OSCP Preparation TryHackMe 01: Vulnersity
Notification: This is not a technical step-by-step guide.
Summary
a. Initial Access
Web upload RCE
b. User Access
Web upload RCE
c. Root Access
SUID /bin/systemctl
a. Gobuster should at least run twice to enumerate the first round found folder.
b. Common Php extensions
.php
.php1
.php2
.php3
.php4
.php5
.phtml
c. To identify which extensions are not blocked can use:
Fuzz to upload form
Burp Suite set the payload to "sniper" to attack
Procedure
1. Port Scan
$nmap -vv 10.10.132.213 ##scan top 1000 ports
$nmap -sV 10.10.132.213 ##scan top 1000 ports with port service version
$nmap -A -p- -T4 10.10.132.213 ##All os/service, all ports, fast module
2. Service Enumation
21 Port
Vsftpd 3.0.3
No anonymous login
No exploit
22 Port
SSH-2.0-OpenSSH_7.2p2 Ubuntu-4ubuntu2.7
139, 445 Port
3138 Port
3333 Port
Web http server
Gobuster found /internal/ upload location
Gobuster found/internal/uplaod/, looks file saved location
Not allow txt,php conmon extension
Tested allow .phtml extension upload
3. User Access
Gobuster
$gobuster dir -u http://10.10.132.213:3333 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
$gobuster dir -u http://10.10.132.213:3333/internal -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
The website does not allow PHP reverse shell to upload. tested common extension. bypassed with .phtml
Manage to get the reverse shell
4. Privilege Escalation
Check SUID permission
$$find / -perm -u=s -type f 2>/dev/null
Cross compared with GtfoBins SUID list I created, match "systemctl" value
Modify the command to get root permission reverse shell
Comments
Post a Comment