Weak [TryHackMe] Walkthrough
I recently developed a THM Room for a CTF event at my college and here is the Walkthrough !!
Link: https://tryhackme.com/jr/weak
Note: The box does take upto 5–7 Minutes to properly start all services so you gotta be a little patient :)
Recon
A basic port scan of the box reveals that ports 80 and 22 are open with valid services(http and ssh respectively).
Enumeration
Http
The http page has no active buttons or anything, so source code analysis and directory busting is something I would do.
This particular comment begs the possibility of tyrone being a valid user on the box.
Meanwhile, directory busting reveals the existence of a file called impressum.txt
Which so luckily looks like a private key for ssh login.
Putting two and two together, login can be achieved for tyrone.
More Enumeration
After login, local.txt is immediately found in /home/tyrone/
Further the /var/www/html/ has a file called flag2 which we are not allowed to read
Looking at it closely, its owned by tyrone himself, so we can change the permissions and let us read it.
A casual grep on the file contents show us two more files which can be read once we change their permissions
The Root directory has a text file which can be read by tyrone but is clearly not a flag
baseRot1364 looks like a base64 wrapper around rot13
Base64 — Rot13 — Base64
Privilege Escalation
The user tyrone has no sudo permissions and no as such credentials available in any directories.
Looking at the SUID bits with the following command lets us look at binaries which allow any user to execute them as the user that owns them
find / -perm -4000 2>/dev/null/usr/bin/tee is an interesting binary with a notable GTFObins descriptions.
Now we can overwrite any file in the file system. ( Easy Priv Esc through /etc/passwd)
However, there is another Privilege Escalation Vector which I would Like to display.
Lets Monitor Services to see what crontab is running .
Something, Somewhere is triggering a script. The UID is zero, so probably root.
Root access now easily available via an easy GTFOBins command
cd to root and grab the proof.txt ezpz.
Any comments, suggestion or critique can be communicated to me via Twitter, LinkedIn or dropping a comment here
@JodisKripe
