Mustacchio

Hello, i made a writeup for the THM - Mustacchio room. Enjoy!!

Starting with an Nmap scan;

so we visit the webpage on port 80

But we find nothing interesting so we bruteforce for directories;

Upon visiting /custom directory we find a js folder & inside we find an interesting Users.bak file

Downloading the file & upon inspecting, we find out it contains a user “Admin” & a password hash (cropped here)

we can crack this hash on crackstation.net to get the plaintext password

Now we can try to ssh with known creds now but it doesn’t work so Looking back at our Nmap scan we see there’s another web server hosted on port 8765

Now trying the creds here again and we get logged in

I tried sending a random text at first like “hello” and noticed a few things;

(1) It has a parameter called xml (2) a url in comment Example=/auth/dontforget.bak (2) Also in the html comment i see the user has an ssh key i’m suppose to get somehow

so i have to test for xxe here apparently

on the webpage we see we can make a valid xml request with the name, author & comment parameter and so we have to provide that

so sending a GET request to the url from the html comment we find an example we can use going forward

And with this now we can read the /etc/passwd file and also grab the ssh keys from this machine

and now the ssh key

now we can save the file locally and try to ssh but we find out the key password protected

For this we can use the ssh2john tool to convert the key to hash & then crack hash with john

After changing the perms for the key Now we can ssh into the Barry machine successfully using the key & password and we can find our user.txt right there;

Time to root!

Moving around & enumerating we find 2 users on the machine a an interesting binary on the Joe user;

Looking for suid bits set & we find some interesting stuff;

Still enumerating, we find out we are able to execute the file so running strings on the file reveals to us that this binary runs the tail command without the absolute path. That makes me think of Path Variable attack.

Exploiting to root!

createa file in /tmp that executes /bin/bash and give it permission to run export the PATH variable to point to the /tmp directory Now run the file

External refrences;

https://tryhackme.com/room/mustacchio
https://crackstation.net/
https://blog.g0tmi1k.com/2011/08/basic-linux-privilege-escalation/