search
Page cover

Plotted-TMS (FileUpload, Cronjob, Openssl)

First, we need to enumerate using nmap.

╭─hnl@hnl ~/Desktop/ctf/tryhackme/plotted-tms  
╰─➤  nmap -A 10.10.44.17 | tee nmap.log
Starting Nmap 7.80 ( https://nmap.org ) at 2022-04-03 22:32 +0630
Nmap scan report for 10.10.44.17
Host is up (0.23s latency).
Not shown: 997 closed ports
PORT    STATE SERVICE VERSION
22/tcp  open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
80/tcp  open  http    Apache httpd 2.4.41 ((Ubuntu))
|_http-server-header: Apache/2.4.41 (Ubuntu)
|_http-title: Apache2 Ubuntu Default Page: It works
445/tcp open  http    Apache httpd 2.4.41 ((Ubuntu))
|_http-title: Apache2 Ubuntu Default Page: It works
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Host script results:
|_smb2-time: Protocol negotiation failed (SMB2)

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 126.19 seconds

SSH and HTTP ports are open. Let's enumerate HTTP. We will see index of the apache is open.

So, we will check web directory using gobuster. We can't scan at default port 80. Change port to 445. There are too many errors while scanning. But we found a directory called management

When you go to http://10.10.44.17:445/management/, you will see login button and click it. It will point you to http://10.10.44.17:445/management/admin/login.php. We can bypass using simple sqli methods like admin' or '1'='1.

It will redirects to you to system administrators page.

In system logo, upload a php reverse shell files. And then you will get a revere shell.

With a lot of enumeration, I found a cronjob which is running with plot_admin privileges.

We can change the file name backup.sh to backup.sh.bak. And then replace with our reverse script file.

In netcat sessions, we got reverse shell with plot_admin privileges.

Find setuid file using find commands. I will hightlight some interesting files.

/usr/bin/doas is quiet interesting. First, we will analyze file type. The configuration of /usr/bin/doas is located at /etc/doas.conf.

Is it a hint? Can we run openssl command using root privileges. Let's try this. Here is a link https://gtfobins.github.io/gtfobins/openssl/. The below part is the reading root flag.

The below part is to get root shell access.

PreviousOh My Webserver (CVE-2021-41773, Capabilities, Docker, CVE-2021-38647)NextInsekube (Kubernetes)

Last updated