Chill Hack

Lab Setup

mkdir ~/Documents/TryHackMe/eJPT/ChillHack
cd ~/Documents/TryHackMe/eJPT/ChillHack
mkdir recon enumeration notes
touch notes/{README.md,vulns,creds}

export IP=10.10.44.40
export URL=http://$IP

Enumeration

First let's scan the machine for open ports. I usually do this with nmap You need to run this command as root.

nmap -Pn -p- -v -T4 --max-retries 5 $IP -oN recon/nmap.init;
cat recon/nmap.init | grep '/.*open'| cut -d '/' -f 1| tr '\n' ', '| sed 's/.$//g' > recon/ports;
sudo nmap -Pn -sS -sV -n -v -A -T4 -p $(cat recon/ports) $IP -oN recon/nmap.alltcp

This will take a while so I use rustscan to make a quick scan.

rustscan -a $IP --ulimit 5000 -- -sC -sV -v -oN recon/rustscan.init

Before accessing the website I like to see what can I find in ftp server. And I found something interesting, 2 possible user, Anurodh and Apaar.

Now let’s enumerate the website using feroxbuster and dirsearch

After this I found an interesting directory, /secret Here we can inject commands, but it looks that the application has some filleter.

Exploitation

After trying a lot of reverse shell I found something that it works.

Now get some info about the server. Using netstat command to see connections on this machine. 9001 port is mine 53 is for DNS, so 3306 remain for investigate. 3306 port is default port for SQL.

In /var/www/files/index.php I found something interesting. I assume that this are creds for sql database.

Let’s crack this hashes and get the passwords for apaar and anurodh.

anurodh:masterpassword apaar:dontaskdonttell

After some tries it seems that this are not the credentials for ssh , so let’s enumerate to see what can we found.

I found in home directory of apaar a file that can be read by www-data. And if you check what www-data can execute (sudo -l) you’ll see that this file can be execute.

Privilege Escalation

I came across an intriguing file in the /var/www/files/images folder, prompting me to set up a simple HTTP server using Python to facilitate the download of said file. Upon further investigation, I identified a file named backup.zip.

It seems that I need a password to unzip that file so I use john to crack that password.

I have obtained a PHP file named source_code.php, in which I discovered credentials associated with the username 'anurodh'.

After some enumeration I found the answer.

PreviousBrooklyn Nine NineNextUndiscovered

Last updated