Introduction/Overview

• Challenge Name: Expose
• My Rating: Medium
• Category: Linux exploitation
• /etc/hosts: expose.thm
• Author: 1337rce
• Description: Use your red teaming knowledge to pwn a Linux machine.

Scanning/Recon & Initial Exploitation

As per usual, we start with a broad nmap scan of all ports with nmap -p- expose.thm, which returns us something similar to the following:

PORT     STATE SERVICE
21/tcp   open  ftp
22/tcp   open  ssh
53/tcp   open  domain
1337/tcp open  waste
1883/tcp open  mqtt

After investigating tcp port 1337 with nmap expose.thm -p 1337, we find a webserver. With these services, we may begin directory fuzzing on 1337 (i use gobuster)

You should get something similar to the following :

After visiting both directories, we learn that /admin_101 has a login screen with credentials already burnt in. We can test for SQLi (which was luckily my first idea) by passing hacker@root.thm` OR 1=1 -- into the username perameter in the browser.

We are then brought to a new page, which looks to me a lot like the chatgpt interface:

This was really annoying to play with, but its basically a dead end. Instead, we need to capture the login request and use sqlmap to dump as much info as possible from the page.

Using burpsuite, I capture the login request, making sure to not touch the password perameter:

POST /admin_101/includes/user_login.php HTTP/1.1
Host: expose.thm:1337
Content-Length: 37
Accept: */*
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.107 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Origin: http://expose.thm:1337
Referer: http://expose.thm:1337/admin_101/
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cookie: PHPSESSID=0h1o5fr4r09h1ph143k48vjni2
Connection: close

email=hacker%40root.thm&password=test

We then run a quick sqlmap -r burp.txt --dump`` with rockyou.txt` as our dictionary to crack the hases, and get the following info.

When we visit /file1010111/index.php and enter the given cracked password, we are prompted to hide DOM elements. I had no idea what they meant by this, so I entered the CTRL+U menu, and found this line commented out in the website code:

Hint: Try file or view as GET parameters?

Big hint there, so I decided to fuzz for lfi with

http://expose.thm:1337/file1010111/index.php?file=../../../../../../../etc/passwd

which secured that we have lfi on the machine!

This also gave us the username for our next exploitation – zeamkish

At this point, I looked through ftp on port 21 from earlier to find some way to upload a payload, but I forgot about the other section in our dump – /upload-cv00101011/index.php

Upon visiting this site, we input our new username and are met with an upload portal. Finally!!!

I upload the pentestmonkey php-reverse-shell.php, but have to rename it to php-reverse-shell.php.png in order to get past the filter. In burpsuite, we change the requested file name back to php-reverse-shell.php and upload. From this point, we can simply rlwrap nc -nvlp (whatever port you chose) and recieve your web shell.

Web shell / PrivEsc

• Initial User: www-data

Immediately, I try sudo -l to no avail. I found that I have cd permissions to /home, which found me ~/ssh_creds.txt, a text file containing the username & password for the zeamkish user. We can ssh into this, which gives us a quick PE vector into an actual user on the machine.

Now with zeamkish’s permissions, we still don’t have sudo -l unfortunately. What we do have, after uploading linpeas into /tmp with python -m http.server on my local machine, is an suid bit on /usr/bin/nano. This allows us to read and write to /etc/shadow!.

With nano /etc/shadow, we can copy the hash for zeamkish and paste it into the root password. Now, we can su root with the ssh password we got previously from ssh_creds.txt. This took me WAY too long to figure out, but I eventually came up with this method to gain root.

Conclusion

• Lessons Learned: In this supposedly easy box, we used industry standard tools such as nmap, hydra, sqlmap, burpsuite, etc in order to get sql injection on the login page, and eventually upload a php web shell which gained us initial exploitation. From here, we leveraged a misconfiguration in GNU nano to read & write to /etc/shadow. This finally gained us a root shell!

Happy hacking!!!