GithubTwitterTryHackMeHackTheBox
Page cover

THM Machine: SkyNet

Information Gathering

Got an IP from TryHackMe and I use the export command to store that IP Address in the linux environment variables.

Scanning

Starting off with a simple nmap scan to find open ports and services running on it using the following command.

From the nmap scan results it was found they have the following open ports in the system.

  • 22 for SSH

  • 80 for HTTP

  • 110 for pop3

  • 139 for netbios

  • 143 for IMAP

  • 445 for SMB that is shown as microsoft-ds in the scan result.

Enumeration

Start off the enumeration with the smb server to see how many shares they have and if can we access any of those without any credentials. SMB service many times gives us lots of information like Users, Domain Name, and Computer Name, etc.

SMB

Listing The Shares

From the above shares listing, we can see there are some shares that are not come by default i.e anonymous and milesdyson. We can try to access that without giving a password.

We got success with anonymous shares and got some files that are present in them. Upon checking I see log1.txt has some kind of password list and attention.txt some information also but they also mentioned the name Miles Dyson. We see a share name related to that also.

HTTP

Now we start enumerating the HTTP server, In the webserver, we are often interested to find some login pages, hidden files, directories, any information related to CMS and its versions if applicable, and Backend technologies and their versions, etc. After knowing that we try to find vulnerabilities in it.

Content-Discovery Result

After running ffuf for content, discovery found some pages on which squirrelmail have login functionality. I tried the fuzz with the user milesdyson as username and log1.txt as passwords list to find some valid credentials, the command is like the following.

From above

  • -w is used to specify the wordlist in that case it log1.txt file.

  • :FUZZ is a keyword used to specify a FUZZING position, In which : is a separator and FUZZ is the actual keyword. Note we can avoid it for a single list but for multiple lists, we must supply it with different keywords.

  • -u is used to specify the URL.

  • -X is used to specify the request method.

  • -d is used to specify the web request data.

  • -H is used to specify the Request Header in that case it's Content-Type: application/x-www-form-urlencoded that must be supplied because we are sending a POST request with parameters.

  • -fs is used to filter results by their response size. We got a different response and many of them had the same sizes that have wrong credentials so we filter that request size so we only get a few of them that have a valid login.

Using the above command we got a valid login credential.

Valid Credentials

Using the above credentials we can login to the squirrelmail server which is an email server in which we can send and receive emails. There we see milesdyson the user has some emails that we can read, there we found an email that says the following.

Samba Password reset

Another Password was found.

Other Emails and their content.

Nothing Special there.

SMB - Miles

We have the miles smb password now so we can login using that.

From above we see miles users have so many files in their shares but one file catches my eye, important.txt. The important.txt file has some useful things.

Above we see they write a To-do list in which they mentioned some important things related to his life and work but we are only interested in /45kra24zxs28v3yd that very looks like an http directory, and it is confirmed as a web directory when I visit. They are a valid directory but there is nothing special that we can exploit so I start the ffuf scan to do some content discovery.

Content-Discovery - /45kra24zxs28v3yd

Found an administrator endpoint very nice!!.

Exploitation & Initial Access

Administrator Page mentioned it as a cuppa CMS and by using searchsploit cuppa cms we found a potential RFI(Remote File Inclusion) vulnerability. Knowing that I download a php reverse shell code bypentest monkey. Make some changes related to IP and port number and host that file using a Python http server. Then I use the following command that exploits RFI vulnerability in which they request our shell.php` file and executed it that gives us a remote reverse shell.

Note: Open your listener using nc -lvnp 4444 before running the following command.

Privilege Escalation

After gaining access to the system with a low-privilege user www-data, I start enumerating the system like finding SUID binaries, sudo permissions, etc but nothing special is found when I use the following command to see the content of a crontab file.

I see there is a cronjob running by the root user. They are running /home/milesdyson/backups/backups.sh on every minute. I checked if can I read the backup.sh file and I see I can and they have the following content.

There they backup everything in the /var/www/html directory to backup.tgz. One thing to note they use the wildcard * which means everything i.e files, directories, etc. This is a risky thing because there is a technique named wile card injection in which we can make files that look like an argument like the ls command in which we use an argument -al to list all files. For the tar binary, there is a documented way to execute the command with the following method.

Above we create a file shell.sh in /var/www/html that has a reverse shell command on it. Then use the following command to create a file that looks like an argument of the tar command that eventually executes the shell.sh file.

Recap: We make a file in the /var/www/html directory with the names --checkpoint-action=exec=sh shell.sh, /var/www/html/--checkpoint=1 and shell.sh that has our reverse shell command on it.

So when the cronjob run tar the command executes and they take the directory name as an argument that executes our shell command. The --checkpoint-action=exec= is a legit argument of the tarcommand that is used to run a system command after compressing a file. By following the above method I eventually received a reverse shell back from the root user.

Note: You have to start your listener using the nc -lvnp 5555 Command so you can catch the reverse shell.

Now you are a root user copies the flags and submits them to TryHackMe and solves the machine.

PreviousTHM Machine RelevantNextTHM Room: Web Fundamentals

Last updated

Was this helpful?