Personal WebsiteGithubLinkedIn

ConvertMyVideo

https://tryhackme.com/room/convertmyvideo

What is the name of the secret folder?

Let's perform a simple nmap scan against the target.

$ nmap -p- 10.10.162.57 -T5
Starting Nmap 7.92 ( https://nmap.org ) at 2024-02-08 12:08 IST
Warning: 10.10.162.57 giving up on port because retransmission cap hit (2).
Nmap scan report for 10.10.162.57
Host is up (0.13s latency).
Not shown: 64219 closed tcp ports (conn-refused), 1314 filtered tcp ports (no-response)
PORT   STATE SERVICE
22/tcp open  ssh
80/tcp open  http

Nmap done: 1 IP address (1 host up) scanned in 657.11 seconds

We can now run an advanced scan against the open ports.

┌──(kunal㉿kali)-[~/tryhackme]
└─$ nmap -A -p 22,80 10.10.162.57
Starting Nmap 7.92 ( https://nmap.org ) at 2024-02-08 12:22 IST
Nmap scan report for 10.10.162.57
Host is up (0.13s latency).

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 65:1b:fc:74:10:39:df:dd:d0:2d:f0:53:1c:eb:6d:ec (RSA)
|   256 c4:28:04:a5:c3:b9:6a:95:5a:4d:7a:6e:46:e2:14:db (ECDSA)
|_  256 ba:07:bb:cd:42:4a:f2:93:d1:05:d0:b3:4c:b1:d9:b1 (ED25519)
80/tcp open  http    Apache httpd 2.4.29 ((Ubuntu))
|_http-title: Site doesn't have a title (text/html; charset=UTF-8).
|_http-server-header: Apache/2.4.29 (Ubuntu)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 13.65 seconds

There are two open ports with the following services:

Port
Service

22

ssh

80

http

Now, we can use gobuster to perform directory brute forcing.

We can see that the /admin page is throwing a 401 error. This means that we are unauthorized to access it.

Answer

What is the user to access the secret folder?

Let's visit the target's website.

Let's provide the following input:

As we can see, that did not provide us with any information.

Let's intercept the request in Burpsuite and check the response.

If we use the --default-search flag in our command, we get a different output.

We can escape the flags by adding -- before the command.

Let's change the yt_url parameter to the following to check if we have a command execution vulnerability on our hands:

Now, let's create a simple a Bash reverse shell script.

Let's set up a Python3 server on our machine.

We can now set the yt_url parameter to the following to download the reverse shell on the target.

Note that in order for this command to work, there needs to be a TAB between wget and http instead of a SPACE.

Now, let's set up a nc listener.

Next, we have to execute the reverse_shell.sh file on the server using the following:

Let's check back on our nc listener.

Let's list out the files in the current directory.

We can now cat out the .htpasswd file.

There's the user that has access to the secret folder.

Answer

What is the user flag?

We can find the flag in the /var/www/html/admin directory.

Answer

What is the root flag?

In order to escalate privileges, we need to run the pspy tool which we have to transfer to the target machine.

For that, let's set up another Python3 server.

Now using wget we can download the necessary file.

Let's execute the pspy file and observe the output.

As we can see, the /var/www/html/tmp/clean.sh file is being executed by the machine with the UID set to 0.

This means we can obtain a reverse shell with root privileges.

First, we have to set up a nc listener.

Next, we have to add the reverse shell code to the clean.sh file.

After around a minute, when the system next executes the /var/www/html/tmp/clean.sh file, we will get our reverse shell with root privilege.

Let's cat out the root flag.

Answer

Last updated

Was this helpful?