TryHackMe|Blog WriteUp\Walkthrough (English)

Blog

Room Link: https://tryhackme.com/r/room/blog

===============================================================

• First things first do an nmap scan. You have 4 open ports 22,80, 139 and 445. Do another -A scan on these ports. You have SSH on port 22, WordPress on port 80 and a samba server.

• Add the IP to your /etc/hosts as it told you in the room.
• Start with the samba server. enum4linux -a IP -a to do all simple enumeration. This scan said to you that the null session is allowed, you have two local users: bjoel and smb, and there are 3 shares.

Null sessions are allowed.

Two local users bjoel and smb.

Three shares.

• smbclient //IP/BillySMB click enter when prompted to enter the password. ls and get [file name] for the three files found in this share.

Upon analysing these three files. There was a hidden file inside Alice_White_Rabbit.jpg. steghide extract -sf Alice_White_Rabbit.jpg the file is rabbit_hole.txt.

Too bad :). I will stop here with samba.

• Move on to port 80. As this website uses WordPress then we will do our scans with wpscan. Wpscan –url http://IP -e vp,vt,u the scan didn’t give much about vulnerable themes or plugins. But it did give us two users bjoel and kwheel. Now we will brute force their passwords with a dictionary attack. wpscan –url http://IP -u [users list] -P [password list] this scan resulted in a password for kwheel only.

Note: You cannot ssh to the server with kwheel because this user is not a user on the machine, hence it didn’t show in the enum4linux scan.

• Now that you have a user and a password, login to the website. But before that you might find a vulnerability for this specific version of WordPress searchsploit wordpress 5.0 and indeed there is a Metasploit exploit for this version. If you went and searched for it in rapid7 you will get the module name https://www.rapid7.com/db/modules/exploit/multi/http/wp_crop_rce/ which is exploit/wp_crop_rce.

• Fire up Metasploit. Choose the module and fill in the required options as follows:

Then run the exploit and you will get a meterpreter session. Now cat /home/bjoel/user.txt to get the first flag. Unfortunately, that is not the flag, even if you tired to search for it, you won’t find any, so we will move to privilege escalation. 

• shell then /bin/bash -i then upload linpeas.sh to the target system's /tmp directory, change it to executable and run it. From the scan you got an interesting, unusual binary called checker. If you tried and searched for it in GTFObins you won’t find anything, so this is our key, we just need to understand it.

If you tired to run it you will get a response telling you “Not an Admin”. Transfer this binary to your machine to analyse it. You can download it using the meterpreter session download /usr/sbin/checker.

• I will analyse the binary using Ghidra. Start ghidra file >> new project >> select “Non-Shared Project” >> Next.

Now select the folder that you want to save your project in. I created a folder called blog and chose it. name you project then click finish.

Now you will be back to the main window, from file >> import file, then choose the binary you want to analyse. You will get a window click ok. 

Now that you have your binary click on it then click on the green dragon to open the code browser.

This will open a new window from file >> open then choose your binary. It will ask you if you want to analyse it click yes. Then you will be prompted with a window leave everything as is, and just add a check next to Decompiler Parameter ID and click analyse.

This will analyse the code and you will get the binary in plain text :).

• As you can see in the picture below:

This binary uses the function getenv() to return the value of the environment variable admin, because there is no environment variable called admin it has the value null. So, it will print “Not an Admin” as we have seen previously. Simply we can solve this by making the admin variable has a value, this way the else in the if will be executed, it will make the user id 0 which is root and give us a shell back, nice !!!.

• Go back to the shell and create an environment variable called admin and give it any value export admin=one. Then, rerun checker and you will get a root shell. search for the user flag find / -name “user.txt” 2>/dev/null and you will get the user flag at /media/usb/user.txt ✨. And the root flag will be in the root’s home directory ✨.