TryHackMe|Gallery WriteUp\Walkthrough (English)

Gallery

Room Link: https://tryhackme.com/r/room/gallery666

================================================================

• After the Nmap scan, you will see 2 ports open 80 and 8080. 8080 doesn’t have anything interesting. In 80 the main page has the home page for nginx server. Use gobuster to find any hidden directories. There is /gallery.
• In /gallery you have a login page. Try to see if sqli works on it. 

Enter " ‘ or ‘1’ = ‘1’ -- - " in the username field and see if it allows you to get in, and it did :).

• Once you are in you can answer the second question which is the CMS, the website uses Simple Image Gallery. Although there is a known vulnerability for this, you don’t need it. Go to albums from the top horizontal menu. Then, click on any of the albums and upload a .php webshell, I used the one from pentestmonkey. Do not forget to change the IP into your IP and set up a netcat listener with the same port number as in the shell.

• Once you have your webshell uploaded click on it and you will get a shell back on your machine. Do these steps to make your shell more stable and to make it not end any time you do ctrl+c.
• python3 -c 'import pty; pty.spawn("/bin/bash")'
• export TERM=xterm
• Background the shell by ctrl+z
• stty raw -echo;fg
• Now you can complete your work :).
• You will get a shell with the user www-data. Go to the directory of www-data which is /var/www and you can get this info from the /etc/passwd file. cd html then cd gallery and start looking into the files.

The file initialize.php has an interesting content. You can use these information to log in into the mysql server.

mysql --user = gallery_user --password = ********* gallery_db once you are in use gallery_db; >> show tables; >> select * from users; and you will get the hash of the admin’s password.

• Now you want to get the user flag. First what users are on the system? You can know that by ls /home you have two users mike and ubuntu. You don’t have the permissions to go to mike’s home directory. So upload linpeas.sh to the victim's machine run it and look at the results from the scan.
• In the picture below the scan retrieved what appears to be a password used after sudo -l command. It might be mike’s.

su mike then provide the password and you will be mike. You can now cd /home/mike and retrieve the user.txt ✨.

• Now you need to be root in order to read root.txt from the root’s home directory. sudo -l it shows that the user Mike can run the rootkit.sh script with root permissions, nice!.

• cat /opt/rootkit.sh to see what this script does.

This script checks the version, or update, or list the /usr/bin/rkhunter file. Or you can read the report.txt file from the root’s home directory with nano. In other words, this script allows you to open a nano shell with root privileges.

• Go to GTFObins and search for nano. Since the binary is allowed to be run as super user you do the following:

• sudo /bin/bash /opt/rootkit.sh
• type read and press enter
• once you are in a nano shell click ctrl+r and ctrl+x and then reset; sh 1>&0 2>&0

and you will be prompted with a root shell. /bin/bash -i >> cat /root/root.txt ✨.