TryHackMe - Jack
Last updated
Last updated
We start by enumerating the box and notice that its running WordPress. Then using the wpscan tool, we can enumerate users and get some credentials by brute-forcing the application.
To get a reverse shell we escalate our privileges from normal user to administrator on WordPress and then edit the php file and inject our reverse shell code
After getting a reverse shell as user www-data, we can find the id_rsa ssh key of jack
After enumerating the box with linpeas.sh, we notice that there is a cron job executed by root which is running a script that imports the os module which we have read and write access.
We modify the os module and get a reverse shell as root.
nmap, wpscan, Burp, pspy
There is a note saying we should add jack.thm to the /etc/hosts
Edit your /etc/hosts file and add:
Visiting the site
From the nmap results, we can see the /wp-admin/ in the results which takes us to the WordPress login form, but we don't have any credentials yet.
I used the following command below to enumerate users.
Users Found:
We create a file named users.txt and those usernames. Now we can try to brute force WordPress and see if we get lucky.
Use the -h to get help for wpscan, but basically -U is the file with the users, -P is the password wordlist I used, and then the --url to point it to the target.
After a few minutes, we get the password for wendy and we can successfully login.
After login into the dashboard, there is no much we can do to get a reverse shell, however there is an exploit that allow us to get administrator privileges on the WordPress dashboard and that should help us get some code execution.
You can use metasploit, but we are going to do it manually.
The first thing we need to do, is start Burp Suite and intercept the requests. Then, we go to Profile
Click Update Profile
The request will look as follows
Add the following to the Request (our change was added before &action)
The edited request should look like this
Then click forward to allow Burp to send the edited request, and your dashboard should now look as follows:
Go to Plugin Editor
You will be prompted with a Warning letting you know that you should not be editing the plugins directly. Click "I understand"
Now we are going to add our code and hopefully get a reverse shell
We are going to use the following to get our reverse shell
Click on Update File
We go to Installed Plugins and click Activate
And, we get a shell
To get a proper shell, follow the following steps:
We can get the user flag and continue enumerating.
Checking out the reminder.txt file, we noticed something related to backups, so we do some enumeration and find a backups folder with an ssh key which we can use to login as jack.
We search for a directory named backup and we find something under /var
List of files under /var/backups
We can login as user jack after changing the permissions of the id_rsa to 600
Using pspy to monitor the processes that are running, we notice that root has a cronjob running every minute. The script is located at /opt/statuscheck/checker.py
The contents of the script shows that it imports the python module os
With all that information we discovered, it's time to do some further enumeration. We noticed that the user jack is part of the family group which has the ability to write on any files under the /usr/lib/python2.7/ directory. This is good because the os module is under that directory and our user jack has write access to that module.
To exploit this, we edit the /usr/lib/python2.7/os.py module and add the following reverse shell all the way at the end.
We start a listener and wait a minute for the cronjob to run, and we get a root shell.
