Year of the Dog - TryHackMe Writeup

Always so polite…

##Task 1 | Flags

Who knew? The dog has some bite!

###Answer the questions below

Q. User Flag

Ans.

Q. Root Flag

Ans.

##Walkthrough

Let's begin with a full port scan against the target

Great, we can head straight to the Web Application running on port 80.

Not much to grab here. We need to run a gobuster scan and enumerate any hidden pages/files -

Not much here. /assets/ endpoint contained css, font and the background image.

After more recon, and inspecting the initial requests. Found the following -

When the first request was made, we were issued an ID which seems like a MD5 hash. Let's try tampering it's value and see if the queue number relates/depends on it.

And it does! When we change the value to 14. It returns the message - You are number Error in the queue

Now, we need to reverse engineer the logic here.

Couldn't crack the hash/string assigned. So, next we moved on to SQLi

And confirmed the vulnerability -

Great, next we'll enumerate the db -

So, the database is webapp

Soon, we are able to read local files using LOAD_FILE-

Next, we'll try and read the files we enumerated -

config.php -

index.php -

The WAF uses PHP's strstr() function, which is case-sensitive. It blocks: DUMPFILE, SLEEP, LOADFILE, AND, >, <, CONCAT, IF, ELT, 0,1 (Notice that LOAD_FILE and concatworked because they bypass the case-sensitive match!)

So, let's try and use OUTFILE to dump a Reverse PHP Webshell -

Directly writing a webshell triggered the WAF. So, To bypass this, we can encode our PHP webshell as a Hex string in MySQL. MySQL will decode the hex and write the actual PHP code to the file, but the cookie payload itself won't contain any < or > characters, so it bypasses the WAF completely! -

Moment of truth -

Works!

Let's establish a reverse listener on our attacker machine -

And, then send the payload -

Now, we have a reverse shell established!

Stabilize the shell with the following commands -

Next, we head directly to the user /home/dylan -

user.txt is not readable.

From the looks of it, work_analysis file is a log file of login attempts over SSH -

This is interesting as we can try to see if there were any failed attempts of leaking information about any other users -

Interesting find! dylanLabr4d0rs4L1f3 seems like a password accidentally entered into the username field.

Or, maybe mangled where username was dylan and password - Labr4d0rs4L1f3 .

Let's try SSH for dylan -

And we're in! Let's get the user flag -

Great, we can now focus on the Root flag and attempt Privilege Escalation.

After a few attempts we found a vulnerable SUID binary (find / -type f -perm -4000 -exec ls -l {} \; 2>/dev/null)-

So, on the attacker machine we'll first clone the exploit and host it for the SSH connection to download on the target machine -

On Attacker Machine -

On Target machine -

Then, we execute -

And, now we are root! -

Get the Root flag from /root/root.txt -

And there we have solved the room!