 8765

hashtag
3a - Logging in

Trying to login using the recovered credentials does not work. I suspect that the password was not stored in plaintext but as a hash. Thus, we need to crack it and try again:

Bingo!
We are in!

hashtag
3b - Comment input

hashtag
3bi - Probing

Tried to submit an empty text field. This error poped up
Submitting the word 'test' gives us this

Now this is clear. The input text field requires those 3 child elements: name, author and comment. Let us try:

Submitting this XML code returns the above comment preview

I couldn't figure out the correct tag for the comment section, but I guess we won't really need it since two others are working.

Now, I wasn't sure what I could do with this field. I googled XML attacks, and found this interesting webpage: https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processingarrow-up-right

hashtag
3c - XXE powered exfiltration

I crafted this payload:

and got this:

We now know the target machine has two human user accounts: joe and barry

Let us try to retrieve their respective SSH private keys.

It worked for barry only and not joe.

hashtag
4 - SSH

hashtag
4a - SSH key cracking

The above key is encrypted. We need to crack it.

hashtag
4b - Foothold!

hashtag
5 - PrivEsc

hashtag
5a - Looking around

The first move I always do when establishing foothold is go to the home directories of other users. Looking into joe's home dir:

This is important, we have a root-owned executable with the SUID bit set! Let us look into this.

hashtag
5b - Weaponizing and Escalation

We exfiltrate the ELF executable to our Kali machine for further analysis:

Nice! It seems the executable is executing tail. Let us check if this is right:

It does seem to execute tail on a log file. Since a relative path was used to reference tail, we can change PATH and make live_log launch a program of our choice with root privileges.

PreviousmKingdomNextOpacity

Last updated