TryHackMe|ColddBox:Easy WriteUp\Walkthrough (English)

ColddBox:Easy

Room Link: https://tryhackme.com/room/colddboxeasy

• sudo nmap -vv IP you have port 80 open. Do another scan on all ports you will get port 4512 for SSH. After doing -A scan on both ports you will get that the website used WordPress.

• gobuster dir -w /usr/share/dirb/wordlists/common.txt -u http://IP -r you got many folders. The interesting ones are /hidden and /wp-admin. In /hidden you got a message that gave out possible usernames and we will make sure of them using wpscan later. /wp-admin is a login page.

• Now use wpscan --url http://IP -e u,vp,vt to enumerate users (u), vulnerable themes (vt), and vulnerable plugins (vp). The scan didn’t show anything about the themes and plugins but it enumerated the users hugo, c0ldd, and philip, which are the same to the ones we found in the /hidden folder. Save these names in a file called users.

• Now use wpscan --url http://IP -U [users] -P /usr/share/wordlists/rockyou.txt to get the passwords for the users. You got the password for the user c0ldd:**********. Use these credentials to sign in the page /wp-admin.

• When you sign in look around in the website for any possible way to get a reverse shell back on your machine from the target system. After some digging and searching do the following:

• From the side pane Appearance > Editor > click on 404 Template page which appears to be a php page > paste you php shell on it (use the pentestmonkey shell) > click update.

• Start a listener on your machine.

• If you go to the home page and open any post, you will notice in the URL a number that points to the page.

Change this number to any random number to activate this error page, and you will get a connection back to your machine.

• python3 -c 'import pty; pty.spawn("/bin/bash")' then transfer linpeas to the victim and run it. From the results, you will get the password in plain text for the user c0ldd.

• use c0ldd:************* and login using ssh on port 4512. You will find the first flag in the home directory of c0ldd ✨.

• sudo -l c0ldd can run vim, chmod, ftp all with sudo. All of them can be used to escalate your privileges like so:

• vim: open any file with vim using sudo then in the command mode :!/bin/bash and you will get a root shell.
• chmod: change the permissions of the /root directory, then read the file you want.
• ftp: sudo ftp then you will be prompted with ftp console !/bin/bash and you will get a root shell.

• Now retrieve the flag from /root directory ✨.