You have been assigned to a client that wants a penetration test conducted on an environment due to be released to production in three weeks.
Scope of Work
The client requests that an engineer conducts an external, web app, and internal assessment of the provided virtual environment. The client has asked that minimal information be provided about the assessment, wanting the engagement conducted from the eyes of a malicious actor (black box penetration test). The client has asked that you secure two flags (no location provided) as proof of exploitation:
User.txt
Root.txt
Additionally, the client has provided the following scope allowances:
Ensure that you modify your hosts file to reflect internal.thm
Any tools or techniques are permitted in this engagement
Locate and note all vulnerabilities found
Submit the flags discovered to the dashboard
Only the IP address assigned to your machine is in scope
PORT STATE SERVICE
22/tcp open ssh
| ssh-hostkey:
| 2048 6e:fa:ef:be:f6:5f:98:b9:59:7b:f7:8e:b9:c5:62:1e (RSA)
| 256 ed:64:ed:33:e5:c9:30:58:ba:23:04:0d:14:eb:30:e9 (ECDSA)
|_ 256 b0:7f:7f:7b:52:62:62:2a:60:d4:3d:36:fa:89:ee:ff (ED25519)
80/tcp open http
|_http-title: Apache2 Ubuntu Default Page: It works
We got admin user credentials and now we can login with that.
Private Post has some Credentials
To-Do
Don't forget to reset Will's credentials. william:arnold147
Exploitation
Now we are login in so we can edit the php file from the following link like index.php with our reverse shell code and visiting this will give us reverse shell or code execution. http://internal.thm/blog/wp-admin/theme-editor.php?file=index.php&theme=twentyseventeen
By editing and adding index.php with the following code I can now run system commands
You can get the reverse shell directly but I like it this way.
After getting the reverse shell I see wp-config.php that file contains MySQL Database credentials and found the following credentials.
DB_User: wordpress
DB_Password: wordpress123
Using that we can login with the MySQL database locally and there is a phpmyadmin directory that is a GUI version of the interacting MySQL database so we can check him also for getting some useful things.
POST Exploitation
There is only one user aubreanna. And I try every credential I found yet to login with that but no one works. And there are no special SUID and Capabilities binaries found that we can use for priv-esc.
But when I use the ls command on the /opt endpoint there is a file name wp-save.txt that has some juicy things.
Bill,
Aubreanna needed these credentials for something later. Let her know you have them and where they are.
aubreanna:bubb13guM!@#123
And It's a valid credential so use that to connect with ssh In the user home directory, there's a file name jenkins.txt that has the following content.
Internal Jenkins service is running on 172.17.0.2:8080
They mentioned there is a Jenkins server running locally on port 8080 and we can confirm that using the ss -tupln command. Now we have to do a port forward to access that port and we can do that using ssh port tunneling with the following syntax.
After using the above command they tunnel the local Jenkins server port to our local 8080 port so now we can access the Jenkins server. I try to default admin:admin credentials but it doesn't work so I try a bruteforce attack. The bruteforce may take too much time and we can only guess the credentials by their response size so we have to filter our results with response size. I try using the hydra HTTP-form bruteforce method or some other method they didn't able to guess the password so we had to use burp intruder or zap proxy or any other method that can filter with response size. after that, we can get the following valid credentials
Jenkins Server Credentials
admin:spongebob
Now we are login in to Jenkins so there are many ways we can get the reverse shell back from Jenkins but I use the groovy script method. First I got the /script endpoint and there we have a groovy script box we can copy and paste the following groovy reverse shell scrip there and after running that we can get the reverse shell back.
After getting the Jenkins reverse shell I again use methods like finding SUID, GUID, and capabilities but didn't find anything useful so I use the ls /opt command there is a file name note.txt that has root user credentials. We can now login to the root user account with the followings credentials using ssh
root:tr0ub13guM!@#123
ssh root@internal.thm
password: tr0ub13guM!@#123
And we got a root user to use the cat command to read the root.txt file from the /root directory submit it to TryhackMe and complete to room.
