Personal WebsiteGithubLinkedIn

LazyAdmin

https://tryhackme.com/room/lazyadmin

Task 1:

What is the user flag?

Let's perform a nmap scan against the target machine.

$ nmap -sC -sV 10.10.37.233               
Starting Nmap 7.92 ( https://nmap.org ) at 2023-12-12 09:12 IST
Nmap scan report for 10.10.37.233
Host is up (0.16s latency).
Not shown: 998 closed tcp ports (conn-refused)
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.2p2 Ubuntu 4ubuntu2.8 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 49:7c:f7:41:10:43:73:da:2c:e6:38:95:86:f8:e0:f0 (RSA)
|   256 2f:d7:c4:4c:e8:1b:5a:90:44:df:c0:63:8c:72:ae:55 (ECDSA)
|_  256 61:84:62:27:c6:c3:29:17:dd:27:45:9e:29:cb:90:5e (ED25519)
80/tcp open  http    Apache httpd 2.4.18 ((Ubuntu))
|_http-server-header: Apache/2.4.18 (Ubuntu)
|_http-title: Apache2 Ubuntu Default Page: It works
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 36.75 seconds

There are two open ports:

Ports
Service

22

ssh

80

http

We can now use gobuster to brute force the web directories.

Let's visit the /content page.

Let's perform a directory scan inside the /content web directory.

If we go to the /content/inc page, we see the following:

Let's go inside the /content/inc/mysql directory.

We can download and open this file in a text editor.

If we look closely we can see the following credentials:

User
Password hash

manager

42f749ade7f9e195bf475f37a44cafcb

Since the password is hashed, we need to first identify the type using hash-identifier.

Now we can use john to crack the hash and obtain the password.

If we go to the /content/as page we will come across a login form which we can login to using the following credentials:

Username
Password

manager

Password123

Now that we are in the admin panel, we can start looking for some exploits.

We can obtain a reverse shell from the Revshells page.

Once we have it stored in a file, we can upload the file in the Media Center of the admin panel with a php5 extension.

Next, we have to set up a nc listener.

Then we can visit the /content/attachment/ page to access our exploit.

Let's check our listener.

We can now cat out the user flag.

Answer

What is the root flag?

Let's check what commands our user can execute as root using the sudo -l command.

So we can run the backup.pl script as root without any password. Let's check what the script does.

The ./backup.pl script executes the /etc/copy.sh script. Let's check what that script does.

So it establishes a reverse shell to 192.168.0.190 on port 5554. We can replace the IP and port to our own so that the reverse shell connection is sent to us.

We now have to set up a nc listener and execute the /home/itguy/backup.pl script using sudo.

Let's check our nc listener.

As we can see, the reverse shell connection has been caught by our listener. We can now read the root flag.

Answer

Last updated

Was this helpful?