Tryhackme | All in one writeup

Nmap

Commencing with a thorough Nmap scan, the examination of the target environment brought forth crucial findings. Port 21 revealed the existence of an FTP service, indicating possible opportunities for file interaction, while the presence of Port 80 showcased an active Apache web server. This initial revelation serves as a solid foundation for further investigation, providing valuable insights into potential vulnerabilities and avenues for cybersecurity exploration. The concise and informative nature of this initial review sets the stage for a more in-depth analysis of the target’s digital architecture.

──(kali㉿kali)-[~/Documents/all-in-one]
└─$ nmap -p21,22,80 -A -T4 10.10.81.69
Starting Nmap 7.93 ( https://nmap.org ) at 2023-11-14 14:41 EST
Nmap scan report for 10.10.81.69
Host is up (0.039s latency).

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 9.92 seconds

┌──(kali㉿kali)-[~]
└─$ dirb http://10.10.81.69/

Dirbuster

START_TIME: Tue Nov 14 14:42:03 2023
URL_BASE: http://10.10.81.69/
WORDLIST_FILES: /usr/share/dirb/wordlists/common.txt

GENERATED WORDS: 4612

—- Scanning URL: http://10.10.81.69/ —-

http://10.10.81.69/index.html (CODE:200|SIZE:10918)
http://10.10.81.69/server-status (CODE:403|SIZE:276)
==> DIRECTORY: http://10.10.81.69/wordpress/

—- Entering directory: http://10.10.81.69/wordpress/ —-

http://10.10.81.69/wordpress/index.php (CODE:301|SIZE:0)

WordPress plugin

Executing DirBuster with a common.txt file on the target web server bore fruit, unveiling a WordPress site in its digital domain. Further exploration uncovered a vulnerability in a plugin susceptible to Local File Inclusion (LFI) attacks. This discovery unveils a potential avenue for exploitation, as LFI vulnerabilities can be leveraged to access and retrieve sensitive files from the server. The identification of this specific weakness opens the door to targeted security measures and reinforces the need for a meticulous examination of the WordPress installation to mitigate the risk associated with the LFI vulnerability.

http://10.10.81.69/wordpress/wp-content/plugins/mail-masta/inc/campaign/count_of_send.php?pl=php://filter/convert.base64-encode/resource=../../../../../wp-config.php

Exploit

In a meticulous exploration of the target’s web server, I identified a Local File Inclusion (LFI) vulnerability. Leveraging this vulnerability, I skillfully accessed the contents of the wp-config file using PHP, then took a security-conscious step by encoding the output to base64, enhancing the confidentiality of the extracted data.

The decoded output revealed sensitive information, specifically the database credentials: ‘elyana’ as the database username and ‘H@ckme@123’ as the corresponding password. Recognizing the prevalence of password reuse in various contexts, I made an informed decision to attempt those credentials for login access..

This strategic move proved successful, granting me unauthorized access through login credentials obtained from the LFI vulnerability. This scenario underscores the importance of promptly addressing and patching vulnerabilities to mitigate potential breaches and unauthorized access. It also highlights the significance of strong, unique passwords to enhance overall system security and resilience against such exploits.

/** MySQL database username */

define( ‘DB_USER’, ‘elyana’ );

/** MySQL database password */

define( ‘DB_PASSWORD’, ‘H@ckme@123’ );

php shell mod the 404.php templat

http://10.10.81.69/wordpress/wp-content/themes/twentytwenty/404.php

REVERS SHELL

Engaging in an unconventional approach to exploit the WordPress site, a consistent method involves the modification of the 404.php file within the themes folder. The chosen technique involves inserting a reverse PHP shell from “https://github.com/pentestmonkey/php-reverse-shell/blob/master/php-reverse-shell.php.” Remarkably, this strategy has proven to be consistently effective, yielding successful callbacks.

By leveraging this method, unauthorized access to the target system is achieved, demonstrating a notable proficiency in exploiting vulnerabilities within the WordPress environment. This persistent success underscores the importance of addressing and fortifying against such attack vectors, as well as the necessity for rigorous security measures to protect WordPress sites from potential compromises.

Privesc

Engaging in a targeted scan using LinPEAS, a bash SUID is identified, providing an exploitable avenue for privilege escalation. Leveraging the resourceful GTFOBins (https://gtfobins.github.io/gtfobins/bash/), you swiftly navigate through the SUID permission and elevate privileges, attaining root access and successfully obtaining the coveted flag.

This efficient and direct approach underscores the significance of comprehensive security measures to prevent unauthorized privilege escalation. Additionally, the encoded base64 flag serves as a reminder of the importance of secure data handling practices to safeguard sensitive information within the system.

root
VEhNe3VlbTJ3aWdidWVtMndpZ2I2OHNuMmoxb3NwaTg2OHNuMmoxb3NwaT–

user
VEhNezQ5amc2NjZhbGI1ZTc2c2hydXNuNDlqZzY2NmFsYjVlNzZzaHJ1c2–

base64 encodet

Boot2root

Everyone gets Hit