search

Blog

hashtag
Lab Setup

mkdir ~/Documents/TryHackMe/eJPT/Blog
cd ~/Documents/TryHackMe/eJPT/Blog
mkdir recon enumeration notes
touch notes/{README.md,vulns,creds}

export IP=10.10.245.192
export URL=http://$IP

hashtag
Enumeration

To set up a domain for the room, the author recommends adding "blog.thm" to the /etc/hosts file. This step is crucial for creating a designated domain for the machine.

To begin, perform a comprehensive scan of the machine's open ports using both rustscan and nmap. This dual approach ensures a thorough examination of the network, providing a more detailed understanding of the available services and potential vulnerabilities.

  • nmap

nmap -Pn -p- -v -T4 --max-retries 5 $IP -oN recon/nmap.init;
cat recon/nmap.init | grep '/.*open'| cut -d '/' -f 1| tr '\n' ', '| sed 's/.$//g' > recon/ports;
sudo nmap -Pn -sS -sV -n -v -A -T4 -p $(cat recon/ports) $IP -oN recon/nmap.alltcp

  • rustscan

rustscan -a $IP --ulimit 5000 -- -sC -sV -v -oN recon/rustscan.init

Before to access the website I try to get some info about shares using enum4linux tool.

I downloaded three files, but they didn't contain useful information. Now, I'm moving on to check the website to see if there's anything there that could help.

We already found a user so I use wpscan to brute force and get password for this user. After minutes of waiting I got nothing so I enumerate for users and I found another user -> kwheel

Found the password for kwheel user

hashtag
Exploitation

In the room description, there's a crucial clue pointing to a specific CVE that we need to leverage. This information is key to advancing in the challenge.

There are 2 methods to do this machine. We can use a script or metasploit framework.

LogoGitHub - oussama-rahali/CVE-2019-8943: Exploit of CVE-2019-8942 and CVE-2019-8943GitHubchevron-right

I get access on the machine and after a lot of enumeration I found a file with suid tag -> /usr/sbin/checker

Let's download the file and employ reverse engineering tools and techniques to understand its functionality.

Upon examining the source code, it appears that setting the environment variable "admin" to 0 will grant root privileges when the code is executed. To proceed, simply set the "admin" variable to 0 before running the code. This should elevate the privileges as intended.

PreviousOllieNextKoTH Hackers

Last updated