Creative
Exploit a vulnerable web application and some misconfigurations to gain root privileges.
This work by Manav G Krishna is licensed under CC BY-NC 4.0 
Machine IP: 10.10.65.65
Nmap Scan:
From the scan we can see that the domain name is creative.thm from the http-title part. We can also find this out by just searching the machine IP in Firefox instead of waiting for the scan to complete.
Now an entry can be made in the /etc/hosts file.
Command:
Checking out port 80:
We have a contact form here:
Testing out a basic XSS Payload:
Now let's set up a netcat listener on port 80. If the above payload works we should be getting a connection back on our listener which basically shows that the server has reached out to our machine. The IP specified in the payload is the tun0 interface IP.
But unfortunately we don't get any connection on the listener.
We can now do some directory busting :
Command:
The /assets path was Forbidden.
We have no other paths.
Now let us do a VHost Busting:
Command:
There is a subdomain named: beta.creative.thm. Now we can this to the hosts file.
Checking out the newly found subdomain:
There is a dialog box where URL's can be entered and the description says it will check if the URL submitted is alive or not.
The first thought was of trying Command Injection, but had no success.
Let us now check if it is vulnerable to SSRF:
We can do this using a tool called SSRFmap which is a semi-automatic operating tool that exploits the vulnerability to fetch information. It provides ready-made modules that we can make use of.
The tool takes a Burp request file as input and a parameter to fuzz. Now let us intercept the request in Burp post clicking on Submit (The dialog box can be left empty or you can type in anything that you want to):
The parameter that we have is: url
Commands:
The portscan module scans top 8000 ports for the host.
Now the request shown in the snippet above has to be saved to a file, have named it request in this case.
Running the tool:
It found two open ports on the machine's localhost: 80 & 1337. The same output can be achieved by using ffuf, wfuzz, Burp's Intruder etc.
Now we can use payloads like these to fetch information:
Payloads:
The payload worked and now we have a listing of all the directories on the machine.
Let us get inside the /home directory:
We have a user named saad. Upon further climbing the directories, we get to the private key of saad within the .ssh directory:
We have the key in the correct format in the page source.
SSH ing in as saad:
Using the private key, post giving the file the needed permissions (chmod 400/600) we can SSH in as saad:
Command:
We notice that it is asking for the private key's passphrase. An id_rsa passphrase is an additional layer of security that can be added to the private key of an SSH key pair.
There are tools like ssh2john that converts the current private key format to John format which can then be used with John The Ripper tool to crack the passphrase.
Commands:
Note:
Since I had already done the cracking before, I have used the --show switch of john to show the passphrase.
SSH ing in as saad with the obtained passsphrase:
The user flag can now be fetched from the users /home directory. We could also take it from the URL Tester page by submitting this: http://127.0.1:1337/home/saad/user.txt.
Upon checking out the .bash_history file we find saad's password:
In Bash, your command history is stored in a file ( .bash_history ) in your home directory. Now we can check for sudo rights.
Privilege Escalation:
We can now check for saad's sudo rights/privs:
saad has the ability to run /usr/bin/ping as the root user using sudo. The LD_PRELOAD environment variable is retained when executing commands with sudo, which is used for preloading shared libraries into a program's memory.
This environment variable can be exploited to privilege escalate.
Create a C-program within a directory we have write permissions on, we can use the /tmp directory in this case:
Command:
This creates a shell.so file. The warnings can be ignored.
Command:
Now we are root and can fetch the root flag from the /root directory.
Room solved!!
Last updated